CVE-2026-75131Published
NetworkManager-l2tp Privilege Escalation via pppd Username Injection
cve-program ·
Vendor product: NetworkManager-l2tp
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698979 source statements · aliases may refer to the same vulnerabilityCVE-2026-92708Published
devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
cve-program ·
Vendor product: devalue
CVE-2026-90899Published
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0
cve-program ·
Vendor product: Easy Store extension for Joomla
CVE-2026-96770Published
s2s-proxy accepts untrusted client certificates
cve-program ·
https://pkg.go.dev: github.com/temporalio/s2s-proxy
CVE-2026-94181Published
Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
cve-program ·
Vendor product: Arc
CVE-2026-96872Published
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
cve-program ·
Vendor product: Mediawiki - WikiLambda Extension
CVE-2026-92692Published
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
cve-program ·
Vendor product: sulu
CVE-2026-90903Published
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0
cve-program ·
Vendor product: Easy Store extension for Joomla
CVE-2026-90905Published
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0
cve-program ·
Vendor product: Easy Store extension for Joomla
CVE-2026-90904Published
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0
cve-program ·
Vendor product: Easy Store extension for Joomla
CVE-2026-90900Published
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0
cve-program ·
Vendor product: Easy Store extension for Joomla
CVE-2026-92730Published
LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
cve-program ·
Vendor product: LimeSurvey
CVE-2026-94183Published
Address bar spoofing risk in affected Android versions of Arc Search
cve-program ·
Vendor product: Arc Search
CVE-2025-63564Published
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests
cve-program ·
Vendor product: n/a
CVE-2026-86064Published
Klever-Go: /log controls global node logging
cve-program ·
Vendor product: klever-go
CVE-2026-77601Published
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
cve-program ·
Vendor product: cosmos
CVE-2026-77394Published
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
cve-program ·
Vendor product: cosmos
CVE-2026-59990Published
Jawn: Uncontrolled nesting depth in JSON parser
cve-program ·
Vendor product: jawn
CVE-2026-96549Published
sfturing hosp_order CommonUserServiceImpl.java cleartext storage
cve-program ·
Vendor product: hosp_order
CVE-2026-95603Published
WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: reycob-product-import-export
CVE-2026-95592Published
WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: tlp-team
CVE-2026-95528Published
WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: core-web-vitals-pagespeed-booster
CVE-2026-95522Published
WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: easy-digital-downloads
CVE-2026-94682Published
WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: podcast-importer-secondline
CVE-2026-94498Published
WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: appmysite
CVE-2026-94179Published
WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: razorpay-payment-button
CVE-2026-94118Published
WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: premium-blocks-for-gutenberg
CVE-2026-93772Published
WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: wpforo
CVE-2026-93529Published
WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: wsp-mcp-ai-agents-connector
CVE-2026-92700Published
Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation
cve-program ·
Vendor product: caddy
CVE-2026-92284Published
Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS
cve-program ·
Vendor product: caddy
CVE-2026-77582Published
Tinyauth: User enumeration attack by timing oracle
cve-program ·
Vendor product: tinyauth
CVE-2026-63132Published
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
cve-program ·
Vendor product: openbao
CVE-2026-46655Published
virtio-win: Integer overflow causing a heap overflow in Viosock driver
cve-program ·
Vendor product: kvm-guest-drivers-windows
CVE-2026-55062Published
uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
cve-program ·
Vendor product: cli
CVE-2026-54670Published
WeGIA: Unauthenticated Auth Bypass + Local File Inclusion
cve-program ·
Vendor product: WeGIA
CVE-2026-54506Published
Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
cve-program ·
Vendor product: Vvveb
CVE-2026-93526Published
WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: event-tickets
CVE-2026-61541Published
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service
cve-program ·
Vendor product: zapros
CVE-2026-61833Published
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
cve-program ·
Vendor product: zot
CVE-2026-77240Published
WACRM: Database-layer authorization bypasses
cve-program ·
Vendor product: wacrm
CVE-2026-63330Published
Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions
cve-program ·
Vendor product: warpgate
CVE-2026-93622Published
WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: wps-limit-login
CVE-2026-94079Published
WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: wp-user-manager
CVE-2026-3626Published
Multiple Vulnerabilities in IBM Concert Software
cve-program ·
Vendor product: Concert
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.