CVE-2026-50571Published
WebSub: Reflected script execution through intent-verification challenges
cve-program ·
Vendor product: websub
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
690320 source statements · aliases may refer to the same vulnerabilityCVE-2026-118272Published
a2ui-project a2ui Error data-context.ts DataContext.dispatchExpressionError information exposure
cve-program ·
Vendor product: a2ui
CVE-2014-125136Published
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
cve-program ·
Vendor product: qEngine CMS · Vendor product: Kemana Directory · Vendor product: Cart Engine
CVE-2026-117605Published
nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers
cve-program ·
Vendor product: nopCommerce
CVE-2026-117609Published
rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder
cve-program ·
Vendor product: rtl_433
CVE-2026-118372Published
LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path
cve-program ·
Vendor product: LibreSSL
CVE-2026-118376Published
WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
cve-program ·
Vendor product: WeKnora
CVE-2026-107625Published
Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
cve-program ·
Vendor product: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
CVE-2026-109999Published
AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
cve-program ·
Vendor product: AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot
CVE-2026-118275Published
a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
cve-program ·
Vendor product: a2ui
CVE-2026-111255Published
affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter
cve-program ·
Vendor product: affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
CVE-2026-109236Published
Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter
cve-program ·
Vendor product: Customer Email Verification for WooCommerce
CVE-2026-109381Published
Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
cve-program ·
Vendor product: Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
CVE-2026-103996Published
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
cve-program ·
Vendor product: If-So Dynamic Content – Elementor & All Page Builders Personalization
CVE-2026-109972Published
s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
cve-program ·
Vendor product: s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
CVE-2026-76058Published
PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action
cve-program ·
Vendor product: PayPal Brasil para WooCommerce
CVE-2026-111120Published
VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
cve-program ·
Vendor product: VikRentCar Car Rental Management System
CVE-2026-118164Published
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
cve-program ·
Vendor product: If-So Dynamic Content – Elementor & All Page Builders Personalization
CVE-2026-109980Published
Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter
cve-program ·
Vendor product: Related Posts for WordPress
CVE-2026-92098Published
Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
cve-program ·
Vendor product: Webheadcoder Multi-Step Forms for Contact Form 7
CVE-2026-116610Published
Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook
cve-program ·
Vendor product: Clean Login
CVE-2026-107710Published
Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
cve-program ·
Vendor product: Hustle – Email Marketing, Lead Generation, Optins, Popups
CVE-2026-110185Published
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
cve-program ·
Vendor product: Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
CVE-2026-115596Published
WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: ecommerce-product-catalog
CVE-2026-115612Published
WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: slicewp
CVE-2026-116393Published
WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: optima-express
CVE-2026-59172Published
Joker linter executed project-local .jokerd/linter.* files during linting
cve-program ·
Vendor product: joker
CVE-2026-59185Published
identrail: Cross-tenant GitHub installation binding without ownership verification
cve-program ·
Vendor product: identrail
CVE-2026-115968Published
WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: ultimate-member
CVE-2026-50539Published
Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
cve-program ·
Vendor product: xibo-cms
CVE-2026-50542Published
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
cve-program ·
Vendor product: xibo-cms
CVE-2026-116778Published
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
cve-program ·
Vendor product: fogproject
CVE-2026-93522Published
X.Org Server Glamor CopyArea Heap Buffer Overflow
cve-program ·
Vendor product: xorg-x11-server · Vendor product: xwayland
CVE-2016-20103Published
Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php
cve-program ·
Vendor product: Cherry Plugin
CVE-2026-114094Published
Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths
cve-program ·
Vendor product: dulwich
CVE-2026-113731Published
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
cve-program ·
Vendor product: djust
CVE-2026-114089Published
Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover
cve-program ·
Vendor product: trigger.dev
CVE-2026-81212Published
DataStage on Cloud Pak for Data Improper Authorization
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-113705Published
a2aproject a2a-rs error.rs information exposure
cve-program ·
Vendor product: a2a-rs
CVE-2026-114069Published
Trigger.dev before 4.6.0 Root Secret Disclosure via envvars API Endpoint
cve-program ·
Vendor product: trigger.dev
CVE-2026-113736Published
D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password
cve-program ·
Vendor product: DHP-W610AV
CVE-2020-37289Published
Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
cve-program ·
Vendor product: vyper
GHSA-f5f4-3hh4-f54mPublished
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
osv · CVE-2026-54167 · GO-2026-6266
Go: github.com/openshift-pipelines/pipelines-as-code · Go: github.com/openshift-pipelines/pipelines-as-code · Go: github.com/openshift-pipelines/pipelines-as-code
CVE-2026-114041Published
FreeRDP before 3.32.1 Heap Out-of-Bounds Read via RD Gateway Consent Message
cve-program ·
Vendor product: FreeRDP
CVE-2026-114046Published
FreeRDP 3.0.0 before 3.32.0 null-pointer dereference via emulated smartcard
cve-program ·
Vendor product: FreeRDP
CVE-2026-56828Published
Shopper: read-only team permissions allow administrator creation and permission escalation
cve-program ·
Vendor product: shopper
CVE-2026-93521Published
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
cve-program ·
Vendor product: xorg-x11-server · Vendor product: xwayland
CVE-2026-59979Published
YosemiteCrew: Missing organization authorization on service and PMS library/template routes
cve-program ·
Vendor product: Yosemite-Crew
CVE-2026-114084Published
Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
cve-program ·
Vendor product: trigger.dev
CVE-2026-44179Published
XWiki Pro Macros: excerpt-include title and content injection executes code
cve-program ·
Vendor product: xwiki-pro-macros
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.