CVE-2026-109747Published
Other issue in the Address Bar component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694708 source statements · aliases may refer to the same vulnerabilityCVE-2026-11803Published
PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products
cve-program ·
Vendor product: Revit · Vendor product: AutoCAD · Vendor product: AutoCAD LT
CVE-2026-109746Published
Mitigation bypass in the DOM: Security component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2025-10898Published
Multiple Vulnerabilities in Certain Autodesk Products
cve-program ·
Vendor product: Shared Components · Vendor product: AutoCAD
CVE-2025-10882Published
Multiple Vulnerabilities in Certain Autodesk Products
cve-program ·
Vendor product: Shared Components · Vendor product: AutoCAD
CVE-2026-109745Published
Sandbox escape due to uninitialized memory in the DOM: Web Serial component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-109744Published
Other issue in the DOM: File component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-109740Published
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-109737Published
Mitigation bypass in the Enterprise Policies component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-18618Published
Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-mlmd-grpc-server-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-mlmd-grpc-server-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-mlmd-grpc-server-rhel9
CVE-2026-15218Published
Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts with excessive permissions lead to privilege escalation
cve-program ·
https://github.com/opendatahub-io/models-as-a-service: maas-api · https://github.com/opendatahub-io/models-as-a-service: maas-controller · https://catalog.redhat.com/software/containers/: rhoai/odh-maas-api-rhel9
CVE-2026-109736Published
Frame poisoning in the Layout component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-18947Published
Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-feature-server-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-feature-server-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-feature-server-rhel9
CVE-2026-18941Published
Feast: feast-operator: feast: default authentication mode is no_auth — shared multi-tenant instances deployed without authentication
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-feature-server-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-feature-server-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-feature-server-rhel9
CVE-2026-18621Published
Data-sciences-pipeline: dsp: v1 argo template path accepts arbitrary workflow spec, bypassing all v2 security hardening
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-ml-pipelines-api-server-v2-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-ml-pipelines-api-server-v2-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-ml-pipelines-api-server-v2-rhel9
CVE-2026-109734Published
Mitigation bypass in the DOM: Security component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-109731Published
Incorrect boundary conditions in the Graphics: Canvas2D component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-109721Published
Incorrect boundary conditions in the JavaScript Engine: JIT component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-109720Published
JIT miscompilation in the JavaScript: WebAssembly component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-84286Published
OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table
cve-program ·
Vendor product: ExLlamaV3
CVE-2026-68571Published
Apache Kylin: JDBC URL Whitelist Verification Bypass
cve-program ·
Vendor product: Apache Kylin
CVE-2024-2182Published
Ovn: insufficient validation of bfd packets may lead to denial of service
cve-program ·
https://www.github.com/ovn-org/ovn/: ovn · https://access.redhat.com/downloads/content/package-browser/: ovn23.06 · https://access.redhat.com/downloads/content/package-browser/: ovn22.12
CVE-2026-110378Published
WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: ninja-signature-contract-forms-add-on
CVE-2026-103311Published
Coinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared Secret
cve-program ·
https://wordpress.org/plugins: Coinbase Commerce Payment Gateway for WooCommerce
CVE-2026-106010Published
BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
cve-program ·
https://wordpress.org/plugins: BDM Digital Payment Gateway
CVE-2026-110034Published
Salon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount Code
cve-program ·
https://wordpress.org/plugins: Salon Booking System
CVE-2026-74921Published
Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
cve-program ·
https://wordpress.org/plugins: Document Gallery
CVE-2026-74922Published
Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass
cve-program ·
https://wordpress.org/plugins: Document Gallery
CVE-2026-86791Published
iPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation Forgery
cve-program ·
https://wordpress.org/plugins: iPOSpays Payment Gateway for WooCommerce
CVE-2026-91831Published
Subscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name Setting
cve-program ·
https://wordpress.org/plugins: Subscribe to Comments
CVE-2026-94228Published
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
cve-program ·
https://wordpress.org/plugins: TrueBooker
CVE-2026-94229Published
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
cve-program ·
https://wordpress.org/plugins: TrueBooker
CVE-2026-94230Published
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
cve-program ·
https://wordpress.org/plugins: TrueBooker
CVE-2026-94231Published
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification
cve-program ·
https://wordpress.org/plugins: TrueBooker
CVE-2026-94272Published
Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
cve-program ·
https://wordpress.org/plugins: Snap Finance
CVE-2026-94294Published
App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
cve-program ·
https://wordpress.org/plugins: App Builder
CVE-2026-106028Published
ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
cve-program ·
Vendor product: ActiveTrail for WooCommerce
CVE-2026-106933Published
Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
cve-program ·
Vendor product: Blaze Demo Importer
CVE-2026-91046Published
ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization
cve-program ·
Vendor product: ElementsReady Addons for Elementor
CVE-2026-91047Published
ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
cve-program ·
Vendor product: ElementsReady Addons for Elementor
CVE-2026-89286Published
FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File
cve-program ·
Vendor product: FormFlow for GoHighLevel (GHL)
CVE-2026-106014Published
Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
cve-program ·
Vendor product: Gateway for Vantiv on WC
CVE-2026-94273Published
Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment
cve-program ·
Vendor product: Snap Finance
CVE-2026-98868Published
dm-pcache: reject a kset that overruns its segment
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-98867Published
dm-pcache: bound the logical key offset from persistent memory
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-98866Published
sched/cache: Introduce task_struct->sched_cache_grp to fix UAF
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-98865Published
sched_ext: Don't run ops.dequeue() with a DSQ lock held
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-98864Published
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-98863Published
KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
cve-program ·
Vendor product: Linux · Vendor product: Linux
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.