CVE-2026-109672Published
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
cve-program ·
Vendor product: erpnext
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695687 source statements · aliases may refer to the same vulnerabilityCVE-2026-109614Published
Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
cve-program ·
Vendor product: erpnext
CVE-2026-109406Published
macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error
cve-program ·
Vendor product: mall
CVE-2022-4269Published
A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA …
cve-program ·
Vendor product: Linux kernel (TC subsystem)
CVE-2022-4139Published
An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the s…
cve-program ·
Vendor product: kernel
CVE-2022-4129Published
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system …
cve-program ·
Vendor product: Linux kernel (l2tp)
CVE-2022-3821Published
An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Servi…
cve-program ·
Vendor product: systemd
CVE-2022-3715Published
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
cve-program ·
Vendor product: bash
CVE-2022-3649Published
Linux Kernel BPF inode.c nilfs_new_inode use after free
cve-program ·
Vendor product: Kernel
CVE-2022-3646Published
Linux Kernel BPF segment.c nilfs_attach_log_writer memory leak
cve-program ·
Vendor product: Kernel
CVE-2022-3635Published
Linux Kernel IPsec idt77252.c tst_timer use after free
cve-program ·
Vendor product: Kernel
CVE-2022-3633Published
Linux Kernel transport.c j1939_session_destroy memory leak
cve-program ·
Vendor product: Kernel
CVE-2022-3629Published
Linux Kernel af_vsock.c vsock_connect memory leak
cve-program ·
Vendor product: Kernel
CVE-2022-3625Published
Linux Kernel IPsec devlink.c devlink_param_get use after free
cve-program ·
Vendor product: Kernel
CVE-2022-3621Published
Linux Kernel nilfs2 inode.c nilfs_bmap_lookup_at_level null pointer dereference
cve-program ·
Vendor product: Kernel
CVE-2022-3606Published
Linux Kernel BPF libbpf.c find_prog_by_sec_insn null pointer dereference
cve-program ·
Vendor product: Kernel
CVE-2022-3594Published
Linux Kernel BPF r8152.c intr_callback logging of excessive data
cve-program ·
Vendor product: Kernel
CVE-2022-3586Published
A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw …
cve-program ·
Vendor product: Linux Kernel
CVE-2026-109402Published
conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery
cve-program ·
Vendor product: conductor
CVE-2026-109157Published
TRENDnet TEW-432BRP formTcpipSetup stack-based overflow
cve-program ·
Vendor product: TEW-432BRP
CVE-2026-85115Published
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages.
cve-program ·
Vendor product: .NET Client Library for SIMATIC S7 Webserver API
CVE-2022-3565Published
Linux Kernel Bluetooth l1oip_core.c del_timer use after free
cve-program ·
Vendor product: Kernel
CVE-2022-3564Published
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
cve-program ·
Vendor product: Kernel
CVE-2022-3545Published
Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free
cve-program ·
Vendor product: Kernel
CVE-2026-63357Published
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page.
cve-program ·
Vendor product: SIMATIC Drive Controller CPU 1504D TF · Vendor product: SIMATIC Drive Controller CPU 1507D TF · Vendor product: SIMATIC ET 200SP CPU 1510SP F-1 PN
CVE-2026-63352Published
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page.
cve-program ·
Vendor product: SIMATIC Drive Controller CPU 1504D TF · Vendor product: SIMATIC Drive Controller CPU 1507D TF · Vendor product: SIMATIC ET 200SP CPU 1510SP F-1 PN
CVE-2026-44414Published
A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.…
cve-program ·
Vendor product: Industrial Edge Cloud Device (IECD) · Vendor product: Industrial Edge Device Kit - arm64 V1.10 · Vendor product: Industrial Edge Device Kit - arm64 V1.11
CVE-2022-3534Published
Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free
cve-program ·
Vendor product: Kernel
CVE-2022-3524Published
Linux Kernel IPv6 ipv6_renew_options memory leak
cve-program ·
Vendor product: Kernel
CVE-2026-103307Published
Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook
cve-program ·
Vendor product: Walletdoc Payment Gateway for WooCommerce
CVE-2026-104644Published
Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update
cve-program ·
Vendor product: Image Photo Gallery Final Tiles Grid
CVE-2026-104751Published
Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion
cve-program ·
Vendor product: Rank Math SEO
CVE-2026-105261Published
PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes
cve-program ·
Vendor product: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
CVE-2026-105969Published
CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure
cve-program ·
Vendor product: CodeAtoZ B2B Suite for WooCommerce
CVE-2026-105975Published
CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference
cve-program ·
Vendor product: CamPay Shortcode Payment Gateway
CVE-2026-106098Published
WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update
cve-program ·
Vendor product: WP Data Access
CVE-2026-106099Published
WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export
cve-program ·
Vendor product: WP Data Access
CVE-2026-106166Published
NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter
cve-program ·
Vendor product: NEX-Forms
CVE-2026-106646Published
Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers
cve-program ·
Vendor product: Classified Listing
CVE-2026-107126Published
WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header
cve-program ·
Vendor product: WP Booking System
CVE-2026-107158Published
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route
cve-program ·
Vendor product: LTL Freight Quotes
CVE-2026-107160Published
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message
cve-program ·
Vendor product: LTL Freight Quotes
CVE-2026-107178Published
Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter
cve-program ·
Vendor product: Image Photo Gallery Final Tiles Grid
CVE-2026-107319Published
GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
cve-program ·
Vendor product: GamiPress
CVE-2026-107320Published
GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
cve-program ·
Vendor product: GamiPress
CVE-2026-107508Published
Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter
cve-program ·
Vendor product: Ultimate Multisite
CVE-2026-107594Published
File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion
cve-program ·
Vendor product: File Upload to Order
CVE-2026-108064Published
WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler
cve-program ·
Vendor product: WP Encryption
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.