CVE-2026-85017Published
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
cve-program ·
Vendor product: Unlimited Elements For Elementor
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699233 source statements · aliases may refer to the same vulnerabilityCVE-2026-84223Published
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
cve-program ·
Vendor product: Kirki
CVE-2026-82842Published
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
cve-program ·
Vendor product: SAML Single Sign On
CVE-2026-81653Published
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
CVE-2026-81654Published
NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
CVE-2026-81652Published
NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
CVE-2026-81651Published
NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
CVE-2026-81650Published
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
CVE-2026-16542Published
Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
cve-program ·
Vendor product: Import and export users and customers
CVE-2026-14844Published
Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
cve-program ·
Vendor product: Master Slider
CVE-2026-13577Published
Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable
cve-program ·
https://cpan.org/modules: Dancer2
CVE-2026-12749Published
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
cve-program ·
Vendor product: Cloud Pak for Business Automation
CVE-2026-11918Published
IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures
cve-program ·
Vendor product: ContextForge MCP Gateway
CVE-2026-81898Published
Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-18113Published
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-82837Published
Insertion of Sensitive Information Into Sent Data in GitLab
cve-program ·
Vendor product: GitLab
CVE-2026-12910Published
Missing Authentication for Critical Function in GitLab
cve-program ·
Vendor product: GitLab
CVE-2026-68532Published
Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-18424Published
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-18425Published
IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-88922Published
Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
cve-program ·
Vendor product: Shared library
CVE-2026-76672Published
Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator
cve-program ·
Vendor product: EdgeConnect SD-WAN Gateways
CVE-2026-13327Published
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller …
cve-program ·
Vendor product: Server
CVE-2026-84850Published
Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connection…
cve-program ·
Vendor product: Server
CVE-2026-90969Published
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoi…
cve-program ·
Vendor product: Server
CVE-2026-90971Published
Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network …
cve-program ·
Vendor product: Server
CVE-2026-86754Published
Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients
cve-program ·
Vendor product: snipe-it
CVE-2026-86759Published
Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
cve-program ·
Vendor product: snipe-it
CVE-2026-86764Published
Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
cve-program ·
Vendor product: snipe-it
CVE-2026-86769Published
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
cve-program ·
Vendor product: snipe-it
CVE-2026-86774Published
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
cve-program ·
Vendor product: snipe-it
CVE-2026-87824Published
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
cve-program ·
https://repo1.maven.org/maven2/com/github/luben/zstd-jni/: zstd-jni
CVE-2026-90509Published
dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials
cve-program ·
Vendor product: orion-visor
CVE-2026-90515Published
SourceCodester School Registration and Fee System delete_stud.php sql injection
cve-program ·
Vendor product: School Registration and Fee System
CVE-2026-90520Published
jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorization
cve-program ·
Vendor product: Tourism-Management-System
CVE-2026-90525Published
itsourcecode Sales and Inventory System cust_pos_trans.php sql injection
cve-program ·
Vendor product: Sales and Inventory System
CVE-2026-82519Published
Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler
cve-program ·
Vendor product: Really Simple Security
CVE-2026-91836Published
OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors
cve-program ·
Vendor product: ClawScan
CVE-2026-91930Published
Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover
cve-program ·
Vendor product: Flowise
CVE-2026-91935Published
Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
cve-program ·
Vendor product: Flowise · Vendor product: Flowise
CVE-2026-91941Published
Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
cve-program ·
Vendor product: crawl4ai
CVE-2026-91951Published
FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
cve-program ·
Vendor product: FreeRDP
CVE-2026-91959Published
FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway
cve-program ·
Vendor product: FreeRDP
CVE-2026-91966Published
AVideo through 29.0 Unauthenticated SSRF via Host Header
cve-program ·
Vendor product: AVideo
CVE-2026-9858Published
Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
cve-program ·
Vendor product: Partial Shipment for WooCommerce
CVE-2026-11927Published
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
cve-program ·
Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container
CVE-2026-12101Published
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
cve-program ·
Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container
CVE-2026-92016Published
Use-after-free in the Disability Access APIs component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-92042Published
Race condition in the DOM: Content Processes component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.