CVE-2026-114175Published
WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability
cve-program ·
https://wordpress.org/plugins: eroom-zoom-meetings-webinar
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694495 source statements · aliases may refer to the same vulnerabilityCVE-2026-114177Published
WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability
cve-program ·
https://wordpress.org/plugins: xpro-elementor-addons
CVE-2026-111847Published
WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: marketking-multivendor-marketplace-for-woocommerce
CVE-2026-114180Published
WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: metform
CVE-2026-112826Published
WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: falcon
CVE-2026-112843Published
WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: strong-testimonials
CVE-2026-114182Published
WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: powerpack-lite-for-elementor
CVE-2026-112379Published
WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: contact-form-to-email
CVE-2026-112327Published
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: ameliabooking
CVE-2026-114698Published
WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: mycred
CVE-2026-110894Published
WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: suredash
CVE-2026-110893Published
WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: suredash
CVE-2026-112845Published
WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: off-canvas-sidebars
CVE-2026-112241Published
WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: surecart
CVE-2026-111830Published
WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: wp-mailster
CVE-2026-111851Published
WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability
cve-program ·
https://wordpress.org/plugins: royal-elementor-addons
CVE-2026-112311Published
WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability
cve-program ·
https://wordpress.org/plugins: acf-extended
CVE-2026-111842Published
WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: sunshine-photo-cart
CVE-2026-112218Published
WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: majestic-support
CVE-2026-114195Published
WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: shopmagic-for-woocommerce
CVE-2026-114699Published
WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: yookassa
CVE-2026-114700Published
WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: menu-ordering-reservations
CVE-2026-114701Published
WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: waitlist-woocommerce
CVE-2026-114702Published
WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: nd-shortcodes
CVE-2026-114703Published
WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: extensions-leaflet-map
CVE-2026-112820Published
WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability
cve-program ·
https://themeforest.net: academist-core
CVE-2026-113681Published
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 Cineon Reader Heap Out-of-Bounds Read
cve-program ·
Vendor product: OpenImageIO
CVE-2026-100504Published
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128
cve-program ·
Vendor product: ghidra
CVE-2026-100503Published
Ghidra through 12.1.4 Heap Use-After-Free in Decompiler
cve-program ·
Vendor product: ghidra
CVE-2026-96596Published
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
cve-program ·
Vendor product: rebar3 · https://github.com: erlang/rebar3 · https://repo.hex.pm: hex_core
MAL-2026-18181Published
Malicious code in test-brotli-testmetest (npm)
osv ·
npm: test-brotli-testmetest
MAL-2026-18182Published
Malicious code in test-brotli2-testmetest (npm)
osv ·
npm: test-brotli2-testmetest
MAL-2026-18177Published
Malicious code in data-pipeline-testmetest (npm)
osv ·
npm: data-pipeline-testmetest
MAL-2026-18091Published
Malicious code in @platform-services/hrm-mfe-core (npm)
osv ·
npm: @platform-services/hrm-mfe-core
MAL-2026-18185Published
Malicious code in log-rotate-testmetest (npm)
osv ·
npm: log-rotate-testmetest
CVE-2025-66533Published
WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability
cve-program ·
https://wordpress.org/plugins: give
CVE-2026-86332Published
Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-dashboard-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-dashboard-rhel9 · https://access.redhat.com/downloads/content/package-browser/: rhoai/odh-core-bff-rhel9
CVE-2026-15574Published
Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9
CVE-2026-18949Published
Odh-dashboard: odh-dashboard: clusterrole grants cluster-wide crud on secrets and rbac management resources
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-dashboard-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-mod-arch-model-registry-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-dashboard-rhel9
CVE-2026-15143Published
Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
cve-program ·
https://github.com/trustyai-explainability/guardrails-detectors: guardrails-detectors · https://catalog.redhat.com/software/containers/: rhoai/odh-built-in-detector-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-guardrails-detector-huggingface-runtime-rhel9
CVE-2026-111056Published
FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
cve-program ·
Vendor product: FOSSBilling
CVE-2026-112157Published
MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumption
cve-program ·
Vendor product: memmy-agent
CVE-2026-112309Published
@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods
cve-program ·
Vendor product: @rvf/set-get
CVE-2026-112304Published
docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()
cve-program ·
https://pypi.org: docTR
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.