CVE-2026-54578Published
mport verify can compare stale checksum data after hashing failures
cve-program ·
Vendor product: mport
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699261 source statements · aliases may refer to the same vulnerabilityCVE-2026-54576Published
mport package installation has symlink TOCTOU in chown and chmod handling
cve-program ·
Vendor product: mport
CVE-2026-54676Published
Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled
cve-program ·
Vendor product: scoold
CVE-2026-52836Published
OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service
cve-program ·
Vendor product: OpenDDS
CVE-2026-55061Published
uniget: EDITOR Command Injection in uniget CLI
cve-program ·
Vendor product: cli
CVE-2026-54716Published
Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets
cve-program ·
Vendor product: valhalla
CVE-2026-54495Published
Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters
cve-program ·
Vendor product: open-feature-operator
CVE-2026-54354Published
MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation
cve-program ·
Vendor product: MapServer
CVE-2026-16582Published
Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
cve-program ·
Vendor product: Booking for Appointments and Events Calendar – Amelia
CVE-2026-50158Published
yutu: Arbitrary File Write via MCP `caption-download` Tool
cve-program ·
Vendor product: yutu
CVE-2026-54507Published
Vvveb oEmbedProxy vulnerable to server-side request forgery
cve-program ·
Vendor product: Vvveb
CVE-2026-54634Published
Hamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure
cve-program ·
Vendor product: Hamlib
CVE-2026-15650Published
RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
cve-program ·
Vendor product: RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
CVE-2026-18317Published
Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action
cve-program ·
Vendor product: Foxtool All-in-One: Contact chat button, Custom login, Media optimize images
CVE-2026-17586Published
VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
cve-program ·
Vendor product: VK All in One Expansion Unit
CVE-2026-14323Published
Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters
cve-program ·
Vendor product: Printcart Store – Web to Print Product Designer for WooCommerce
CVE-2026-85705Published
Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
cve-program ·
Vendor product: Location Manager
CVE-2026-93493Published
Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: netty-handler-ssl-ocsp
CVE-2025-13533Published
CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
cve-program ·
Vendor product: CSS & JavaScript Toolbox
CVE-2026-87915Published
Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
cve-program ·
Vendor product: Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
CVE-2026-75880Published
Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-selector · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-selector
CVE-2026-87886Published
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Ac…
cve-program ·
Vendor product: Acronis Backup plugin for cPanel & WHM · Vendor product: Acronis Backup extension for Plesk · Vendor product: Acronis Backup plugin for DirectAdmin
CVE-2026-93594Published
ArcadeDB before 26.9.1 ACL Bypass via Index and TimeSeries
cve-program ·
Vendor product: arcadedb
CVE-2023-5778Published
Missing Length Check
cve-program ·
Vendor product: Freelance Controller DCP · Vendor product: Freelance Controller AC700 · Vendor product: Freelance Controller AC800
CVE-2026-28199Published
Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell
cve-program ·
Vendor product: NetBackup Flex OS
CVE-2026-28198Published
Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell
cve-program ·
Vendor product: NetBackup Flex OS
CVE-2026-28197Published
Privilege Escalation via Argument Injection in NetBackup Flex OS Shell
cve-program ·
Vendor product: NetBackup Flex OS
CVE-2026-89413Published
Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter
cve-program ·
Vendor product: Filter Gallery
CVE-2026-75017Published
Magazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint
cve-program ·
Vendor product: Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
CVE-2026-84909Published
Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
cve-program ·
Vendor product: Custom Twitter Feeds – A Tweets Widget or X Feed Widget
CVE-2026-89278Published
GPTranslate <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script
cve-program ·
Vendor product: GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
CVE-2026-12106Published
Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
cve-program ·
Vendor product: Auto Upload Images
CVE-2026-92561Published
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
cve-program ·
Vendor product: Booking Calendar
CVE-2026-91707Published
Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
cve-program ·
Vendor product: Divi
CVE-2026-89138Published
Filter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action
cve-program ·
Vendor product: Filter Gallery
CVE-2026-17576Published
InfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key
cve-program ·
Vendor product: InfiniteWP Client
CVE-2026-17086Published
ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
cve-program ·
Vendor product: ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
CVE-2026-93468Published
HGiga｜OAKlouds - Arbitrary File Read
cve-program ·
Vendor product: OAKlouds-bulletin_v3-2.0 · Vendor product: OAKlouds-bulletin_v3-3.0
CVE-2026-93467Published
HGiga｜OAKlouds - Insecure Deserialization
cve-program ·
Vendor product: OAKlouds-custom_page-2.0 · Vendor product: OAKlouds-custom_page-3.0 · Vendor product: OAKlouds-custom_page-4.0
CVE-2026-86688Published
Session id is not renewed on authentication in ash_authentication, allowing session fixation
cve-program ·
https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication
CVE-2026-76949Published
Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement
cve-program ·
https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication
CVE-2026-14311Published
Booking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover
cve-program ·
Vendor product: Booking for Appointments and Events Calendar – Amelia
CVE-2026-93395Published
Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()
cve-program ·
Vendor product: C Driver
CVE-2026-93394Published
libmongoc SCRAM client nonce-validation bypass
cve-program ·
Vendor product: C Driver
CVE-2026-7406Published
BMP File Parsing Untrusted Pointer Dereference in certain Autodesk products
cve-program ·
Vendor product: Revit · Vendor product: AutoCAD · Vendor product: AutoCAD LT
CVE-2026-7405Published
TIF File Parsing Out-of-Bounds Read in certain Autodesk products
cve-program ·
Vendor product: Revit · Vendor product: AutoCAD · Vendor product: AutoCAD LT
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.