CVE-2026-73975Published
djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
cve-program ·
Vendor product: djehuty
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698276 source statements · aliases may refer to the same vulnerabilityCVE-2026-103686Published
rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting
cve-program ·
Vendor product: dom-sanitizer
CVE-2026-103291Published
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
cve-program ·
Vendor product: Ghost
CVE-2026-103287Published
Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
cve-program ·
Vendor product: Ghost
CVE-2026-103283Published
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
cve-program ·
Vendor product: Ghost
CVE-2026-103279Published
Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
cve-program ·
Vendor product: Ghost
CVE-2026-103275Published
Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
cve-program ·
Vendor product: Ghost
MAL-2026-17504Published
Malicious code in dotenv-async (npm)
osv · GHSA-gp83-4g76-4qg5
npm: dotenv-async
CVE-2026-103271Published
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
cve-program ·
Vendor product: Ghost
CVE-2026-103266Published
Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
cve-program ·
Vendor product: Ghost
CVE-2026-103262Published
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
cve-program ·
Vendor product: tornado
CVE-2026-103258Published
n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
cve-program ·
Vendor product: n8n
CVE-2026-103254Published
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
cve-program ·
Vendor product: n8n
CVE-2026-103250Published
n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
cve-program ·
Vendor product: n8n
CVE-2026-103246Published
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
cve-program ·
Vendor product: n8n
CVE-2026-103542Published
formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
cve-program ·
Vendor product: Form Tools
CVE-2026-103539Published
ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication
cve-program ·
Vendor product: SuperMarket
GHSA-858h-whjf-mvg5Published
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
osv · CVE-2026-102827
npm: simple-git
GHSA-238p-pmpm-9mq7Published
KaTeX: Existing prototype pollution can bypass trust restrictions
osv · CVE-2026-103923
npm: katex
GHSA-v5rq-49vh-5v5cPublished
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
osv · CVE-2026-102829
npm: @simple-git/argv-parser
GHSA-x6jw-m9v5-85vhPublished
simple-git unsafe-operation guard does not block trailer command configuration
osv · CVE-2026-102828
npm: simple-git
GHSA-g4wm-2vf7-vfgrPublished
simple-git allows command execution through unblocked Git configuration includes
osv · CVE-2026-102826
npm: simple-git
GHSA-wfpm-5gcm-94cgPublished
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
osv · CVE-2026-102600
npm: @socket.io/cluster-engine
GHSA-p6vx-979v-rg4cPublished
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
osv · CVE-2026-104846
npm: seroval
GHSA-r4xh-jqrq-34v2Published
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
osv ·
npm: smol-toml
CVE-2026-103534Published
David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control
cve-program ·
Vendor product: databasement
CVE-2026-103531Published
OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow
cve-program ·
Vendor product: OpenSC
CVE-2026-103592Published
simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers
cve-program ·
Vendor product: simple-router
CVE-2026-103001Published
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse
cve-program ·
Vendor product: pyjwt
GHSA-w3vv-58gj-gw77Published
Nx daemon and plugin worker sockets are accessible to other local users
osv · CVE-2026-104854
npm: nx · npm: nx
GHSA-prgh-xp8r-p3m5Published
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
osv · CVE-2026-90776
npm: nodemailer
GHSA-hrvq-x7jp-36xvPublished
Nx: Path traversal in nx migrate package-migrations extraction
osv · CVE-2026-104853
npm: nx · npm: nx
GHSA-wr44-6hxh-3jwqPublished
joi messages compilation allows prototype replacement through __proto__ error codes
osv · CVE-2026-90771
npm: joi · npm: joi
GHSA-6vc5-vf29-ffr2Published
@nx/docker: OS command injection in the @nx/docker release pipeline
osv · CVE-2026-104859
npm: @nx/docker · npm: @nx/docker
GHSA-g7fw-3gjp-g5hfPublished
OpenClaw: Channel read actions could skip target allowlists
osv · CVE-2026-100582
npm: @openclaw/msteams · npm: @openclaw/feishu · npm: @openclaw/matrix
GHSA-68fv-2mgg-jv7qPublished
source-map-js allows event-loop denial of service through indexed source-map section offsets
osv · CVE-2026-93749
npm: source-map-js
GHSA-6h2x-m376-mqjqPublished
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
osv · CVE-2026-92599
npm: joi · npm: joi
GHSA-jp82-f5mq-hwhpPublished
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
osv · CVE-2026-104845
npm: seroval
GHSA-w2vw-w76x-qr89Published
Nx: OS command injection via git revisions and remote refs
osv ·
npm: nx · npm: nx
GHSA-vc2v-76pw-4v95Published
compression vulnerable to Denial of Service via memory leak on premature response close
osv · CVE-2026-87776
npm: compression
GHSA-jqcg-44mw-7w3hPublished
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
osv · CVE-2026-90711
npm: proxy-addr
GHSA-2v2p-6j97-cjg9Published
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
osv · CVE-2026-100722
npm: vm2
GHSA-5h3f-q97h-ccvcPublished
vm2: NodeVM custom resolution bypasses external path boundaries
osv · CVE-2026-100721
npm: vm2
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.