CVE-2026-117512Published
oretnom23 php-travel-agency-system employee_insert.php unrestricted upload
cve-program ·
Vendor product: php-travel-agency-system
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
690315 source statements · aliases may refer to the same vulnerabilityCVE-2026-116673Published
systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
cve-program ·
Vendor product: systeminformation
CVE-2026-116675Published
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
cve-program ·
Vendor product: tinymce
CVE-2026-118510Published
Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs
cve-program ·
Vendor product: mongodb/laravel-mongodb
CVE-2026-114104Published
adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
cve-program ·
Vendor product: adm-zip
CVE-2026-57189Published
Asterisk: Possible RED T.140 Generation Accumulation OOB Write
cve-program ·
Vendor product: asterisk · Vendor product: certified-asterisk
CVE-2026-104354Published
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
cve-program ·
Vendor product: Adobe Campaign Classic
CVE-2026-117515Published
oretnom23 php-travel-agency-system traceapplication.php sql injection
cve-program ·
Vendor product: php-travel-agency-system
CVE-2026-116679Published
Neko: Authorization bypass in legacy WebRTC input handling
cve-program ·
Vendor product: neko
CVE-2026-57202Published
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
cve-program ·
Vendor product: asterisk · Vendor product: certified-asterisk
CVE-2026-116686Published
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
cve-program ·
Vendor product: python-sdk
CVE-2026-116690Published
MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source
cve-program ·
Vendor product: mlflow
CVE-2026-112352Published
Sunhillo SureLine Authentication Bypass via Session Cookie
cve-program ·
Vendor product: SureLine
CVE-2026-116694Published
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
cve-program ·
Vendor product: opentelemetry-python
CVE-2026-116774Published
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
cve-program ·
Vendor product: russh
CVE-2026-57186Published
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
cve-program ·
Vendor product: asterisk · Vendor product: certified-asterisk
CVE-2026-57190Published
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
cve-program ·
Vendor product: asterisk · Vendor product: certified-asterisk
CVE-2026-118128Published
a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
cve-program ·
Vendor product: a2a-js
CVE-2026-58255Published
Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
cve-program ·
Vendor product: Cronicle
CVE-2026-114099Published
Coraza 3.0.0 before 3.8.1 WAF Bypass via JSON Key Collision
cve-program ·
Vendor product: coraza
CVE-2026-50571Published
WebSub: Reflected script execution through intent-verification challenges
cve-program ·
Vendor product: websub
CVE-2026-118272Published
a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
cve-program ·
Vendor product: a2ui
CVE-2014-125136Published
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
cve-program ·
Vendor product: qEngine CMS · Vendor product: Kemana Directory · Vendor product: Cart Engine
CVE-2026-117605Published
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
cve-program ·
Vendor product: nopCommerce
CVE-2026-117609Published
rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder
cve-program ·
Vendor product: rtl_433
CVE-2026-118372Published
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
cve-program ·
Vendor product: LibreSSL
CVE-2026-118376Published
WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
cve-program ·
Vendor product: WeKnora
CVE-2026-107625Published
Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
cve-program ·
Vendor product: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
CVE-2026-109999Published
AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
cve-program ·
Vendor product: AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot
CVE-2026-118275Published
a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
cve-program ·
Vendor product: a2ui
CVE-2026-111255Published
affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
cve-program ·
Vendor product: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
CVE-2026-109236Published
Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
cve-program ·
Vendor product: Customer Email Verification for WooCommerce
CVE-2026-109381Published
Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
cve-program ·
Vendor product: Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
CVE-2026-103996Published
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
cve-program ·
Vendor product: If-So Dynamic Content – Elementor & All Page Builders Personalization
CVE-2026-109972Published
s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
cve-program ·
Vendor product: s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
CVE-2026-76058Published
PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
cve-program ·
Vendor product: PayPal Brasil para WooCommerce
CVE-2026-111120Published
VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
cve-program ·
Vendor product: VikRentCar Car Rental Management System
CVE-2026-118164Published
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
cve-program ·
Vendor product: If-So Dynamic Content – Elementor & All Page Builders Personalization
CVE-2026-109980Published
Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
cve-program ·
Vendor product: Related Posts for WordPress
CVE-2026-92098Published
Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
cve-program ·
Vendor product: Webheadcoder Multi-Step Forms for Contact Form 7
CVE-2026-116610Published
Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
cve-program ·
Vendor product: Clean Login
CVE-2026-107710Published
Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
cve-program ·
Vendor product: Hustle – Email Marketing, Lead Generation, Optins, Popups
CVE-2026-110185Published
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
cve-program ·
Vendor product: Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
CVE-2026-115596Published
WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: ecommerce-product-catalog
CVE-2026-115612Published
WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: slicewp
CVE-2026-116393Published
WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: optima-express
CVE-2026-59172Published
Joker linter executed project-local .jokerd/linter.* files during linting
cve-program ·
Vendor product: joker
CVE-2026-59185Published
identrail: Cross-tenant GitHub installation binding without ownership verification
cve-program ·
Vendor product: identrail
CVE-2026-115968Published
WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: ultimate-member
CVE-2026-50539Published
Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
cve-program ·
Vendor product: xibo-cms
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.