CVE-2026-118095Published
WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: media-library-assistant
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
693902 source statements · aliases may refer to the same vulnerabilityCVE-2026-115605Published
WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: suredash
CVE-2026-110682Published
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
GHSA-c33x-vcv4-vg3gPublished
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
osv ·
crates.io: cedar-policy · crates.io: cedar-policy · npm: @cedar-policy/cedar-wasm
GHSA-q344-5v34-gm84Published
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
osv · CVE-2026-62264
npm: @sylphx/pdf-reader-mcp
GHSA-w9x9-j56r-h98rPublished
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
osv ·
npm: @eeacms/volto-chatbot
GHSA-8g5g-mxqh-grgjPublished
Vite: `server.fs.deny` bypassed with queries
osv · CVE-2026-118662
npm: vite
GHSA-r899-h629-j84rPublished
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
osv · BIT-parse-2026-61448 · CVE-2026-61448
npm: parse-server · npm: parse-server
GHSA-p6c5-mjgj-m4rmWithdrawn
Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
osv ·
npm: parse-server · npm: parse-server
CVE-2026-110678Published
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-110677Published
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-110676Published
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-110675Published
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-110674Published
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-110673Published
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-110672Published
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-107618Published
Gitea cross-site request forgery on repository topics
cve-program ·
Vendor product: gitea.dev
CVE-2026-116098Published
SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization
cve-program ·
Vendor product: Ravenfield
CVE-2026-116095Published
smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation
cve-program ·
Vendor product: smg
CVE-2026-116062Published
SourceCodester Performance Indicator System save_profile.php sql injection
cve-program ·
Vendor product: Performance Indicator System
CVE-2026-116198Published
Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store
cve-program ·
Vendor product: snipe-it
CVE-2026-116058Published
Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection
cve-program ·
Vendor product: Activiti
CVE-2026-116055Published
SourceCodester Performance Indicator System deleteproduct.php sql injection
cve-program ·
Vendor product: Performance Indicator System
CVE-2026-116186Published
OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
cve-program ·
Vendor product: core
CVE-2026-116206Published
YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
cve-program ·
Vendor product: yeswiki
CVE-2026-116202Published
YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
cve-program ·
Vendor product: yeswiki
CVE-2026-116194Published
Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback
cve-program ·
Vendor product: rclone
CVE-2026-59837Published
A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all ver…
cve-program ·
Vendor product: FortiOS · Vendor product: FortiProxy · Vendor product: FortiPAM
CVE-2026-71408Published
A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an unauthenticate…
cve-program ·
Vendor product: FortiOS
CVE-2026-116190Published
rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect
cve-program ·
Vendor product: rclone
CVE-2026-39814Published
Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.13, FortiWeb 7.2.7 through 7.2.13, FortiWeb 7.0.10 through 7.0.12 may…
cve-program ·
Vendor product: FortiWeb
CVE-2026-106175Published
A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiPro…
cve-program ·
Vendor product: FortiOS · Vendor product: FortiSwitch · Vendor product: FortiProxy
CVE-2026-84392Published
A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all…
cve-program ·
Vendor product: FortiOS · Vendor product: FortiProxy · Vendor product: FortiPAM
CVE-2026-116182Published
phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching
cve-program ·
Vendor product: phpMyFAQ
CVE-2026-84387Published
An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2…
cve-program ·
Vendor product: FortiSandbox
CVE-2026-116174Published
vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate
cve-program ·
Vendor product: vllm
CVE-2026-116170Published
SiYuan before v3.8.7 SQL Injection via History Search op and query
cve-program ·
Vendor product: siyuan
CVE-2026-116166Published
SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting
cve-program ·
Vendor product: siyuan
CVE-2026-116162Published
Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
cve-program ·
Vendor product: parse-server · Vendor product: parse-server
CVE-2026-116142Published
ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box
cve-program ·
Vendor product: ImageMagick
CVE-2026-116137Published
adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names
cve-program ·
Vendor product: adm-zip
CVE-2026-116014Published
open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType
cve-program ·
Vendor product: open62541
CVE-2026-116052Published
LinkStackOrg LinkStack cross-site request forgery
cve-program ·
Vendor product: LinkStack
CVE-2026-116071Published
rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
cve-program ·
Vendor product: rotki
CVE-2026-116067Published
Paisa before 0.7.8 Path Traversal via Editor and Sheet API
cve-program ·
Vendor product: paisa
CVE-2026-23705Published
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.1…
cve-program ·
Vendor product: FortiAnalyzer · Vendor product: FortiManager
CVE-2026-116048Published
krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection
cve-program ·
Vendor product: EmployeeRecruitmentSystem
CVE-2026-116045Published
1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal
cve-program ·
Vendor product: designer-mcp
CVE-2026-116006Published
YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication
cve-program ·
Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.