CVE-2026-94045Published
newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
cve-program ·
Vendor product: newbee-mall
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698866 source statements · aliases may refer to the same vulnerabilityCVE-2026-94040Published
vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
cve-program ·
Vendor product: TaxHacker
CVE-2026-94030Published
SerenityOS LibGfx BMPLoader.cpp decode_bmp_pixel_data integer overflow
cve-program ·
Vendor product: SerenityOS
CVE-2026-16302Published
Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
cve-program ·
Vendor product: Spectra Legacy – Gutenberg Blocks
CVE-2026-94003Published
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
cve-program ·
Vendor product: CF-N1-S
CVE-2026-94104Published
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
cve-program ·
Vendor product: nivocart
CVE-2026-93977Published
code-projects Assessment Management add-single-mark.php cross site scripting
cve-program ·
Vendor product: Assessment Management
CVE-2026-93972Published
SourceCodester Online Reviewer Management System btn_functions.php sql injection
cve-program ·
Vendor product: Online Reviewer Management System
CVE-2026-96826Published
WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: w4-post-list
CVE-2026-74991Published
WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent
cve-program ·
Vendor product: WPForms
CVE-2026-80338Published
CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler
cve-program ·
Vendor product: CMB2
CVE-2026-80513Published
wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
cve-program ·
Vendor product: wpForo Forum
CVE-2026-82195Published
10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
cve-program ·
Vendor product: 10Web Booster
CVE-2026-82849Published
Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR
cve-program ·
Vendor product: Masteriyo LMS
CVE-2026-82850Published
Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure
cve-program ·
Vendor product: Masteriyo LMS
CVE-2026-84151Published
The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
cve-program ·
Vendor product: The Post Grid
CVE-2026-88843Published
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
CVE-2026-88845Published
MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
CVE-2026-88846Published
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
CVE-2026-88847Published
MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
CVE-2026-89002Published
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-89004Published
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-89005Published
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-93661Published
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
cve-program ·
Vendor product: Events Manager
CVE-2026-93662Published
Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
cve-program ·
Vendor product: Events Manager
GO-2026-6355Published
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
osv · CVE-2026-56855
Go: golang.org/x/crypto
MAL-2026-11153Published
Malicious code in triage_bot_using_sdkv3 (npm)
osv ·
npm: triage_bot_using_sdkv3
MAL-2026-14194Published
Malicious code in system-performance-helper (npm)
osv · GHSA-fhpw-32cw-j76m · SNYK-JS-SYSTEMPERFORMANCEHELPER-19003271
npm: system-performance-helper
MAL-2026-12507Published
Malicious code in @sapappgyver/appgyver-descriptors (npm)
osv · GHSA-33x7-6mwq-xg5j · SNYK-JS-SAPAPPGYVERAPPGYVERDESCRIPTORS-18758933
npm: @sapappgyver/appgyver-descriptors
MAL-2026-13467Published
Malicious code in wos-library-ui (npm)
osv · GHSA-j5rq-m53m-6xfx · GHSA-wh36-rj36-m3ff
npm: wos-library-ui
MAL-2026-15520Published
Malicious code in ring-device-settings-library (npm)
osv · GHSA-c9hf-9c62-jcfq · GHSA-f4f7-3wwr-hxfx
npm: ring-device-settings-library
MAL-2026-6379Published
Malicious code in simplisafe-gatsby (npm)
osv · GHSA-4h74-54qw-vx37 · GHSA-grcq-xfr7-4vpm
npm: simplisafe-gatsby
MAL-2026-15528Published
Malicious code in axis-datagrid (npm)
osv · GHSA-7f64-56gx-r4cm · GHSA-c6gq-r9w4-xg7j
npm: axis-datagrid
MAL-2026-6373Published
Malicious code in twilio-voice-js-reference-components (npm)
osv · GHSA-5wvr-g236-9w68 · GHSA-6547-hjjw-237x
npm: twilio-voice-js-reference-components
MAL-2026-15545Published
Malicious code in ux-metrics-client-interaction-subscriber (npm)
osv · GHSA-5v45-27j3-r52f · GHSA-fgwj-qvjx-g92h
npm: ux-metrics-client-interaction-subscriber
MAL-2026-13612Published
Malicious code in transform-es2015-unicode-regex (npm)
osv · GHSA-fmrp-cpm8-5245 · GHSA-jcxm-5v55-599q · SNYK-JS-DEPUPAWSSDKCREDENTIALPROVIDERPROCESS-18584483
npm: transform-es2015-unicode-regex
MAL-2026-15516Published
Malicious code in nx-app (npm)
osv · GHSA-h9j7-rx3x-rwhc · GHSA-vmrp-3pwx-mj42
npm: nx-app
MAL-2026-16373Published
Malicious code in wos-library (npm)
osv · GHSA-mfwv-9gcf-2mww
npm: wos-library
MAL-2026-16516Published
Malicious code in @egencia/uitk-global-styles (npm)
osv ·
npm: @egencia/uitk-global-styles
MAL-2026-6721Published
Malicious code in ts-eslint-helper (npm)
osv · GHSA-cr8h-v4vp-m4m8
npm: ts-eslint-helper
MAL-2026-16539Published
Malicious code in speaker_tagging_media_player (npm)
osv ·
npm: speaker_tagging_media_player
MAL-2026-12482Published
Malicious code in tool-registry-scripts (npm)
osv · GHSA-r8mg-hv3j-fc44
npm: tool-registry-scripts
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.