GHSA-r3ph-w7gj-g6xmPublished
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
osv ·
npm: js-yaml
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698751 source statements · aliases may refer to the same vulnerabilityGHSA-j84w-jfhq-vhvjPublished
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
osv · CVE-2026-102675
npm: electron · npm: electron · npm: electron
GHSA-9qh4-3jw8-366wPublished
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
osv · CVE-2026-102676
npm: electron · npm: electron · npm: electron
GHSA-rx4f-c7p8-82vqPublished
undici vulnerable to Denial of Service via WebSocketStream unclean close
osv · CVE-2026-85014
npm: undici · npm: undici
GHSA-hq2x-r82h-9wj4Published
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
osv · CVE-2026-102673
npm: electron · npm: electron · npm: electron
GHSA-gr2m-v5gq-v685Published
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
osv · CVE-2026-102674
npm: electron · npm: electron · npm: electron
GHSA-253c-mchw-3w2rPublished
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
osv ·
npm: markdown-it · npm: markdown-it
CVE-2026-102809Published
PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
cve-program ·
Vendor product: PX4-Autopilot
CVE-2026-95382Published
Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium…
cve-program ·
Vendor product: Chrome
CVE-2026-97886Published
mathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection
cve-program ·
Vendor product: CloudClassroom-PHP-Project
CVE-2026-84460Published
Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration
cve-program ·
Vendor product: zammad
CVE-2026-95367Published
Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium …
cve-program ·
Vendor product: Chrome
CVE-2026-84465Published
Zammad: S/MIME signature verification allows forged sender impersonation
cve-program ·
Vendor product: zammad
CVE-2026-63207Published
Zammad: Sensitive Information Exposure in Integration Administration API
cve-program ·
Vendor product: zammad
CVE-2026-63006Published
Zammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset
cve-program ·
Vendor product: zammad
CVE-2026-101091Published
SiYuan before v3.8.4 SQL Injection via Block Query Embed
cve-program ·
Vendor product: siyuan
CVE-2026-49469Published
GLPI: LDAP filter injection in user import feature
cve-program ·
Vendor product: glpi
CVE-2026-102807Published
OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
cve-program ·
Vendor product: OpenClaw
CVE-2026-97897Published
Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting
cve-program ·
Vendor product: laravel-crm
CVE-2026-100304Published
TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check
cve-program ·
https://github.com/TDuckCloud/tduck-survey-form: tduck-survey-form
CVE-2026-102811Published
Marmite through 0.4.2 Unauthenticated API Access via Development Server
cve-program ·
Vendor product: marmite
CVE-2026-57443Published
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
cve-program ·
Vendor product: SCBE-AETHERMOORE
MAL-2026-17282Published
Malicious code in @hrmony/hyper-json-builder (npm)
osv · GHSA-r476-wfgx-8rc7
npm: @hrmony/hyper-json-builder
CVE-2026-71483Published
Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
cve-program ·
Vendor product: horilla-hr
CVE-2026-100418Published
Flame through 2.4.0 Information Exposure via GET /api/config
cve-program ·
Vendor product: flame
CVE-2026-102363Published
mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number
cve-program ·
https://github.com/gz-yami/mall4j: mall4j
CVE-2026-101277Published
Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source
cve-program ·
Vendor product: OpenDKIM
CVE-2026-102364Published
mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API
cve-program ·
https://github.com/gz-yami/mall4j: mall4j
CVE-2026-102367Published
mall4j through 4.0 Insufficient Session Expiration via Token Refresh
cve-program ·
https://github.com/gz-yami/mall4j: mall4j
CVE-2026-94417Published
CRL check skipped when OCSP enabled and certificate has no OCSP URL
cve-program ·
Vendor product: wolfSSL
CVE-2026-102634Published
SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
cve-program ·
https://pypi.org/project/sglang: sglang
CVE-2026-102568Published
Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py
cve-program ·
Vendor product: pardus-parental-control
MAL-2026-17278Published
Malicious code in @hrmony/pladddform-partner-registry (npm)
osv · GHSA-757q-42rv-qjcf
npm: @hrmony/pladddform-partner-registry
MAL-2026-17261Published
Malicious code in @hrmony/gutscheinverwaltung (npm)
osv · GHSA-g4hp-22g7-9hf5
npm: @hrmony/gutscheinverwaltung
MAL-2026-17281Published
Malicious code in @hrmony/valuenet (npm)
osv · GHSA-5958-mpfq-wfrj
npm: @hrmony/valuenet
MAL-2026-17280Published
Malicious code in @hrmony/pladddform-testing (npm)
osv · GHSA-wc37-mwww-8cwr
npm: @hrmony/pladddform-testing
MAL-2026-17249Published
Malicious code in @hrmony/account-management (npm)
osv · GHSA-ppvh-5qcf-3gvr
npm: @hrmony/account-management
MAL-2026-17271Published
Malicious code in @hrmony/pladddform-application (npm)
osv · GHSA-wrw4-45wp-75v5
npm: @hrmony/pladddform-application
MAL-2026-17270Published
Malicious code in @hrmony/organisationsverwaltung (npm)
osv · GHSA-gxrr-r3q5-4429
npm: @hrmony/organisationsverwaltung
MAL-2026-17266Published
Malicious code in @hrmony/kit-5 (npm)
osv · GHSA-96c4-q73c-c32q
npm: @hrmony/kit-5
MAL-2026-17255Published
Malicious code in @hrmony/benefit-mobilitaet (npm)
osv · GHSA-87h6-fqj7-r5rw
npm: @hrmony/benefit-mobilitaet
MAL-2026-17258Published
Malicious code in @hrmony/cdk-constructs (npm)
osv · GHSA-h9qw-wcm3-qrr8
npm: @hrmony/cdk-constructs
MAL-2026-17272Published
Malicious code in @hrmony/pladddform-cli (npm)
osv · GHSA-7j4w-rjm5-96qj
npm: @hrmony/pladddform-cli
MAL-2026-17257Published
Malicious code in @hrmony/benefitverwaltung (npm)
osv · GHSA-xvwj-8x3p-gr7w
npm: @hrmony/benefitverwaltung
MAL-2026-17262Published
Malicious code in @hrmony/interfaces (npm)
osv · GHSA-h2q3-6wwv-v7c8
npm: @hrmony/interfaces
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.