Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694333 source statements · aliases may refer to the same vulnerabilitySmileCDR HAPI FHIR unauthorized read
cve-program ·
Vendor product: HAPI FHIR
WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: media-library-assistant
WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: lazy-load-for-videos
WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: better-post-filter-widgets-for-elementor
WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: geo-mashup
WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: geo-mashup
WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability
cve-program ·
https://crocoblock.com: jet-engine
WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: media-library-assistant
WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://crocoblock.com: jet-elements
WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: b-slider
WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: panorama
WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: advanced-post-block
WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: woosquare
WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: woosquare
WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: contact-form-by-supsystic
WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://crocoblock.com: jet-smart-filters
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
osv · CVE-2026-105298 · GHSA-mgg9-6xw2-jfgp
crates.io: pingora-core
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
osv · CVE-2026-105299 · GHSA-vx4q-2c55-cvmg
crates.io: pingora-proxy
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
osv · CVE-2026-105297 · GHSA-7gpj-mj4q-x62x
crates.io: pingora-core
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.