CVE-2026-111277Published
NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download
cve-program ·
Vendor product: nivocart
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694793 source statements · aliases may refer to the same vulnerabilityCVE-2026-107918Published
Insufficient input validation vulnerability in NETGEAR R7300
cve-program ·
Vendor product: R7300DST
CVE-2026-111320Published
ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check
cve-program ·
Vendor product: ValueCell
CVE-2026-107764Published
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink
cve-program ·
Vendor product: SiteOrigin CSS
CVE-2026-49950Published
Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool
cve-program ·
Vendor product: xoscar
CVE-2026-109513Published
NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route
cve-program ·
Vendor product: NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
CVE-2026-111329Published
JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
cve-program ·
Vendor product: JuggleIM
CVE-2026-85659Published
PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
cve-program ·
Vendor product: PilotPress
CVE-2026-107917Published
Insufficient input validation vulnerability in NETGEAR R7300 router
cve-program ·
Vendor product: R7300DST
CVE-2026-111344Published
APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description
cve-program ·
Vendor product: apitable
CVE-2026-110701Published
CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
cve-program ·
Vendor product: CP Multi View Events Calendar
CVE-2026-101978Published
Junos OS Evolved: PTX Series: An attacker controlled gRPC response causes root-level compromise when zero-touch provisioning is used
cve-program ·
Vendor product: Junos OS Evolved
CVE-2026-111349Published
Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL
cve-program ·
Vendor product: Craftplan
CVE-2026-107770Published
Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action
cve-program ·
Vendor product: Photo Engine (Media Organizer & Lightroom)
CVE-2026-19798Published
WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints
cve-program ·
Vendor product: WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
CVE-2026-104730Published
Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter
cve-program ·
Vendor product: Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
CVE-2026-111354Published
crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints
cve-program ·
Vendor product: crmeb_java
CVE-2026-109401Published
WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email
cve-program ·
Vendor product: WP Mail Logging
CVE-2026-111363Published
BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox
cve-program ·
Vendor product: bisheng
CVE-2026-101997Published
Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication
cve-program ·
Vendor product: Junos OS
CVE-2026-101955Published
Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used
cve-program ·
Vendor product: Junos OS
CVE-2026-101990Published
Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-101927Published
Junos OS and Junos OS Evolved: An unprivileged local attacker causes denial of service or privilege escalation
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-102014Published
Junos OS: An attacker causes authd to crash when subscriber RADIUS authentication is used
cve-program ·
Vendor product: Junos OS
CVE-2026-102015Published
Junos OS and Junos OS Evolved: An attacker causes root code execution when 802.1X authentication is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-102031Published
Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled
cve-program ·
Vendor product: Junos OS Evolved
CVE-2026-102049Published
Junos OS and Junos OS Evolved: An attacker causes l2cpd crash or root code execution when Unified Access Policy is enabled
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-102052Published
Junos OS and Junos OS Evolved: An attacker causes jdhcpd to crash when the DHCPv4 local-client feature is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-102055Published
Junos OS and Junos OS Evolved: MX Series, PTX Series: An attacker causes remote code execution and denial of service when enhanced CFM is enabled
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-102059Published
Junos OS and Junos OS Evolved: EX Series, SRX Series, QFX Series: A rogue DHCP server causes root-level command execution when the phone-home client processes specific information
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-102061Published
Junos OS and Junos OS Evolved: An attacker causes root code execution when SZTP DHCP provisioning is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-102174Published
Junos OS: SRX Series: An authenticated remote-access VPN client causes iked denial of service or root-level code execution when JIMS identity publishing is enabled
cve-program ·
Vendor product: Junos OS
CVE-2026-102175Published
Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-101981Published
Junos OS and Junos OS Evolved: An adjacent LDP peer causes routing-engine compromise when LDP is enabled
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-101982Published
Junos OS and Junos OS Evolved: A EVPN peer causes an rpd crash or root-level compromise when EVPN-VPWS is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-101954Published
Junos OS and Junos OS Evolved: Unauthenticated network access causes full device takeover when J-Web is enabled
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
CVE-2026-107350Published
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
cve-program ·
Vendor product: PgBouncer
CVE-2026-102298Published
Insufficient Authorization and User Boundary Validation in Omada Controller MSP
cve-program ·
Vendor product: Omada Software Controller (Windows)
CVE-2026-16453Published
Mattermost SAML RelayState forgery allows unauthorized team membership
cve-program ·
Vendor product: Mattermost
CVE-2026-18560Published
Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status
cve-program ·
Vendor product: Mattermost
CVE-2026-18223Published
Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
cve-program ·
Vendor product: Mattermost
CVE-2026-100106Published
FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
cve-program ·
Vendor product: FiboSearch – Ajax Search for WooCommerce
CVE-2026-96870Published
SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
cve-program ·
Vendor product: SureDash – Community, Courses & Member Dashboard
CVE-2026-111368Published
ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
cve-program ·
Vendor product: ClassroomIO
CVE-2026-111311Published
DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint
cve-program ·
Vendor product: DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More
CVE-2026-110703Published
GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute
cve-program ·
Vendor product: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
CVE-2026-109118Published
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
cve-program ·
Vendor product: rdiffweb
CVE-2026-11732Published
Insufficient input validation vulnerability exists in website blocking feature of certain NETGEAR RAX/CAX series models
cve-program ·
Vendor product: CAX30 · Vendor product: RAX30 · Vendor product: RAX5
CVE-2026-16754Published
A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.
cve-program ·
Vendor product: Smart Camera C33 · Vendor product: Smart Camera C33 Pro · Vendor product: Smart Camera C35
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.