CVE-2026-42693Published
WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: jannah
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694159 source statements · aliases may refer to the same vulnerabilityCVE-2026-107686Published
Gitea reactions accepted on locked issues and comments
cve-program ·
Vendor product: gitea.dev
CVE-2026-21589Published
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability …
cve-program ·
Vendor product: Bamboo Data Center · Vendor product: Bitbucket Data Center · Vendor product: Confluence Data Center
CVE-2026-115377Published
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream
cve-program ·
Vendor product: incus
CVE-2026-115373Published
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}
cve-program ·
Vendor product: incus
CVE-2026-115369Published
OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs
cve-program ·
Vendor product: openbao
CVE-2026-115363Published
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
cve-program ·
Vendor product: openbao
CVE-2026-115359Published
OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Role-Based Rate Limit Quota Bypass via Request Parsing
cve-program ·
Vendor product: openbao
CVE-2026-115351Published
Mistune 3.2.1 before 3.3.0 CSS Injection via Figure Directive figwidth Option
cve-program ·
Vendor product: mistune
CVE-2026-108359Published
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
cve-program ·
Vendor product: PhpSpreadsheet
CVE-2026-108360Published
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
cve-program ·
Vendor product: PhpSpreadsheet
CVE-2026-114608Published
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
cve-program ·
Vendor product: pylint
CVE-2026-75508Published
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
cve-program ·
Vendor product: graphql-core
CVE-2026-61791Published
OCO-Server: Stored XSS through agent hostnames in command buttons
cve-program ·
Vendor product: OCO-Server
CVE-2026-115249Published
subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation
cve-program ·
Vendor product: online-clinic-management-system
CVE-2026-115411Published
crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
cve-program ·
Vendor product: crawlseo
CVE-2026-25439Published
WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability
cve-program ·
https://codecanyon.net: booknetic
CVE-2026-39746Published
WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability
cve-program ·
https://codecanyon.net: booknetic
CVE-2026-115246Published
subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
cve-program ·
Vendor product: online-clinic-management-system
CVE-2026-115332Published
Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
cve-program ·
Vendor product: lotus
CVE-2026-115324Published
mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
cve-program ·
Vendor product: mem0
CVE-2026-115319Published
fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents
cve-program ·
Vendor product: fzf
CVE-2022-51024Published
Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
cve-program ·
Vendor product: Kavita
CVE-2021-48017Published
OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi
cve-program ·
Vendor product: BSCW Server
CVE-2021-48013Published
Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
cve-program ·
Vendor product: E-cology
CVE-2018-25439Published
MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
cve-program ·
Vendor product: MetInfo
CVE-2017-20288Published
QCubed 3.1.1 Reflected XSS via installer step_2.php
cve-program ·
Vendor product: QCubed
CVE-2026-114732Published
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity …
cve-program ·
Vendor product: Webmail
CVE-2026-115282Published
Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
cve-program ·
Vendor product: Recipe Card Blocks Lite
CVE-2026-115299Published
Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
cve-program ·
Vendor product: Contact Form by Supsystic
CVE-2026-115300Published
Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
cve-program ·
Vendor product: Contact Form by Supsystic
CVE-2026-115301Published
Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block
cve-program ·
Vendor product: Contact Form by Supsystic
CVE-2026-115302Published
Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion
cve-program ·
Vendor product: Contact Form by Supsystic
CVE-2026-78395Published
Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass
cve-program ·
Vendor product: Link Library
CVE-2026-78396Published
Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure
cve-program ·
Vendor product: Link Library
CVE-2026-88928Published
PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass
cve-program ·
Vendor product: PAYCOMET for WooCommerce
CVE-2026-89216Published
vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
cve-program ·
Vendor product: vTables
CVE-2024-3586Published
LetterPress < 2.4.0 - Admin+ Stored XSS
cve-program ·
Vendor product: LetterPress
CVE-2026-103693Published
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
cve-program ·
Vendor product: Frontend Dashboard · Vendor product: ProfileGrid
CVE-2026-105258Published
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
cve-program ·
Vendor product: Appointment Booking Plugin
CVE-2026-108685Published
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
cve-program ·
Vendor product: WP Post Author
CVE-2026-108686Published
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
cve-program ·
Vendor product: WP Post Author
CVE-2026-108763Published
Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR
cve-program ·
Vendor product: Wallet System for WooCommerce
CVE-2026-110030Published
Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration
cve-program ·
Vendor product: Hide Price Until Login
CVE-2026-110504Published
Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass
cve-program ·
Vendor product: Enable SVG, WebP, and ICO Upload
CVE-2026-110505Published
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
cve-program ·
Vendor product: Enable SVG, WebP, and ICO Upload
CVE-2026-110983Published
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
cve-program ·
Vendor product: WP Photo Album Plus
CVE-2026-111739Published
Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
cve-program ·
Vendor product: Two Factor Authentication · Vendor product: All-In-One Security (AIOS)
CVE-2026-113616Published
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
cve-program ·
Vendor product: LogixFast Auth
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.