Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 15,858 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 3 hours ago Checked every 6 hours
All vendor sources Official source

15,858 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-111444
CriticalCVSS 9.8

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

Mariner

Affected productsazl3 python-wheel 0.43.0-2 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2026-111444
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-111450
MediumCVSS 5.9

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request triggers a cold start can direct later error emails to an address under their control for that application's lifetime. Emails disclose error and request metadata; on engines/versions where scope dumps render, they may also disclose configuration secrets and other users' session/cookie data. On the Lucee 7 engine, scope dumps fail to render, limiting disclosure to header fields. This is fixed in 4.1.2.

Mariner

Affected productsazl3 python-wheel 0.43.0-2 on Azure Linux 3.0
Vendor guidance

Release Notes

CVE-2026-111450
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources