CVE-2026-77705Published
Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover
cve-program ·
Vendor product: Booking for Appointments and Events Calendar
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700872 source statements · aliases may refer to the same vulnerabilityCVE-2026-77752Published
Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation
cve-program ·
Vendor product: Temporary Login Without Password
CVE-2026-77753Published
Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords
cve-program ·
Vendor product: Temporary Login Without Password
CVE-2026-78152Published
SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema
cve-program ·
Vendor product: SureRank SEO
CVE-2026-80491Published
SAMO Forms <= 1.0.0 - Unauthenticated SQLi
cve-program ·
Vendor product: SAMO Forms
CVE-2026-80494Published
Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download
cve-program ·
Vendor product: Yogeta WP Cloud
CVE-2026-81090Published
Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF
cve-program ·
Vendor product: Gpx2Graphics
CVE-2026-81402Published
DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
cve-program ·
Vendor product: DS Ad Rotator
CVE-2026-81429Published
Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF
cve-program ·
Vendor product: Export & Import WPBakery Page Builder
CVE-2026-81742Published
BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation
cve-program ·
Vendor product: BE REST Endpoints
CVE-2026-82845Published
Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection
cve-program ·
Vendor product: Masteriyo LMS
CVE-2026-82847Published
Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights
cve-program ·
Vendor product: Masteriyo LMS
CVE-2026-82851Published
Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR
cve-program ·
Vendor product: Masteriyo LMS
CVE-2026-84023Published
BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF
cve-program ·
Vendor product: BEAR
CVE-2026-84024Published
BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF
cve-program ·
Vendor product: BEAR
CVE-2026-84025Published
BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR
cve-program ·
Vendor product: BEAR
CVE-2026-84047Published
Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action
cve-program ·
Vendor product: Album Cover Finder
CVE-2026-84099Published
IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php
cve-program ·
Vendor product: wpstorecart
CVE-2026-84171Published
WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload
cve-program ·
Vendor product: WP images upload on piclect
CVE-2026-85681Published
WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update
cve-program ·
Vendor product: WP Component
CVE-2026-86790Published
WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode
cve-program ·
Vendor product: WP Highlight Box
CVE-2026-87759Published
Add User Autocomplete < 1.2 - Subscriber+ Privilege Escalation
cve-program ·
Vendor product: Add User Autocomplete
CVE-2026-87797Published
Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note
cve-program ·
Vendor product: Sprout Invoices
CVE-2026-87842Published
Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure
cve-program ·
Vendor product: Zonify
CVE-2026-87888Published
YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route
cve-program ·
Vendor product: YayPricing
CVE-2026-87891Published
Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API
cve-program ·
Vendor product: Rox Appointment Booking
CVE-2026-87892Published
Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
cve-program ·
Vendor product: Rox Appointment Booking
CVE-2026-87894Published
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
cve-program ·
Vendor product: Rox Appointment Booking
CVE-2026-87916Published
WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure
cve-program ·
Vendor product: WPBot
CVE-2026-87918Published
WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions
cve-program ·
Vendor product: WPBot
CVE-2026-87919Published
Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
cve-program ·
Vendor product: Product XML Feed Manager for WooCommerce
GHSA-9r4w-jg96-92mvPublished
Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()
osv · CVE-2026-12681 · GO-2026-5298
Go: github.com/google/go-attestation
GHSA-fmgp-q6jx-gg3xPublished
KubeVela Terraform remote loader DoS via unbounded file read
osv · CVE-2026-55108 · GO-2026-6312
Go: github.com/oam-dev/kubevela · Go: github.com/oam-dev/kubevela · Go: github.com/oam-dev/kubevela
GHSA-xmrv-pmrh-hhx2Published
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder
osv · CVE-2026-89090 · GO-2026-5764
Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime
GO-2026-5764Published
DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
osv · CVE-2026-89090 · GHSA-xmrv-pmrh-hhx2
Go: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentcore · Go: github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime
CVE-2026-9176Published
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
cve-program ·
Vendor product: WebSphere Application Server
CVE-2026-81940Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81941Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81211Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81204Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-79742Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-78575Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-78571Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-85025Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-81268Published
Langflow is vulnerable to authentication bypass and insufficient session expiration
cve-program ·
Vendor product: Langflow OSS
CVE-2026-76059Published
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
cve-program ·
Vendor product: Langflow OSS
CVE-2026-42016Published
Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation
cve-program ·
Vendor product: artifactory
CVE-2026-84869Published
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
cve-program ·
Vendor product: ScreenConnect
CVE-2026-59310Published
vCenter directory-traversal vulnerability
cve-program ·
Vendor product: Cloud Foundation · Vendor product: vSphere Foundation · Vendor product: vCenter
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.