CVE-2026-104761Published
Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
cve-program ·
Vendor product: Mang Board
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695687 source statements · aliases may refer to the same vulnerabilityCVE-2026-107650Published
GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
cve-program ·
Vendor product: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
CVE-2026-110457Published
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.
cve-program ·
Vendor product: UniFi Protect AI Key
CVE-2026-109519Published
YouTransfer Template Rendering template path traversal
cve-program ·
Vendor product: YouTransfer
CVE-2026-110455Published
A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.
cve-program ·
Vendor product: UniFi Protect AI Key
CVE-2026-110454Published
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.
cve-program ·
Vendor product: UniFi Protect AI Key
CVE-2026-103369Published
Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
cve-program ·
Vendor product: Social Share Buttons & Analytics Plugin – GetSocial.io
CVE-2026-100153Published
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
cve-program ·
Vendor product: NewStatPress
CVE-2026-87855Published
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
cve-program ·
Vendor product: JTL-Connector for WooCommerce
CVE-2026-97398Published
FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
cve-program ·
Vendor product: FV Flowplayer Video Player
CVE-2026-95808Published
Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter
cve-program ·
Vendor product: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
CVE-2026-16495Published
Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
cve-program ·
Vendor product: Countdown Timer – Widget Countdown
CVE-2026-103422Published
AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
cve-program ·
Vendor product: AnyComment
CVE-2026-107757Published
Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
cve-program ·
Vendor product: Gallery Custom Links
CVE-2026-14909Published
IBM WebSphere Application Server Liberty Information Disclosure
cve-program ·
Vendor product: WebSphere Application Server - Liberty
CVE-2026-101294Published
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step
cve-program ·
Vendor product: WebSphere Application Server - Liberty · Vendor product: WebSphere Application Server
CVE-2026-103671Published
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's …
cve-program ·
Vendor product: AmazonPay V2 Plugin (4.0/4.1 series) · Vendor product: AmazonPay V2 Plugin (4.0/4.1 series) · Vendor product: AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition)
CVE-2026-14851Published
Unauthorised disclosure of information on Copart’s online billing service
cve-program ·
Vendor product: Copart’s online billing service
CVE-2026-35154Published
Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege
cve-program ·
Vendor product: PowerProtect Data Domain appliances
CVE-2026-73790Published
HPE NonStop iTP WebServer - Memory corruption vulnerability
cve-program ·
Vendor product: HPE NonStop iTP WebServer
CVE-2026-35073Published
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-73791Published
HPE NonStop Hpjmeter - Buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop Hpjmeter
CVE-2026-35072Published
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-35074Published
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-73792Published
HPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability
cve-program ·
Vendor product: HPE NonStop Java JToolkit
CVE-2026-35153Published
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-73794Published
HPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation
cve-program ·
Vendor product: HPE NonStop MODULAR NSJ
CVE-2026-103905Published
Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop
cve-program ·
Vendor product: JTL-Shop
CVE-2026-101337Published
Stack overwrite from specially formatted base64 RDATA field
cve-program ·
Vendor product: NSD
CVE-2026-101338Published
Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR
cve-program ·
Vendor product: NSD
CVE-2026-101339Published
Stack overwrite from a specially crafted and formatted HIP RR
cve-program ·
Vendor product: NSD
CVE-2026-93909Published
IBM WebSphere Application Server Liberty is affected by an authentication bypass
cve-program ·
Vendor product: WebSphere Application Server - Liberty
CVE-2026-101341Published
Stack overwrite from specially formatted TXT-DATA RDATA field
cve-program ·
Vendor product: NSD
CVE-2026-109958Published
EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search
cve-program ·
Vendor product: espocrm
CVE-2026-107431Published
WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: jetformbuilder
CVE-2026-109953Published
FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin
cve-program ·
Vendor product: FreeRDP
CVE-2026-109948Published
FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection
cve-program ·
Vendor product: FreeRDP
CVE-2026-109943Published
FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order
cve-program ·
Vendor product: FreeRDP
CVE-2026-85298Published
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation
cve-program ·
Vendor product: Application Integration
CVE-2026-16740Published
Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP
cve-program ·
Vendor product: TR7 ASP · Vendor product: TR7 ASP
CVE-2026-109938Published
FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update
cve-program ·
Vendor product: FreeRDP
CVE-2026-16741Published
OS Command in TR7 Cyber Defense's TR7 ASP
cve-program ·
Vendor product: TR7 ASP · Vendor product: TR7 ASP
CVE-2026-107424Published
WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: frontend-dashboard
CVE-2026-97278Published
WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: polylang
CVE-2026-108065Published
Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce
cve-program ·
Vendor product: WebAlliance eCommerce
CVE-2026-109676Published
FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect
cve-program ·
Vendor product: FreeRDP
CVE-2026-108967Published
SourceCodester Performance Indicator System edit_credit.php sql injection
cve-program ·
Vendor product: Performance Indicator System
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.