CVE-2026-81655Published
Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields
cve-program ·
Vendor product: Ad Inserter
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698800 source statements · aliases may refer to the same vulnerabilityCVE-2026-82841Published
UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
cve-program ·
Vendor product: UpdraftPlus: WP Backup & Migration Plugin · Vendor product: UpdraftPlus: WP Backup & Migration Plugin
CVE-2026-85002Published
EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes
cve-program ·
Vendor product: EmbedPress
CVE-2026-86609Published
Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
cve-program ·
Vendor product: Download Manager
CVE-2026-86839Published
Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR
cve-program ·
Vendor product: Online Scheduling and Appointment Booking System
CVE-2026-86841Published
Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options
cve-program ·
Vendor product: Online Scheduling and Appointment Booking System
CVE-2026-89000Published
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-89001Published
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-89003Published
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-89006Published
WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-92436Published
Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR
cve-program ·
Vendor product: Mailchimp for WooCommerce
CVE-2026-92995Published
Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file
cve-program ·
Vendor product: Verge3D Publishing and E-Commerce
CVE-2026-96895Published
WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes
cve-program ·
Vendor product: WP YouTube Lyte
CVE-2026-96896Published
Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request
cve-program ·
Vendor product: Malcure Malware Shield — Removal, Repair, Monitor
CVE-2026-96897Published
Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache
cve-program ·
Vendor product: Optima Express IDX
CVE-2026-96899Published
Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script
cve-program ·
Vendor product: Optima Express IDX
CVE-2026-97227Published
NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion
cve-program ·
Vendor product: NextScripts: Social Networks Auto-Poster
CVE-2026-97319Published
PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block
cve-program ·
Vendor product: PowerPress Podcasting plugin by Blubrry
GHSA-3ccm-4qq2-5wrpPublished
Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts
osv · CVE-2026-100836 · GO-2026-5864
Go: github.com/edgelesssys/contrast
GO-2026-5864Published
Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts in github.com/edgelesssys/contrast
osv · CVE-2026-100836 · GHSA-3ccm-4qq2-5wrp
Go: github.com/edgelesssys/contrast
GHSA-f5p4-p5q5-jv3hPublished
Contrast has insecure LUKS2 persistent storage partitions may be opened and used
osv · CVE-2025-71422 · GO-2025-4078
Go: github.com/edgelesssys/contrast
GO-2025-4078Published
Contrast has insecure LUKS2 persistent storage partitions may be opened and used in github.com/edgelesssys/contrast
osv · CVE-2025-71422 · GHSA-f5p4-p5q5-jv3h
Go: github.com/edgelesssys/contrast
GHSA-vqv5-385r-2hf8Published
Contrast's unauthenticated recovery allows Coordinator impersonation
osv · CVE-2025-71426 · GO-2025-3455
Go: github.com/edgelesssys/contrast
GO-2025-3455Published
Contrast's unauthenticated recovery allows Coordinator impersonation in github.com/edgelesssys/contrast
osv · CVE-2025-71426 · GHSA-vqv5-385r-2hf8
Go: github.com/edgelesssys/contrast
GHSA-phhq-63jg-fp7rPublished
Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points
osv · CVE-2025-71424 · GO-2025-3807
Go: github.com/edgelesssys/contrast
GO-2025-3807Published
Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points in github.com/edgelesssys/contrast
osv · CVE-2025-71424 · GHSA-phhq-63jg-fp7r
Go: github.com/edgelesssys/contrast
GHSA-vxg3-w9rv-rhr2Published
Contrast leaks workload secrets to logs on INFO level
osv · CVE-2025-71423 · GO-2025-3920
Go: github.com/edgelesssys/contrast
GO-2025-3920Published
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
osv · CVE-2025-71423 · GHSA-vxg3-w9rv-rhr2
Go: github.com/edgelesssys/contrast
GHSA-h5f8-crrq-4pw8Published
Contrast workload secrets leak to logs on INFO level
osv · CVE-2025-71425 · GO-2025-3718
Go: github.com/edgelesssys/contrast
GO-2025-3718Published
Contrast workload secrets leak to logs on INFO level in github.com/edgelesssys/contrast
osv · CVE-2025-71425 · GHSA-h5f8-crrq-4pw8
Go: github.com/edgelesssys/contrast
GHSA-rh99-wc69-c255Published
Contras Affected by CopyFile Policy Subversion via Symlinks
osv · CVE-2026-100838 · GO-2026-5624
Go: github.com/edgelesssys/contrast
GO-2026-5624Published
Contras Affected by CopyFile Policy Subversion via Symlinks in github.com/edgelesssys/contrast
osv · CVE-2026-100838 · GHSA-rh99-wc69-c255
Go: github.com/edgelesssys/contrast
GHSA-6c87-g9pw-78fxPublished
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries
osv · CVE-2026-100837 · GO-2026-5865
Go: github.com/edgelesssys/contrast
GO-2026-5865Published
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries in github.com/edgelesssys/contrast
osv · CVE-2026-100837 · GHSA-6c87-g9pw-78fx
Go: github.com/edgelesssys/contrast
GHSA-g9ww-x58f-9g6mPublished
Contrast BadAML injection allows arbitrary code execution
osv · CVE-2026-100839 · GO-2026-4863
Go: github.com/edgelesssys/contrast
GO-2026-4863Published
Contrast BadAML injection allows arbitrary code execution in github.com/edgelesssys/contrast
osv · CVE-2026-100839 · GHSA-g9ww-x58f-9g6m
Go: github.com/edgelesssys/contrast
CVE-2026-13742Published
Lack of signature verification before execution of downloaded content
cve-program ·
Vendor product: IQ MultiAccess
CVE-2026-0014Published
In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction i…
cve-program ·
Vendor product: Android
CVE-2025-47828Published
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.
cve-program ·
Vendor product: H5P-Nodejs-library
CVE-2026-94130Published
Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3
cve-program ·
Vendor product: YouTube Gallery extension for Joomla
CVE-2026-97161Published
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
cve-program ·
Vendor product: UP plugin for Joomla
CVE-2026-97163Published
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
cve-program ·
Vendor product: UP plugin for Joomla
CVE-2026-97162Published
Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
cve-program ·
Vendor product: UP plugin for Joomla
CVE-2026-97160Published
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
cve-program ·
Vendor product: UP plugin for Joomla
CVE-2026-85542Published
IBM Guardium Data Protection is affected by multiple vulnerabilities.
cve-program ·
Vendor product: Guardium Data Protection
CVE-2026-83311Published
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged…
cve-program ·
Vendor product: Oracle BI Publisher
CVE-2026-92126Published
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including P…
cve-program ·
Vendor product: Jenkins Script Security Plugin
CVE-2026-100701Published
Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
cve-program ·
Vendor product: nodemailer
CVE-2026-100702Published
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
cve-program ·
Vendor product: nodemailer
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.