MAL-2026-17488Published
Malicious code in css-starting-style-polyfill (npm)
osv ·
npm: css-starting-style-polyfill
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698332 source statements · aliases may refer to the same vulnerabilityMAL-2026-17485Published
Malicious code in css-scroll-anchor-polyfill (npm)
osv ·
npm: css-scroll-anchor-polyfill
MAL-2026-17487Published
Malicious code in css-snap-target-polyfill (npm)
osv ·
npm: css-snap-target-polyfill
MAL-2026-17483Published
Malicious code in css-reading-flow-polyfill (npm)
osv ·
npm: css-reading-flow-polyfill
MAL-2026-17486Published
Malicious code in css-scroll-state-polyfill (npm)
osv ·
npm: css-scroll-state-polyfill
MAL-2026-17484Published
Malicious code in css-relative-color-util (npm)
osv ·
npm: css-relative-color-util
CVE-2026-7366Published
IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall
cve-program ·
Vendor product: DataPower Gateway 11.0.0 · Vendor product: DataPower Gateway 10.5.0 · Vendor product: DataPower Gateway 10.6.0
CVE-2026-91769Published
TLS Hostname Verification Falls Back to CN After SAN Mismatch
cve-program ·
Vendor product: ext-openssl
CVE-2026-104470Published
YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
cve-program ·
Vendor product: yeswiki
CVE-2026-12392Published
RPC secret disclosure via vendor data endpoint in Canonical MAAS
cve-program ·
Vendor product: maas
CVE-2026-56305Published
Capgo - Authentication Bypass in Password Change via Missing Current Password Validation
cve-program ·
Vendor product: Capgo
GHSA-9vm3-r8gq-cr6xPublished
Casdoor arbitrary file write vulnerability
osv · CVE-2022-38638 · GO-2022-1006 · PYSEC-2022-43190
Go: github.com/casdoor/casdoor
GO-2022-1006Published
Casdoor arbitrary file write vulnerability in github.com/casdoor/casdoor
osv · CVE-2022-38638 · GHSA-9vm3-r8gq-cr6x · PYSEC-2022-43190
Go: github.com/casdoor/casdoor
GHSA-m358-g4rp-533rPublished
SQL Injection in Casdoor
osv · CVE-2022-24124 · GO-2022-0303 · PYSEC-2022-43189
Go: github.com/casdoor/casdoor
GO-2022-0303Published
SQL Injection in Casdoor in github.com/casdoor/casdoor
osv · CVE-2022-24124 · GHSA-m358-g4rp-533r · PYSEC-2022-43189
Go: github.com/casdoor/casdoor
CVE-2026-103111Published
PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.
cve-program ·
Vendor product: PCRE2
CVE-2026-100630Published
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
cve-program ·
Vendor product: AVideo
CVE-2026-66331Published
Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize
cve-program ·
Vendor product: delphi bindings
CVE-2026-66055Published
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)
cve-program ·
https://conan.io/center: thrift · https://repo.maven.apache.org/maven2: org.apache.thrift:libthrift · https://golang.org/pkg: github.com/apache/thrift
CVE-2026-63772Published
Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count
cve-program ·
https://golang.org/pkg: github.com/apache/thrift
CVE-2026-61374Published
Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.thrift:libthrift
CVE-2026-66054Published
Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize
cve-program ·
https://conan.io/center: thrift
CVE-2026-101104Published
Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
cve-program ·
Vendor product: IoT Cloud Platform OpenAPI Service
CVE-2026-104910Published
MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
cve-program ·
Vendor product: MISP
CVE-2026-96613Published
Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
cve-program ·
Vendor product: IoT Cloud Platform OpenAPI Service
CVE-2026-104912Published
MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
cve-program ·
Vendor product: MISP
CVE-2026-103648Published
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
cve-program ·
Vendor product: image-downloader
CVE-2026-75937Published
OS Command Injection in Digi Accelerated Linux (DAL OS)
cve-program ·
Vendor product: IX Family · Vendor product: EX Family · Vendor product: TX Family
CVE-2026-104055Published
Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm
cve-program ·
https://charmhub.io/postgresql: charmed-postgresql
CVE-2026-93474Published
Monta monta.app Insufficiently Protected Credentials
cve-program ·
Vendor product: monta.app
CVE-2026-97212Published
Monta monta.app Insufficient Session Expiration
cve-program ·
Vendor product: monta.app
CVE-2026-97363Published
Monta monta.app Improper Restriction of Excessive Authentication Attempts
cve-program ·
Vendor product: monta.app
CVE-2026-95102Published
Monta monta.app Missing Authentication for Critical Function
cve-program ·
Vendor product: monta.app
CVE-2026-94594Published
Armatura LLC Armatura One Insertion of Sensitive Information into Log File
cve-program ·
Vendor product: Armatura One · Vendor product: Armatura One (USA)
CVE-2026-94593Published
Armatura LLC Armatura One Insertion of Sensitive Information into Log File
cve-program ·
Vendor product: Armatura One · Vendor product: Armatura One (USA)
CVE-2026-94592Published
Armatura LLC Armatura One Use of Hard-coded Credentials
cve-program ·
Vendor product: Armatura One · Vendor product: Armatura One (USA)
CVE-2026-94591Published
Armatura LLC Armatura One Use of Hard-coded Cryptographic Key
cve-program ·
Vendor product: Armatura One · Vendor product: Armatura One (USA)
CVE-2026-92245Published
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
cve-program ·
Vendor product: Simply Schedule Appointments
CVE-2026-91109Published
Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
cve-program ·
Vendor product: Simply Schedule Appointments
CVE-2026-92548Published
WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters
cve-program ·
Vendor product: WP Popular Posts
CVE-2026-12241Published
Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
cve-program ·
Vendor product: Advanced Woo Labels – Product Labels & Badges for WooCommerce
CVE-2026-85679Published
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
cve-program ·
Vendor product: Extendify
CVE-2026-88999Published
Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter
cve-program ·
Vendor product: Redux Framework
CVE-2026-89047Published
Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL
cve-program ·
Vendor product: Social Media Share Buttons & Social Sharing Icons
CVE-2026-93882Published
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
cve-program ·
Vendor product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
CVE-2026-19902Published
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
cve-program ·
Vendor product: Ad Inserter – Ad Manager & AdSense Ads
CVE-2026-19807Published
ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
cve-program ·
Vendor product: ByteCoreStack – MCP Connector for AI Tools
CVE-2026-15983Published
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
cve-program ·
Vendor product: Super Forms – Drag & Drop Form Builder
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.