CVE-2026-84171Published
WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload
cve-program ·
Vendor product: WP images upload on piclect
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699906 source statements · aliases may refer to the same vulnerabilityCVE-2026-85681Published
WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
cve-program ·
Vendor product: WP Component
CVE-2026-86790Published
WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode
cve-program ·
Vendor product: WP Highlight Box
CVE-2026-87759Published
Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
cve-program ·
Vendor product: Add User Autocomplete
CVE-2026-87797Published
Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note
cve-program ·
Vendor product: Sprout Invoices
CVE-2026-87842Published
Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure
cve-program ·
Vendor product: Zonify
CVE-2026-87888Published
YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
cve-program ·
Vendor product: YayPricing
CVE-2026-87891Published
Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
cve-program ·
Vendor product: Rox Appointment Booking
CVE-2026-87892Published
Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
cve-program ·
Vendor product: Rox Appointment Booking
CVE-2026-87894Published
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
cve-program ·
Vendor product: Rox Appointment Booking
CVE-2026-87916Published
WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure
cve-program ·
Vendor product: WPBot
CVE-2026-87918Published
WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
cve-program ·
Vendor product: WPBot
CVE-2026-87919Published
Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
cve-program ·
Vendor product: Product XML Feed Manager for WooCommerce
GHSA-9r4w-jg96-92mvPublished
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
osv · CVE-2026-12681 · GO-2026-5298
Go: github.com/google/go-attestation
GHSA-fmgp-q6jx-gg3xPublished
KubeVela Terraform remote loader DoS via unbounded file read
osv · CVE-2026-55108 · GO-2026-6312
Go: github.com/oam-dev/kubevela · Go: github.com/oam-dev/kubevela · Go: github.com/oam-dev/kubevela
GHSA-xmrv-pmrh-hhx2Published
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
osv · CVE-2026-89090 · GO-2026-5764
Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime
GO-2026-5764Published
DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
osv · CVE-2026-89090 · GHSA-xmrv-pmrh-hhx2
Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime
CVE-2026-9176Published
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
cve-program ·
Vendor product: WebSphere Application Server
CVE-2026-81940Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81941Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81211Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81204Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-79742Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-78575Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-78571Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-85025Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81268Published
Langflow is vulnerable to authentication bypass and insufficient session expiration
cve-program ·
Vendor product: Langflow OSS
CVE-2026-76059Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-42016Published
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
cve-program ·
Vendor product: artifactory
CVE-2026-84869Published
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
cve-program ·
Vendor product: ScreenConnect
CVE-2026-59310Published
vCenter directory-traversal vulnerability
cve-program ·
Vendor product: Cloud Foundation · Vendor product: vSphere Foundation · Vendor product: vCenter
GHSA-65h7-9wrw-629cPublished
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
osv · CVE-2026-59973
npm: mcp-from-openapi · npm: @frontmcp/adapters · npm: frontmcp
GHSA-rqx4-3f6q-3x2vPublished
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
osv · CVE-2026-59148
npm: @mockoon/commons-server · npm: @mockoon/cli
GHSA-325j-mg25-8q58Published
yayson: Prototype pollution in Store/LegacyStore deserialization
osv · CVE-2026-61534
npm: yayson
GHSA-8wqc-v2q8-vff2Published
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
osv · CVE-2026-59149
npm: @mockoon/commons-server · npm: @mockoon/cli
CVE-2026-19313Published
Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution
cve-program ·
Vendor product: Fireware OS · Vendor product: Fireware OS
CVE-2026-81977Published
Acrobat Reader | Integer Underflow (Wrap or Wraparound) (CWE-191)
cve-program ·
Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024
CVE-2026-81982Published
Acrobat Reader | Out-of-bounds Read (CWE-125)
cve-program ·
Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024
CVE-2026-82001Published
Acrobat Reader | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024
CVE-2026-75706Published
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
CVE-2026-75735Published
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
CVE-2026-75729Published
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
CVE-2026-75677Published
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
CVE-2026-75642Published
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
CVE-2026-75635Published
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
CVE-2026-75661Published
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.