CVE-2026-58154Published
Apache Traffic Server: Memory-safety errors in MIME and header parsing
cve-program ·
Vendor product: Apache Traffic Server
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698587 source statements · aliases may refer to the same vulnerabilityCVE-2026-58152Published
Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
cve-program ·
Vendor product: Apache Traffic Server
CVE-2026-58151Published
Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
cve-program ·
Vendor product: Apache Traffic Server
CVE-2026-58150Published
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
cve-program ·
Vendor product: Apache Traffic Server
CVE-2026-57834Published
Apache Traffic Server: Malformed chunked message body allows request smuggling
cve-program ·
Vendor product: Apache Traffic Server
CVE-2026-33930Published
Apache Traffic Server: Buffer overflow via Host field that has a long string value
cve-program ·
Vendor product: Apache Traffic Server
CVE-2026-12256Published
WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: fusion-builder
GHSA-gq43-vcrh-6jw8Withdrawn
Duplicate Advisory: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
osv ·
Go: github.com/siyuan-note/siyuan/kernel
GHSA-75xh-mp4f-f2rfWithdrawn
Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
osv ·
Go: github.com/siyuan-note/siyuan/kernel
CVE-2026-103267Published
Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
cve-program ·
Vendor product: Ghost
CVE-2026-75886Published
Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/ose-console-rhel9 · https://catalog.redhat.com/software/containers/: openshift4/ose-console-rhel9 · https://catalog.redhat.com/software/containers/: openshift4/ose-console-rhel9
CVE-2025-31980Published
HCL BigFix Service Management is affected by multiple security vulnerabilities.
cve-program ·
Vendor product: HCL BigFix Service Management
CVE-2026-1784Published
Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/ose-cluster-ingress-operator · https://catalog.redhat.com/software/containers/: openshift4/ose-cluster-ingress-operator · https://catalog.redhat.com/software/containers/: openshift4/ose-cluster-ingress-operator
CVE-2026-14316Published
Heap buffer overflow in boks_sshd revoked-key error handling
cve-program ·
Vendor product: Core Privileged Access Manager (BoKS)
CVE-2026-67172Published
HCL BigFix Service Management is affected by multiple security vulnerabilities.
cve-program ·
Vendor product: HCL BigFix Service Management
CVE-2026-67171Published
HCL BigFix Service Management is affected by multiple security vulnerabilities.
cve-program ·
Vendor product: HCL BigFix Service Management
CVE-2026-103272Published
Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
cve-program ·
Vendor product: Ghost
CVE-2026-13043Published
WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access
cve-program ·
Vendor product: Endpoint Security
GHSA-7v6h-j59w-8qfpWithdrawn
Duplicate Advisory: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
osv ·
Go: github.com/siyuan-note/siyuan/kernel
CVE-2026-103353Published
WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: fluentform
CVE-2026-103340Published
WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: site-reviews
CVE-2026-88350Published
An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().
cve-program ·
Vendor product: n/a
CVE-2026-97297Published
WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce
CVE-2026-103068Published
WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: bcs-mcp-manager
CVE-2026-13014Published
Remote Code Execution vulnerability in "Suspicious" application
cve-program ·
https://github.com/thalesgroup-cert/suspicious: Suspicious
CVE-2026-94620Published
Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)
cve-program ·
Vendor product: classroom50
CVE-2026-103690Published
itsourcecode Leave Management System controller.php sql injection
cve-program ·
Vendor product: Leave Management System
CVE-2026-9864Published
Fortra BoKS Server Agent adjoin machine-account password generation vulnerability
cve-program ·
Vendor product: Core Privileged Access Manager (BoKS)
CVE-2026-101322Published
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In depl…
cve-program ·
Vendor product: Eclipse BaSyx AAS Web UI
CVE-2026-92172Published
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHO…
cve-program ·
Vendor product: Meta Horizon OS
CVE-2026-97395Published
Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
cve-program ·
Vendor product: Apache Polaris
CVE-2026-51568Published
modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
cve-program ·
Vendor product: n/a
CVE-2026-103004Published
next.js cache leak on warm `use cache` handlers accessing root param
cve-program ·
Vendor product: next.js
CVE-2026-51860Published
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
cve-program ·
Vendor product: n/a
CVE-2026-51866Published
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.
cve-program ·
Vendor product: n/a
CVE-2026-94390Published
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: hide-shipping-method-for-woocommerce
CVE-2026-79896Published
Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability
cve-program ·
Vendor product: BoKS Manager
CVE-2026-97260Published
WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: maxgalleria
CVE-2026-12627Published
Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability
cve-program ·
Vendor product: Fortra's Core Privileged Access Manager (BoKS)
CVE-2026-97277Published
WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: social-boost
CVE-2026-76143Published
Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
cve-program ·
Vendor product: Genian SSL PNS (frodo-core)
CVE-2026-76144Published
Genians, Inc Genian SSL PNS Unrestricted File Upload
cve-program ·
Vendor product: Genian SSL PNS (frodo-core) · Vendor product: Genian SSL PNS (watchcat-ui)
CVE-2026-71899Published
Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.