CVE-2026-103433Published
Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions
cve-program ·
Vendor product: Docker Buildx
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698260 source statements · aliases may refer to the same vulnerabilityCVE-2026-93315Published
BuildKit proxy CA cleanup can be disrupted by build steps
cve-program ·
Vendor product: github.com/moby/buildkit
CVE-2026-93321Published
Malformed LLB file operation can crash buildkitd
cve-program ·
Vendor product: github.com/moby/buildkit
CVE-2026-105484Published
TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection
cve-program ·
Vendor product: X6000R
CVE-2026-105753Published
vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core
cve-program ·
Vendor product: vllm
CVE-2026-105757Published
vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)
cve-program ·
Vendor product: vllm
CVE-2026-105572Published
PickMall Lilishop Buyer Invoice List receipt authorization
cve-program ·
Vendor product: PickMall Lilishop
CVE-2026-105621Published
jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
cve-program ·
Vendor product: jshERP
CVE-2026-105762Published
Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
cve-program ·
Vendor product: dify
CVE-2026-105784Published
Joplin whiteboard card rendering allows CSS injection into application chrome
cve-program ·
Vendor product: joplin
CVE-2026-104380Published
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one
cve-program ·
https://cpan.org/modules: Punk
CVE-2026-105471Published
girishsaraf Online-Appointment-Booking-System Registration signup.php sql injection
cve-program ·
Vendor product: Online-Appointment-Booking-System
CVE-2026-76728Published
Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs
cve-program ·
Vendor product: Instant ON
CVE-2026-105706Published
SourceCodester Drug Recommendation System cross-site request forgery
cve-program ·
Vendor product: Drug Recommendation System
CVE-2026-28625Published
In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
cve-program ·
Vendor product: Android
CVE-2026-28640Published
In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges…
cve-program ·
Vendor product: Android
CVE-2026-28641Published
In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution priv…
cve-program ·
Vendor product: Android
CVE-2026-28647Published
In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User intera…
cve-program ·
Vendor product: Android
CVE-2026-105487Published
yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection
cve-program ·
Vendor product: reNgine
CVE-2026-105610Published
chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization
cve-program ·
Vendor product: SpringBlade
CVE-2026-105776Published
bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL admin_transaction.php sql injection
cve-program ·
Vendor product: Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL
CVE-2026-57545Published
Untrusted Pointer Dereference in Graphics
cve-program ·
Vendor product: Snapdragon
CVE-2026-25270Published
Out-of-bounds Write in Camera Driver
cve-program ·
Vendor product: Snapdragon
CVE-2026-105708Published
imgproxy SVG svg.go sanitizeElement cross site scripting
cve-program ·
Vendor product: imgproxy
CVE-2026-105704Published
SourceCodester Drug Recommendation System Auth Guard improper authentication
cve-program ·
Vendor product: Drug Recommendation System
CVE-2026-75818Published
Heap Buffer Overflow in GNU Aspell's prezip utility
cve-program ·
Vendor product: Aspell
CVE-2026-75820Published
Integer Truncation Leading to Heap Corruption in GNU Aspell
cve-program ·
Vendor product: Aspell
CVE-2026-56596Published
HCL BigFix Service Management is affected by multiple security vulnerabilities.
cve-program ·
Vendor product: HCL BigFix Service Management
CVE-2026-82531Published
Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache
cve-program ·
Vendor product: smarty
MAL-2026-17637Published
Malicious code in captchetat-angularv8 (npm)
osv · GHSA-7crr-x792-cp3w
npm: captchetat-angularv8
CVE-2026-25272Published
Out-of-bounds Write in Camera Driver
cve-program ·
Vendor product: Snapdragon
CVE-2026-25273Published
Out-of-bounds Write in Camera Driver
cve-program ·
Vendor product: Snapdragon
CVE-2026-25302Published
Improper Verification of Cryptographic Signature in Boot
cve-program ·
Vendor product: Snapdragon
CVE-2026-59357Published
Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
cve-program ·
Vendor product: UAA · Vendor product: cf-deployment
CVE-2026-85153Published
Information Disclosure Vulnerability in Schmooze dating mobile Application
cve-program ·
Vendor product: Schmooze dating mobile Application
CVE-2026-105809Published
SourceCodester Simple Student Information System Profile Field register.php cross site scripting
cve-program ·
Vendor product: Simple Student Information System
CVE-2026-4889Published
SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies
cve-program ·
Vendor product: eLoanApp Platform
CVE-2026-95105Published
Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping
cve-program ·
https://repo.hex.pm: cloak · https://github.com: danielberkompas/cloak
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.