Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698684 source statements · aliases may refer to the same vulnerabilitymall4j through 4.0 Missing Authorization in Admin User Address Endpoints
cve-program ·
https://github.com/gz-yami/mall4j: mall4j
Same-origin policy bypass in the WebExtensions component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
mall4j through 4.0 Missing Authentication in Password Update Endpoint
cve-program ·
https://github.com/gz-yami/mall4j: mall4j
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
osv · CVE-2026-102992
npm: piscina · npm: piscina · npm: piscina
Ziroom ZHOME A0101 set_passwd command injection
cve-program ·
Vendor product: ZHOME A0101
Ziroom ZHOME A0101 firstSetup_wifi command injection
cve-program ·
Vendor product: ZHOME A0101
Cryptography misuse in Storage: Quota Manager component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Dozzle before 11.1.2 Path Traversal via Log ZIP Download
cve-program ·
Vendor product: dozzle
H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.
cve-program ·
Vendor product: InsydeH2O
MISP Reflected XSS in Taxonomy Tag Confirmation Forms
cve-program ·
Vendor product: MISP
rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist
cve-program ·
Vendor product: dom-sanitizer
SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
cve-program ·
Vendor product: siyuan
MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
cve-program ·
Vendor product: MISP
WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: wp-file-upload
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
cve-program ·
Vendor product: YouTrack
n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
cve-program ·
Vendor product: n8n
FastStone Image Viewer TGA Image FSViewer.exe out-of-bounds
cve-program ·
Vendor product: Image Viewer
Netcore POWER13 ubus routerd.passwd_set password recovery
cve-program ·
Vendor product: POWER13
n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
cve-program ·
Vendor product: n8n
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
cve-program ·
Vendor product: brace-expansion
n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
cve-program ·
Vendor product: n8n
WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: bus-ticket-booking-with-seat-reservation
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
cve-program ·
Vendor product: pyjwt
CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
cve-program ·
Vendor product: Pandora FMS
Fleet before 4.89.0 Information Disclosure via MDM Command Results
cve-program ·
Vendor product: fleet
MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions
cve-program ·
Vendor product: MISP
Sangfor Next-Gen Application Firewall Authenticated File Disclosure
cve-program ·
Vendor product: Next-Gen Application Firewall (NGAF)
Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
cve-program ·
https://github.com/verdammelt/tnef: tnef
WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: wpfunnels
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
osv · CVE-2026-102990
npm: basic-ftp
Duplicate Advisory: SiYuan discloses an administrator's open documents and search terms to anonymous readers
osv ·
Go: github.com/siyuan-note/siyuan/kernel
Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction
cve-program ·
https://github.com/verdammelt/tnef: tnef
Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
cve-program ·
Vendor product: Ghost
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: icegram
Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation
cve-program ·
https://github.com/verdammelt/tnef: tnef
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
cve-program ·
Vendor product: pyjwt
WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: parallax-section
Apache APISIX: data-mask may fail to redact request headers in logger output
cve-program ·
Vendor product: Apache APISIX
Apache APISIX: cross-request permission pollution via static permission list mutation
cve-program ·
Vendor product: Apache APISIX
PyJWT: PyJWKClient follows redirects when fetching JWKS
cve-program ·
Vendor product: pyjwt
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.