CVE-2026-110862Published
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
cve-program ·
Vendor product: better-auth
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694934 source statements · aliases may refer to the same vulnerabilityCVE-2026-34008Published
**Privilege Escalation** World-writable crontab path monitored and executed by root-owned process
cve-program ·
Vendor product: Notes Station 3
CVE-2026-34009Published
**Container Escape** Host user home directory mounted with write access into application container
cve-program ·
Vendor product: Notes Station 3
CVE-2026-18660Published
Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames
cve-program ·
https://repo.maven.apache.org/maven2/: org.eclipse.jetty:jetty-server · https://repo.maven.apache.org/maven2/: org.eclipse.jetty:jetty-proxy
CVE-2026-110867Published
Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
cve-program ·
Vendor product: renovate · Vendor product: renovate-ce · Vendor product: renovate-ee-server
CVE-2026-39997Published
Unauthenticated Remote Input Injection in QNAP HD Station's remotepad
cve-program ·
Vendor product: HybridDesk Station
CVE-2026-110872Published
Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
cve-program ·
Vendor product: nodemailer
CVE-2026-19863Published
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.
cve-program ·
https://repo.maven.apache.org/maven2/: org.eclipse.jetty:jetty-ethereum
CVE-2026-19864Published
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may cons…
cve-program ·
https://repo.maven.apache.org/maven2/: org.eclipse.jetty:jetty-security
CVE-2026-18662Published
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.
cve-program ·
https://repo.maven.apache.org/maven2/: org.eclipse.jetty.ee11:jetty-ee11-servlet · https://repo.maven.apache.org/maven2/: org.eclipse.jetty.ee10:jetty-ee10-servlet · https://repo.maven.apache.org/maven2/: org.eclipse.jetty.ee9:jetty-ee9-security
CVE-2026-18659Published
Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring
cve-program ·
https://repo.maven.apache.org/maven2/: org.eclipse.jetty.ee11:jetty-ee11-servlet · https://repo.maven.apache.org/maven2/: org.eclipse.jetty.ee10:jetty-ee10-servlet · https://repo.maven.apache.org/maven2/: org.eclipse.jetty.ee9:jetty-ee9-security
CVE-2026-110807Published
sgl-project SGLang generate Endpoint io_struct.py denial of service
cve-program ·
Vendor product: SGLang
CVE-2026-110904Published
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
cve-program ·
Vendor product: ApostropheCMS
CVE-2026-79827Published
HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop Inspect Subsystem
CVE-2026-79828Published
HPE NonStop Debug Utilities - Heap buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop Debug Utilities
CVE-2026-79829Published
HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability
cve-program ·
Vendor product: HPE NonStop HTTP WEBSERVER
CVE-2026-79826Published
HPE NonStop OCAX - Heap buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop OCAX
CVE-2026-47786Published
Pre-Authentication Command Injection
cve-program ·
Vendor product: HybridDesk Station
CVE-2026-8037Published
OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF
cve-program ·
Vendor product: LoadMaster · Vendor product: ECS Connections Manager · Vendor product: Object Scale Connection Manager
CVE-2026-107416Published
WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: webba-booking-lite
CVE-2026-109892Published
WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: acf-frontend-form-element
CVE-2026-79832Published
HPE NonStop SQL/MX Executor - Buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop SQL/MX Executor
CVE-2026-79831Published
HPE NonStop Posix User Threads - Heap buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop Posix User Threads
CVE-2026-79830Published
HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop Kernel Level Thread Model Lib
CVE-2026-108491Published
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: everest-forms
CVE-2026-79833Published
HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability
cve-program ·
Vendor product: HPE NonStop ANSI SQLUTIL
CVE-2026-79834Published
HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability
cve-program ·
Vendor product: HPE NonStop SQL/MX SQLCAT
CVE-2026-79835Published
HPE Nonstop KMS Server - Buffer overflow vulnerability
cve-program ·
Vendor product: HPE Nonstop KMS Server
CVE-2026-17525Published
My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
cve-program ·
Vendor product: My Control System
CVE-2026-108498Published
WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: bsk-pdf-manager
CVE-2026-109692Published
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: user-registration
CVE-2026-88794Published
XML External Entity injection in Sparx Enterprise Architect
cve-program ·
Vendor product: Enterprise Architect
CVE-2026-79837Published
HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerability
cve-program ·
Vendor product: HPE NonStop SQL/MX UDR SERVER
CVE-2026-104025Published
Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name
cve-program ·
https://github.com/peazip/PeaZip/releases: PeaZip
CVE-2026-110723Published
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the origina…
cve-program ·
Vendor product: Eclipse Connected Services Platform
CVE-2026-79836Published
HPE NonStop SQL/MX Run-Time Statistics - Information disclosure and DoS vulnerability
cve-program ·
Vendor product: HPE NonStop SQL/MX Run-Time Statistics
CVE-2026-8145Published
WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
cve-program ·
Vendor product: WholesaleX – All-in-One B2B Solution with Wholesale Pricing
CVE-2026-109698Published
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: mangboard
CVE-2025-2586Published
Ols: unauthenticated metrics flooding in openshift lightspeed service leading to resource exhaustion
cve-program ·
https://github.com/openshift/lightspeed-service: lightspeed-service · https://access.redhat.com/downloads/content/package-browser/: openshift-lightspeed-tech-preview/lightspeed-service-api-rhel9
CVE-2026-103304Published
eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update
cve-program ·
Vendor product: eaSYNC Booking
CVE-2026-104643Published
Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite
cve-program ·
Vendor product: Easy HTTPS Redirection (SSL)
CVE-2026-106031Published
Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
cve-program ·
Vendor product: Spin Wheel
CVE-2026-109145Published
User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
cve-program ·
Vendor product: User Rights Access Manager
CVE-2026-74920Published
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
cve-program ·
Vendor product: Document Gallery
CVE-2026-96537Published
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite
cve-program ·
Vendor product: Tutor LMS
CVE-2026-103324Published
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret
cve-program ·
https://wordpress.org/plugins: Cardinity Payment Gateway for WooCommerce
CVE-2026-92428Published
Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook
cve-program ·
https://wordpress.org/plugins: Rede Itaú for WooCommerce
CVE-2026-92429Published
Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook
cve-program ·
https://wordpress.org/plugins: Rede Itaú for WooCommerce
CVE-2026-48856Published
httpc leaks Authorization header to cross-origin redirect targets
cve-program ·
Vendor product: otp · Vendor product: inets · https://github.com: erlang/otp
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.