CVE-2026-115547Published
Command Execution via Admin Console Input in Okta Access Gateway
cve-program ·
Vendor product: Okta Access Gateway
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694472 source statements · aliases may refer to the same vulnerabilityCVE-2026-115497Published
Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
cve-program ·
Vendor product: Music Store – WordPress eCommerce
CVE-2026-109198Published
Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter
cve-program ·
Vendor product: CleanTalk Anti-Spam – Complete Spam Protection
CVE-2026-112825Published
WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: car-rental-manager
CVE-2026-112821Published
WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: knit-pay
CVE-2026-112838Published
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: vikrentcar
CVE-2026-112359Published
WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: wpappninja
CVE-2026-112837Published
WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: gamipress
CVE-2026-112835Published
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: vikrentcar
CVE-2026-112862Published
WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: participants-database
CVE-2026-112860Published
WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: participants-database
CVE-2026-115657Published
KNIME Analytics Platform logs credentials of configured proxy when used as an executor
cve-program ·
Vendor product: KNIME Analytics Platform
CVE-2026-16762Published
Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt
cve-program ·
Vendor product: qt
GHSA-5r3p-6rj5-7937Published
Bytebase vulnerable to Improper Authentication
osv · CVE-2022-51026
Go: github.com/bytebase/bytebase
CVE-2026-111965Published
Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass
cve-program ·
https://wordpress.org/plugins: Profile Builder
CVE-2026-94263Published
Advanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success Message
cve-program ·
https://wordpress.org/plugins: Advanced Custom Fields: Extended · Vendor product: Advanced Custom Fields: Extended PRO
CVE-2026-109933Published
Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
cve-program ·
Vendor product: Otter Blocks
CVE-2026-109934Published
Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API
cve-program ·
Vendor product: Otter Blocks
CVE-2026-111737Published
Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
cve-program ·
Vendor product: Speed Optimizer
CVE-2026-111738Published
Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
cve-program ·
Vendor product: Speed Optimizer
CVE-2026-111966Published
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
cve-program ·
Vendor product: User Profile Builder
CVE-2026-111982Published
Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
cve-program ·
Vendor product: User Profile Builder
CVE-2026-112219Published
Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
cve-program ·
Vendor product: Download Monitor
CVE-2026-112230Published
Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter
cve-program ·
Vendor product: Popup Builder
CVE-2026-113472Published
Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload
cve-program ·
Vendor product: Depicter — Popup & Slider Builder
CVE-2026-113499Published
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
cve-program ·
Vendor product: LiteSpeed Cache
CVE-2026-113500Published
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
cve-program ·
Vendor product: LiteSpeed Cache
CVE-2026-113501Published
LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal
cve-program ·
Vendor product: LiteSpeed Cache
CVE-2026-94262Published
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
cve-program ·
Vendor product: Advanced Custom Fields: Extended · Vendor product: Advanced Custom Fields: Extended PRO
CVE-2026-94264Published
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes
cve-program ·
Vendor product: Advanced Custom Fields: Extended · Vendor product: Advanced Custom Fields: Extended PRO
CVE-2026-94267Published
Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action
cve-program ·
Vendor product: Advanced Custom Fields: Extended · Vendor product: Advanced Custom Fields: Extended PRO
CVE-2026-94268Published
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
cve-program ·
Vendor product: Advanced Custom Fields: Extended · Vendor product: Advanced Custom Fields: Extended PRO
CVE-2026-109936Published
Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter
cve-program ·
Vendor product: Otter Blocks
CVE-2026-110510Published
Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Tag
cve-program ·
Vendor product: Essential Addons for Elementor
CVE-2026-110537Published
Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action
cve-program ·
Vendor product: Essential Addons for Elementor
CVE-2026-115502Published
DataApp links without login expose job information to other user in KNIME Business Hub
cve-program ·
Vendor product: KNIME Business Hub
CVE-2026-39769Published
WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: graphina-elementor-charts-and-graphs
CVE-2026-65529Published
WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: graphina-elementor-charts-and-graphs
RUSTSEC-2026-0003Published
Non-constant-time code generation on ARM32 targets
osv · CVE-2026-23519 · GHSA-2gqc-6j2q-83qp
crates.io: cmov
RUSTSEC-2026-0385Published
Non-constant-time mask generation and `u128` comparisons
osv ·
crates.io: ctutils
CVE-2026-74534Published
Bluetooth: ISO: fix refcounting of iso_conn
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31514Published
erofs: set fileio bio failed in short read case
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-96293Published
Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
cve-program ·
Vendor product: WatchGuard Agent
RUSTSEC-2026-0305Published
Use-after-free when XML includes have duplicated entities
osv · CVE-2026-96889 · GHSA-cpvr-w4j5-2mpg
crates.io: librsvg
CVE-2026-75887Published
Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/ose-console · https://catalog.redhat.com/software/containers/: openshift4/ose-console · https://catalog.redhat.com/software/containers/: openshift4/ose-console
CVE-2026-75885Published
Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/ose-console · https://catalog.redhat.com/software/containers/: openshift4/ose-console · https://catalog.redhat.com/software/containers/: openshift4/ose-console
CVE-2026-101416Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-101411Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker wit…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-101390Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker wit…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.