CVE-2026-108670Published
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment
cve-program ·
Vendor product: JeecgBoot
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695680 source statements · aliases may refer to the same vulnerabilityCVE-2026-92910Published
Adobe Commerce | Incorrect Authorization (CWE-863)
cve-program ·
Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source
CVE-2026-108675Published
JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop
cve-program ·
Vendor product: JeecgBoot
CVE-2026-110466Published
WisdomGarden｜Tronclass - Sensitive Data Exposure
cve-program ·
Vendor product: Tronclass
CVE-2026-108680Published
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement
cve-program ·
Vendor product: JeecgBoot
CVE-2026-108692Published
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
cve-program ·
Vendor product: CordysCRM
CVE-2026-108700Published
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
cve-program ·
Vendor product: CordysCRM
CVE-2026-108705Published
CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
cve-program ·
Vendor product: CordysCRM
CVE-2026-109167Published
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save
cve-program ·
https://github.com/TDuckCloud/tduck-survey-form: tduck-survey-form
CVE-2026-110098Published
Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests
cve-program ·
Vendor product: Jorani
CVE-2026-110103Published
bbs-go through 4.4.6 Stored XSS via Image Upload Content-Type
cve-program ·
Vendor product: bbs-go
CVE-2026-110108Published
MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
cve-program ·
Vendor product: MateCloud
CVE-2026-110115Published
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
cve-program ·
Vendor product: Digital-Infrastructure
CVE-2026-110120Published
yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController
cve-program ·
Vendor product: yshopmall
CVE-2026-110125Published
waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
cve-program ·
Vendor product: waynboot-mall
CVE-2026-89310Published
SQL Command Injection Vulnerability in JTL-WMS
cve-program ·
Vendor product: JTL-WMS
CVE-2026-108383Published
dataclasses-avroschema enum field defaults can inject statements into generated modules
cve-program ·
Vendor product: dataclasses-avroschema
CVE-2026-110131Published
ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
cve-program ·
Vendor product: ThriveX-Server
CVE-2026-110203Published
Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization
cve-program ·
Vendor product: Roo-Code
CVE-2026-110208Published
Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
cve-program ·
Vendor product: Wukong AICRM
CVE-2026-110213Published
ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints
cve-program ·
Vendor product: ai-fusion-video
CVE-2026-107171Published
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
cve-program ·
Vendor product: Trellix Agent
CVE-2026-110218Published
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
cve-program ·
Vendor product: Aureus ERP
CVE-2026-110223Published
Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
cve-program ·
Vendor product: Kavita
CVE-2026-110229Published
QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
cve-program ·
Vendor product: QloApps
CVE-2022-24407Published
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
cve-program ·
Vendor product: n/a
CVE-2022-23990Published
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
cve-program ·
Vendor product: n/a
CVE-2026-110234Published
Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture
cve-program ·
https://crates.io: elio
CVE-2026-110239Published
Rapyd Admin before 9.20.0 Stored XSS via rich-text Component
cve-program ·
Vendor product: rapyd-admin
CVE-2026-110254Published
Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
cve-program ·
Vendor product: dockhand
CVE-2026-109739Published
Privilege escalation in the WebExtensions component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-109901Published
WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: cp-multi-view-calendar
CVE-2026-109743Published
Privilege escalation in the Panning and Zooming component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-108378Published
dataclasses-avroschema record documentation can terminate generated class docstrings
cve-program ·
Vendor product: dataclasses-avroschema
CVE-2026-109704Published
Privilege escalation in the Application Update component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2017-20286Published
DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette
cve-program ·
Vendor product: DevIL
CVE-2026-110257Published
OW2 ASM 5.0 before 9.11 Excessive Memory Allocation via BootstrapMethods Attribute
cve-program ·
https://repo1.maven.org/maven2/: ASM
CVE-2026-105107Published
Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
cve-program ·
Vendor product: Koha
CVE-2026-110262Published
OW2 ASM 3.1 before 9.11 Excessive Memory Allocation in AdviceAdapter
cve-program ·
https://repo1.maven.org/maven2/: ASM
CVE-2026-103367Published
ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
cve-program ·
Vendor product: ShopMagic – email automation for WordPress
CVE-2026-110129Published
fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
cve-program ·
Vendor product: fuintCatering
CVE-2022-23852Published
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
cve-program ·
Vendor product: n/a
CVE-2026-110124Published
FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
cve-program ·
Vendor product: FastBee
CVE-2026-25946Published
Gitea OpenID discovery server-side request forgery
cve-program ·
Vendor product: code.gitea.io/gitea
CVE-2026-110119Published
yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
cve-program ·
Vendor product: yshopmall
CVE-2022-23308Published
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
cve-program ·
Vendor product: n/a
CVE-2026-110114Published
oms-erp through PRE Missing Authentication via skyer-goods es-test Endpoints
cve-program ·
Vendor product: oms-erp
CVE-2026-110107Published
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
cve-program ·
Vendor product: RuoYi-Cloud-Plus
CVE-2026-110102Published
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
cve-program ·
Vendor product: powerlevel10k
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.