CVE-2026-93809Published
drm/amdgpu: flush pending RCU callbacks on module unload
cve-program ·
Vendor product: Linux · Vendor product: Linux
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698821 source statements · aliases may refer to the same vulnerabilityCVE-2026-92106Published
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
cve-program ·
https://repo.hex.pm: lazy_html · https://github.com: dashbitco/lazy_html
CVE-2026-86837Published
Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass
cve-program ·
https://wordpress.org/plugins: Bookly
CVE-2026-80514Published
wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass
cve-program ·
https://wordpress.org/plugins: wpForo Forum
CVE-2026-88848Published
MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass
cve-program ·
https://wordpress.org/plugins: MasterStudy LMS
CVE-2026-78393Published
Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links
cve-program ·
Vendor product: Link Library
CVE-2026-78394Published
Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter
cve-program ·
Vendor product: Link Library
CVE-2026-78397Published
Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation
cve-program ·
Vendor product: Link Library
CVE-2026-13016Published
Unauthenticated SQL Injection in ServiceNow AI Platform
cve-program ·
Vendor product: ServiceNow AI Platform
CVE-2026-86857Published
Authorization Bypass in ServiceNow AI Platform
cve-program ·
Vendor product: ServiceNow AI Platform
CVE-2026-97898Published
Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms
cve-program ·
Vendor product: akia
RUSTSEC-2026-0279Published
Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution
osv · CVE-2026-97875
crates.io: rojo
CVE-2026-97228Published
Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup
cve-program ·
Vendor product: Platform
CVE-2026-27867Published
CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT
cve-program ·
Vendor product: Regesta Smart HD-PLC - TLDPH16D2
CVE-2026-84281Published
Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta
cve-program ·
Vendor product: Fancy Product Designer
CVE-2026-96766Published
GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
cve-program ·
Vendor product: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
CVE-2026-92799Published
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
cve-program ·
Vendor product: Online Scheduling and Appointment Booking System – Bookly
CVE-2026-14281Published
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
cve-program ·
Vendor product: Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code
CVE-2026-96752Published
Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration
cve-program ·
Vendor product: Zero Spam for WordPress
CVE-2026-88996Published
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
cve-program ·
Vendor product: WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
CVE-2026-17577Published
SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter
cve-program ·
Vendor product: SSL Zen — SSL Certificate Installer & HTTPS Redirects
CVE-2026-93654Published
Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
cve-program ·
Vendor product: Premium Packages – Sell Digital Products Securely
CVE-2026-94573Published
Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value
cve-program ·
Vendor product: Repeater Fields for Elementor Forms
CVE-2025-64289Published
WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: premmerce-search
CVE-2026-39708Published
WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: uicore-elements
CVE-2026-93576Published
Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: netty-codec-smtp · https://access.redhat.com/downloads/content/package-browser/: netty-codec-smtp · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
CVE-2026-93575Published
Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: netty-codec-mqtt · https://access.redhat.com/downloads/content/package-browser/: netty-codec-mqtt · https://access.redhat.com/downloads/content/package-browser/: netty-codec-mqtt
CVE-2026-93572Published
Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: netty-codec-redis · https://access.redhat.com/downloads/content/package-browser/: netty-codec-redis · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
CVE-2026-93563Published
Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: netty-codec-smtp · https://access.redhat.com/downloads/content/package-browser/: netty-codec-smtp · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
CVE-2026-93561Published
Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: netty-codec-memcache · https://access.redhat.com/downloads/content/package-browser/: netty-codec-memcache · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
CVE-2026-93494Published
Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: netty-codec-stomp · https://access.redhat.com/downloads/content/package-browser/: netty-codec-stomp · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
CVE-2026-79651Published
Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
cve-program ·
https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator
CVE-2026-94368Published
Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: odf4/mcg-core-rhel9 · https://access.redhat.com/downloads/content/package-browser/: rhceph-dev/odf4-mcg-core-rhel9
CVE-2026-90997Published
Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch
cve-program ·
https://github.com/keycloak/keycloak: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9-operator
MAL-2025-49169Published
Malicious code in epic-node-ecom-services (npm)
osv ·
npm: epic-node-ecom-services
MAL-2025-49188Published
Malicious code in epic-react-webpack-starter (npm)
osv ·
npm: epic-react-webpack-starter
MAL-2025-49176Published
Malicious code in epic-okta-express-middleware (npm)
osv ·
npm: epic-okta-express-middleware
GHSA-v3p8-whq6-r5jgPublished
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
osv · CVE-2026-88060
npm: @angular/platform-server · npm: @angular/platform-server · npm: @angular/platform-server
GHSA-f8g7-2xjc-7mfhPublished
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
osv · BIT-rclone-2026-88016 · CVE-2026-88016 · GO-2026-6459
Go: github.com/rclone/rclone
MAL-2025-49186Published
Malicious code in epic-react-test-utils (npm)
osv ·
npm: epic-react-test-utils
MAL-2025-49174Published
Malicious code in epic-node-services-common (npm)
osv ·
npm: epic-node-services-common
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.