MAL-2026-17269Published
Malicious code in @hrmony/middlewares (npm)
osv · GHSA-5cwm-5j38-r753
npm: @hrmony/middlewares
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698751 source statements · aliases may refer to the same vulnerabilityMAL-2026-17253Published
Malicious code in @hrmony/benefit-essenszuschuss (npm)
osv · GHSA-2c72-pm8g-m65j
npm: @hrmony/benefit-essenszuschuss
MAL-2026-17273Published
Malicious code in @hrmony/pladddform-codegen (npm)
osv · GHSA-4jh6-g3hw-7qjc
npm: @hrmony/pladddform-codegen
MAL-2026-17260Published
Malicious code in @hrmony/devtool-configuration (npm)
osv · GHSA-qh4w-rc3m-9898
npm: @hrmony/devtool-configuration
MAL-2026-17259Published
Malicious code in @hrmony/component-library (npm)
osv · GHSA-cjfr-hq8x-q26q
npm: @hrmony/component-library
MAL-2026-17268Published
Malicious code in @hrmony/mailer-pladddform (npm)
osv · GHSA-75mr-rmf4-wr8j
npm: @hrmony/mailer-pladddform
MAL-2026-17250Published
Malicious code in @hrmony/api-gateway-service-config (npm)
osv · GHSA-36rr-7v5c-qjqv
npm: @hrmony/api-gateway-service-config
MAL-2026-17279Published
Malicious code in @hrmony/pladddform-shared-infrastructure (npm)
osv · GHSA-xvjm-3hmh-7v4h
npm: @hrmony/pladddform-shared-infrastructure
MAL-2026-17252Published
Malicious code in @hrmony/belegerfassung-pladddform (npm)
osv · GHSA-5hfp-jjv9-69q8
npm: @hrmony/belegerfassung-pladddform
MAL-2026-17254Published
Malicious code in @hrmony/benefit-internetzuschuss (npm)
osv · GHSA-784r-8wmx-42h3
npm: @hrmony/benefit-internetzuschuss
MAL-2026-17276Published
Malicious code in @hrmony/pladddform-frontend (npm)
osv · GHSA-53w6-j9gv-cv5w
npm: @hrmony/pladddform-frontend
MAL-2026-17275Published
Malicious code in @hrmony/pladddform-core (npm)
osv · GHSA-qgqg-65m8-gvwg
npm: @hrmony/pladddform-core
MAL-2026-17267Published
Malicious code in @hrmony/lohndateien (npm)
osv · GHSA-xq9r-4rp7-86c2
npm: @hrmony/lohndateien
MAL-2026-17251Published
Malicious code in @hrmony/app-gateway-templates (npm)
osv · GHSA-52pw-jwv9-q65v
npm: @hrmony/app-gateway-templates
MAL-2026-17277Published
Malicious code in @hrmony/pladddform-infrastructure (npm)
osv · GHSA-rvhw-f5hm-gj2w
npm: @hrmony/pladddform-infrastructure
MAL-2026-17256Published
Malicious code in @hrmony/benefit-sachbezug (npm)
osv · GHSA-jr8j-48fj-734v
npm: @hrmony/benefit-sachbezug
MAL-2026-17274Published
Malicious code in @hrmony/pladddform-config (npm)
osv · GHSA-pgw6-px39-j8m8
npm: @hrmony/pladddform-config
CVE-2022-51019Published
Akaunting before 2.1.31 OS Command Injection via app alias
cve-program ·
Vendor product: akaunting
CVE-2026-101280Published
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
cve-program ·
Vendor product: OpenDMARC
CVE-2026-102697Published
Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
cve-program ·
Vendor product: ollama
CVE-2026-101858Published
RaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection
cve-program ·
Vendor product: raspap-webgui
CVE-2026-102675Published
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
cve-program ·
Vendor product: electron
CVE-2026-100521Published
Cotonti through 1.0.0 Reflected XSS via search highlight parameter
cve-program ·
Vendor product: Cotonti
CVE-2026-71577Published
Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration
cve-program ·
https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-rhel9-operator · https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-rhel9-operator · https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-rhel9-operator
CVE-2026-102240Published
Netcore NAP930 Network Tools CGI network_tools eval os command injection
cve-program ·
Vendor product: NAP930
CVE-2026-102674Published
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
cve-program ·
Vendor product: electron
CVE-2026-102244Published
MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
cve-program ·
Vendor product: SurfSense
CVE-2026-54875Published
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
cve-program ·
Vendor product: OpenSSL
CVE-2026-100529Published
OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
cve-program ·
Vendor product: OpenClaw
CVE-2026-72897Published
Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
cve-program ·
Vendor product: OpenSSL
CVE-2026-100533Published
OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback
cve-program ·
Vendor product: OpenClaw
CVE-2026-75804Published
QUIC Connection-Level Flow Control is Not Enforced for Streams
cve-program ·
Vendor product: OpenSSL
GHSA-p3f5-w63m-mxphWithdrawn
Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
osv ·
npm: webpack-dev-middleware
CVE-2026-100537Published
OpenClaw before 2026.8.1 Authentication Bypass via Active Memory
cve-program ·
Vendor product: OpenClaw
CVE-2026-100545Published
OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation
cve-program ·
Vendor product: OpenClaw
CVE-2026-100549Published
OpenClaw before 2026.8.1 Path Traversal via QQBot voice filenames
cve-program ·
Vendor product: OpenClaw
CVE-2026-100553Published
OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin
cve-program ·
Vendor product: OpenClaw
CVE-2026-100557Published
OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch
cve-program ·
Vendor product: OpenClaw
CVE-2026-100561Published
OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
cve-program ·
Vendor product: OpenClaw
CVE-2026-100570Published
OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS
cve-program ·
Vendor product: OpenClaw
CVE-2026-100748Published
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
cve-program ·
Vendor product: Event Gallery for Joomla
CVE-2026-97164Published
Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0
cve-program ·
Vendor product: Event Gallery for Joomla
CVE-2026-67364Published
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
cve-program ·
Vendor product: com_baforms
CVE-2026-102248Published
Rebuild Login Endpoint login improper authentication
cve-program ·
Vendor product: Rebuild
CVE-2026-100574Published
OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
cve-program ·
Vendor product: OpenClaw
CVE-2026-97711Published
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
cve-program ·
Vendor product: serialize-javascript
CVE-2026-94419Published
Client session cache reference poisoning allows resumption with wrong server
cve-program ·
Vendor product: wolfSSL
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.