CVE-2026-108069Published
Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()
cve-program ·
Vendor product: Sunshine Photo Cart
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695687 source statements · aliases may refer to the same vulnerabilityCVE-2026-85000Published
EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating
cve-program ·
Vendor product: EmbedPress
CVE-2026-85345Published
FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data
cve-program ·
Vendor product: FV Flowplayer Video Player
CVE-2026-86787Published
Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive
cve-program ·
Vendor product: affiliate-toolkit
CVE-2026-86797Published
Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link
cve-program ·
Vendor product: Pricing Table
CVE-2026-86799Published
Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission
cve-program ·
Vendor product: Forms
CVE-2026-87843Published
Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page
cve-program ·
Vendor product: Trust Payments Gateway for WooCommerce
CVE-2026-87968Published
Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
cve-program ·
Vendor product: Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant
CVE-2026-87974Published
Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook
cve-program ·
Vendor product: Asaas Gateway for WooCommerce
CVE-2026-88927Published
rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR
cve-program ·
Vendor product: rtMedia for WordPress, BuddyPress and bbPress
CVE-2026-94260Published
Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure
cve-program ·
Vendor product: Sifalo Pay
CVE-2026-94261Published
Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id
cve-program ·
Vendor product: Sifalo Pay
CVE-2026-94360Published
Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks
cve-program ·
Vendor product: Paymentfor Gateway for WooCommerce
CVE-2026-96900Published
Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR
cve-program ·
Vendor product: Cart Abandonment Recovery for WooCommerce
CVE-2026-96904Published
AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page
cve-program ·
Vendor product: AWP Classifieds
CVE-2026-109116Published
AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization
cve-program ·
Vendor product: Restaurant-Management-System
CVE-2026-109109Published
Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
cve-program ·
Vendor product: WL-WN530BE1-A
CVE-2022-3521Published
Linux Kernel kcm kcmsock.c kcm_tx_work race condition
cve-program ·
Vendor product: Kernel
CVE-2022-3303Published
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) c…
cve-program ·
Vendor product: Linux kernel
CVE-2022-3028Published
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-…
cve-program ·
Vendor product: Linux kernel
CVE-2026-108975Published
SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload
cve-program ·
Vendor product: Library Management System
CVE-2026-108971Published
D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
cve-program ·
Vendor product: DCS-930L
CVE-2026-108962Published
storyicon comfyui_segment_anything GroundingDINO Model Loading slconfig.py SLConfig._file2dict code injection
cve-program ·
Vendor product: comfyui_segment_anything
CVE-2026-97315Published
Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email
cve-program ·
https://wordpress.org/plugins: Responsive Blocks
CVE-2026-88998Published
Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN
cve-program ·
https://wordpress.org/plugins: Tickera
CVE-2022-2978Published
A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or …
cve-program ·
Vendor product: Kernel
CVE-2022-2959Published
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operat…
cve-program ·
Vendor product: kernel
CVE-2026-82844Published
WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce
cve-program ·
https://wordpress.org/plugins: WPForms Lite
CVE-2026-108958Published
TensorLayer HDF5 Loading utils.py load_hdf5_graph deserialization
cve-program ·
Vendor product: TensorLayer
CVE-2026-103308Published
Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint
cve-program ·
https://wordpress.org/plugins: Visma Pay for WooCommerce
CVE-2026-101301Published
WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
cve-program ·
https://wordpress.org/plugins: WPCode
CVE-2026-108954Published
k2-fsa sherpa-onnx Offline Transducer Greedy Search Decoder offline-transducer-greedy-search-decoder.cc Decode buffer overflow
cve-program ·
Vendor product: sherpa-onnx
CVE-2026-108944Published
repository RAE Config-Driven Model Instantiation model_utils.py get_obj_from_str code injection
cve-program ·
Vendor product: RAE
CVE-2026-108750Published
OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction
cve-program ·
Vendor product: OpenDocMan
CVE-2026-95115Published
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
cve-program ·
Vendor product: n/a
CVE-2026-108745Published
CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet
cve-program ·
Vendor product: CloudBeaver
CVE-2022-2663Published
An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc conf…
cve-program ·
Vendor product: Linux kernel
CVE-2026-108739Published
OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
cve-program ·
Vendor product: OpenAgents
CVE-2026-108734Published
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
cve-program ·
Vendor product: crm
CVE-2026-108729Published
Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints
cve-program ·
Vendor product: corteza
CVE-2026-108724Published
Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint
cve-program ·
Vendor product: Sylius
CVE-2026-12613Published
Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor
cve-program ·
Vendor product: UYAP Document Editor · Vendor product: UYAP Document Editor
CVE-2026-108719Published
LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url
cve-program ·
Vendor product: LLMGateway
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.