CVE-2026-102427Published
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
cve-program ·
Vendor product: com_os_cck
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698686 source statements · aliases may refer to the same vulnerabilityCVE-2026-90914Published
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
CVE-2026-92231Published
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS · Vendor product: Joomla! Framework Filter package
CVE-2026-90918Published
Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
CVE-2026-92222Published
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
CVE-2026-101112Published
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
cve-program ·
Vendor product: com_baforms
CVE-2026-92223Published
Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
CVE-2026-90917Published
Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
CVE-2026-92225Published
Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
CVE-2026-92232Published
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS · Vendor product: Joomla! Framework Filter package
CVE-2026-90913Published
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
CVE-2026-90906Published
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
cve-program ·
Vendor product: Joomla! CMS
GHSA-ff3f-86qr-9cv3Published
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
osv · CVE-2026-101896
npm: @angular/router · npm: @angular/router · npm: @angular/router
GHSA-gfhx-hw2g-v5hgPublished
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
osv · CVE-2026-97711
npm: serialize-javascript
CVE-2026-103270Published
LightLLM through 1.2.0 Missing Authentication on RL Control Routes
cve-program ·
Vendor product: LightLLM
CVE-2026-100850Published
AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist
cve-program ·
Vendor product: AzuraCast
CVE-2026-100862Published
heym before 0.0.91 Multiple Secrets Plaintext Storage
cve-program ·
Vendor product: heym
CVE-2026-94545Published
Satori-generated SVG has improper escaping
cve-program ·
Vendor product: satori · Vendor product: next
CVE-2026-100257Published
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
cve-program ·
Vendor product: YouTrack
CVE-2026-100258Published
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
cve-program ·
Vendor product: YouTrack
CVE-2026-100259Published
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
cve-program ·
Vendor product: YouTrack
CVE-2026-100260Published
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
cve-program ·
Vendor product: YouTrack
CVE-2026-100261Published
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
cve-program ·
Vendor product: YouTrack
CVE-2026-100262Published
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
cve-program ·
Vendor product: YouTrack
CVE-2026-100263Published
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
cve-program ·
Vendor product: YouTrack
CVE-2026-100264Published
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
cve-program ·
Vendor product: YouTrack
CVE-2026-100265Published
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
cve-program ·
Vendor product: Rider
CVE-2026-100266Published
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
cve-program ·
Vendor product: Hub
CVE-2026-100267Published
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
cve-program ·
Vendor product: YouTrack
CVE-2026-100268Published
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
cve-program ·
Vendor product: YouTrack
CVE-2026-100269Published
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
cve-program ·
Vendor product: YouTrack
CVE-2026-100270Published
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
cve-program ·
Vendor product: YouTrack
CVE-2026-100271Published
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
cve-program ·
Vendor product: YouTrack
CVE-2026-100272Published
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
cve-program ·
Vendor product: YouTrack
CVE-2026-100274Published
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
cve-program ·
Vendor product: YouTrack
CVE-2026-100275Published
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
cve-program ·
Vendor product: YouTrack
CVE-2026-100276Published
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
cve-program ·
Vendor product: YouTrack
CVE-2026-100278Published
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
cve-program ·
Vendor product: YouTrack
CVE-2026-100279Published
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
cve-program ·
Vendor product: YouTrack
CVE-2026-100280Published
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
cve-program ·
Vendor product: YouTrack
CVE-2026-101043Published
pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings
cve-program ·
Vendor product: pnpm · Vendor product: pnpm
GHSA-m8m8-qj5v-23w3Published
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
osv · CVE-2026-101905
npm: axios
GHSA-j8rh-479h-cp32Published
Axios: Header Injection via Inherited headers After Minimal Interceptor
osv · CVE-2026-101904
npm: axios
GHSA-f596-whhp-79r4Published
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
osv · CVE-2026-101915
npm: @grpc/grpc-js · npm: @grpc/grpc-js
GHSA-4hqw-qxg8-jxx2Published
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
osv · CVE-2026-101900
npm: axios
GHSA-r4gj-5m52-g5whPublished
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
osv · CVE-2026-101907
npm: axios
GHSA-44g4-m2mj-wpvxPublished
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
osv · CVE-2026-101899
npm: axios
GHSA-m9gg-hp2v-232jPublished
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
osv · CVE-2026-101916
npm: @grpc/grpc-js · npm: @grpc/grpc-js
CVE-2026-100858Published
heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
cve-program ·
Vendor product: heym
CVE-2026-100866Published
onefetch through 2.28.1 Terminal Escape Sequence Injection
cve-program ·
Vendor product: onefetch
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.