CVE-2026-34986Published
Go JOSE affect by a panic in JWE decryption
cve-program ·
Vendor product: go-jose
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699261 source statements · aliases may refer to the same vulnerabilityCVE-2026-47691Published
Netty has Insufficient Bailiwick Validation for NS Records
cve-program ·
Vendor product: netty
CVE-2026-3505Published
Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
cve-program ·
https://www.bouncycastle.org/download/bouncy-castle-java/: bcpg
CVE-2026-32283Published
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
cve-program ·
https://pkg.go.dev: crypto/tls
CVE-2026-48059Published
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
cve-program ·
Vendor product: netty
CVE-2026-33810Published
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
cve-program ·
https://pkg.go.dev: crypto/x509
CVE-2026-44893Published
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
cve-program ·
Vendor product: netty
CVE-2026-33811Published
Crash when handling long CNAME response in net
cve-program ·
https://pkg.go.dev: net
CVE-2026-80462Published
Privilege Escalation in Progress Chef Automate
cve-program ·
Vendor product: Chef Automate
CVE-2026-40536Published
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to o…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-92714Published
Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter
cve-program ·
Vendor product: Download Manager
CVE-2026-89330Published
EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
cve-program ·
Vendor product: EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
CVE-2026-17607Published
WP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute
cve-program ·
Vendor product: WP Inventory Manager
CVE-2026-90981Published
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
cve-program ·
Vendor product: Newsletter – Send awesome emails from WordPress
CVE-2026-14472Published
Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
cve-program ·
Vendor product: Kubio AI Page Builder
CVE-2026-13623Published
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authent…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-13683Published
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remot…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-56592Published
HCL BigFix Service Management is affected by multiple security vulnerabilities.
cve-program ·
Vendor product: HCL BigFix Service Management
CVE-2026-81340Published
MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
CVE-2026-81810Published
All-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure
cve-program ·
Vendor product: All-in-One WP Migration and Backup
CVE-2026-84738Published
AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE
cve-program ·
Vendor product: AF Companion
CVE-2026-84902Published
King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import
cve-program ·
Vendor product: King Addons for Elementor
CVE-2026-84903Published
King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode
cve-program ·
Vendor product: King Addons for Elementor
CVE-2026-84904Published
King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
cve-program ·
Vendor product: King Addons for Elementor
CVE-2026-90310Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
CVE-2026-85009Published
RestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment Recovery
cve-program ·
Vendor product: RestroPress
CVE-2026-85122Published
Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
cve-program ·
Vendor product: Easy Form Builder by WhiteStudio
CVE-2026-85123Published
Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type Confusion
cve-program ·
Vendor product: Easy Form Builder by WhiteStudio
CVE-2026-85127Published
VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment
cve-program ·
Vendor product: VikBooking Hotel Booking Engine & PMS
CVE-2026-85350Published
UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together
cve-program ·
Vendor product: UpsellWP
CVE-2026-56597Published
HCL BigFix Service Management is affected by multiple security vulnerabilities.
cve-program ·
Vendor product: HCL BigFix Service Management
CVE-2026-87767Published
WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url
cve-program ·
Vendor product: wp shortcut link and advertisement baner
CVE-2026-87770Published
Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product
cve-program ·
Vendor product: Price Drop Alert for Woo Commerce
CVE-2026-87771Published
Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read
cve-program ·
Vendor product: Product Question and Answer
CVE-2026-87774Published
Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week
cve-program ·
Vendor product: Tz Weekly Radio Schedule
CVE-2026-87775Published
Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell
cve-program ·
Vendor product: Tz Weekly Radio Schedule
CVE-2026-87965Published
Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token
cve-program ·
Vendor product: Easy Appointments
CVE-2026-87966Published
Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR
cve-program ·
Vendor product: Easy Appointments
CVE-2026-88798Published
Really Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP Header
cve-program ·
Vendor product: Really Simple Security
CVE-2026-88825Published
iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings
cve-program ·
Vendor product: iGMS Direct Booking
CVE-2026-88844Published
MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
CVE-2026-88993Published
All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
cve-program ·
Vendor product: All Bootstrap Blocks
CVE-2026-89007Published
Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
cve-program ·
Vendor product: Bookit — Booking & Appointment Calendar
CVE-2026-89008Published
Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure
cve-program ·
Vendor product: Bookit — Booking & Appointment Calendar
CVE-2026-90978Published
Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check
cve-program ·
Vendor product: Filter Gallery
CVE-2026-90984Published
Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field
cve-program ·
Vendor product: Generate PDF using Contact Form 7
CVE-2026-79713Published
Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
cve-program ·
https://wordpress.org/plugins: Breeze Cache
CVE-2026-86796Published
WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters
cve-program ·
https://wordpress.org/plugins: Hide My WP Ghost
CVE-2026-86800Published
WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check
cve-program ·
https://wordpress.org/plugins: Hide My WP Ghost
CVE-2026-88994Published
All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
cve-program ·
https://wordpress.org/plugins: All Bootstrap Blocks
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.