CVE-2026-109638Published
Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
cve-program ·
Vendor product: erpnext
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695741 source statements · aliases may refer to the same vulnerabilityCVE-2026-109643Published
Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
cve-program ·
Vendor product: erpnext
CVE-2026-109648Published
Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
cve-program ·
Vendor product: erpnext
CVE-2026-109653Published
Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
cve-program ·
Vendor product: erpnext
CVE-2026-109658Published
Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
cve-program ·
Vendor product: erpnext
CVE-2026-109663Published
Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
cve-program ·
Vendor product: erpnext
CVE-2026-109668Published
Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints
cve-program ·
Vendor product: erpnext
CVE-2026-109673Published
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
cve-program ·
Vendor product: erpnext
CVE-2026-109677Published
FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
cve-program ·
Vendor product: FreeRDP
CVE-2026-109939Published
FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order
cve-program ·
Vendor product: FreeRDP
CVE-2026-109944Published
FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle
cve-program ·
Vendor product: FreeRDP
CVE-2026-109949Published
FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
cve-program ·
Vendor product: FreeRDP
CVE-2026-109954Published
Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
cve-program ·
Vendor product: parse-server · Vendor product: parse-server
CVE-2026-109959Published
EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint
cve-program ·
Vendor product: espocrm
CVE-2026-74030Published
Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion
cve-program ·
Vendor product: wazuh-agent · Vendor product: wazuh-manager
CVE-2026-109964Published
ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder
cve-program ·
Vendor product: ImageMagick
CVE-2026-83536Published
Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: rhoso-operators/openstack-network-exporter-rhel9
CVE-2026-32574Published
WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: smart-forms
CVE-2026-59976Published
ConvertX: Path Traversal vulnerability leading to Arbitrary File Write
cve-program ·
Vendor product: ConvertX
CVE-2026-107890Published
OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to I…
cve-program ·
Vendor product: CUPS
CVE-2026-9215Published
A CSRF vulnerability exists in certain NETGEAR XR series devices
cve-program ·
Vendor product: XR1000v2 · Vendor product: XR500
CVE-2026-42702Published
WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: tutor
CVE-2026-9216Published
Insufficient input validation vulnerability exists in certain NETGEAR RAX Models
cve-program ·
Vendor product: RAX30 · Vendor product: RAX35 · Vendor product: RAX38
CVE-2026-39785Published
WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: grand-media
CVE-2026-96299Published
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
cve-program ·
Vendor product: MongoDB Server
CVE-2026-104102Published
copyparty FTP: upload outside defined volumes (limited path traversal)
cve-program ·
Vendor product: copyparty
CVE-2026-107732Published
SumatraPDF: Markup/command-link injection into UI notification text
cve-program ·
Vendor product: sumatrapdf
CVE-2026-107737Published
SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup
cve-program ·
Vendor product: sumatrapdf
CVE-2026-107727Published
Strawberry legacy graphql-ws retains naturally completed subscription slots
cve-program ·
Vendor product: strawberry
CVE-2026-108919Published
SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting
cve-program ·
Vendor product: Drug Recommendation System
CVE-2026-107722Published
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
cve-program ·
Vendor product: fast-jwt
CVE-2026-108915Published
Edimax BR-6208AC formWlanMP buffer overflow
cve-program ·
Vendor product: BR-6208AC
CVE-2026-108907Published
Netcore NR268 CGI Execution user_ok improper authentication
cve-program ·
Vendor product: NR268
CVE-2026-109372Published
ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion
cve-program ·
Vendor product: zitadel
CVE-2026-55675Published
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
cve-program ·
Vendor product: docs
CVE-2026-109363Published
Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction
cve-program ·
Vendor product: zebra
CVE-2026-109358Published
Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation
cve-program ·
Vendor product: contrast
CVE-2026-63351Published
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page.
cve-program ·
Vendor product: SIMATIC Drive Controller CPU 1504D TF · Vendor product: SIMATIC Drive Controller CPU 1507D TF · Vendor product: SIMATIC ET 200SP CPU 1510SP F-1 PN
CVE-2026-63356Published
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.
cve-program ·
Vendor product: SIMATIC Drive Controller CPU 1504D TF · Vendor product: SIMATIC Drive Controller CPU 1507D TF · Vendor product: SIMATIC ET 200SP CPU 1510SP F-1 PN
CVE-2026-89199Published
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to …
cve-program ·
Vendor product: RUGGEDCOM CROSSBOW
CVE-2026-89204Published
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or…
cve-program ·
Vendor product: RUGGEDCOM CROSSBOW
CVE-2026-89206Published
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authentica…
cve-program ·
Vendor product: RUGGEDCOM CROSSBOW
CVE-2026-89208Published
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC…
cve-program ·
Vendor product: Capital Embedded AR Classic 431-422 · Vendor product: Capital Embedded AR Classic R20-11 · Vendor product: Desigo PXC00-E.D
CVE-2026-102074Published
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BAC…
cve-program ·
Vendor product: APOGEE MBC (PPC) (BACnet) · Vendor product: APOGEE MBC (PPC) (P2 Ethernet) · Vendor product: APOGEE MEC (PPC) (BACnet)
CVE-2026-102076Published
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BAC…
cve-program ·
Vendor product: APOGEE MBC (PPC) (BACnet) · Vendor product: APOGEE MBC (PPC) (P2 Ethernet) · Vendor product: APOGEE MEC (PPC) (BACnet)
CVE-2026-102250Published
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
cve-program ·
Vendor product: Sage RTU 1410 · Vendor product: Sage RTU 1430 · Vendor product: Sage RTU 1450
CVE-2026-96297Published
MongoDB Server may disclose process memory via a crafted `$_internalApplyOplogUpdate` aggregation pipeline
cve-program ·
Vendor product: MongoDB Server
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.