Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695766 source statements · aliases may refer to the same vulnerabilityImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
osv · CVE-2026-106117
NuGet: ImageSharp · NuGet: ImageSharp
Handlebars: JavaScript Injection via Own Property Check Bypass
osv · CVE-2026-106445
npm: handlebars
Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
cve-program ·
Vendor product: ShareFile Storage Zones Controller
Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
cve-program ·
Vendor product: ShareFile Storage Zones Controller
Handlebars: JavaScript Injection via Own Property Check Bypass
cve-program ·
Vendor product: handlebars.js
WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: woo-product-attachment
WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: delete-all-comments-of-website
WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: sms-alert
Malicious code in webpackbootstrap5 (npm)
osv · GHSA-2q27-vrr7-584g
npm: webpackbootstrap5
Malicious code in unified-platform (npm)
osv · GHSA-9j7c-8j8v-428c
npm: unified-platform
Malicious code in @zaka13/zakasite (npm)
osv · GHSA-j7rx-j64h-2fch
npm: @zaka13/zakasite
Malicious code in risk-detection (npm)
osv · GHSA-h6f8-r5fm-58fv
npm: risk-detection
Malicious code in @library-wide/library-shell (npm)
osv · GHSA-8j36-pr5c-f6vx
npm: @library-wide/library-shell
Malicious code in @airbnb-extended/typescript-config (npm)
osv · GHSA-4jfx-2j46-9rqq
npm: @airbnb-extended/typescript-config
Malicious code in liferay-workspace-scripts (npm)
osv · GHSA-rm73-xcfr-76qq
npm: liferay-workspace-scripts
Malicious code in @pinecone-experience/messages (npm)
osv · GHSA-r9p9-pfmv-rc77
npm: @pinecone-experience/messages
Malicious code in @smwebserver/static (npm)
osv · GHSA-qhx4-m546-6w2x
npm: @smwebserver/static
Malicious code in app-sca-info-banking (npm)
osv · GHSA-v2r2-pcp9-6mxr
npm: app-sca-info-banking
Malicious code in @user-services/web-components (npm)
osv · GHSA-f3g4-6hpx-9mcq
npm: @user-services/web-components
Malicious code in eslint-config-compact-base (npm)
osv · GHSA-gx7g-jjf6-c7jg
npm: eslint-config-compact-base
Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.
cve-program ·
Vendor product: Smart Switch
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
Malicious code in @tesla-insurance/vinless-quote (npm)
osv · GHSA-6m9v-pw95-fc67
npm: @tesla-insurance/vinless-quote
Malicious code in helpersutils-dev-tools (npm)
osv · GHSA-w2cw-5p4p-mc64
npm: helpersutils-dev-tools
Malicious code in npmscript_tesstalert_unpkg (npm)
osv · GHSA-xvj9-j5xj-9f5p
npm: npmscript_tesstalert_unpkg
Malicious code in com.apple.unityplugin.storekit (npm)
osv · GHSA-xcvv-h724-8jw8
npm: com.apple.unityplugin.storekit
Malicious code in testmgkregme (npm)
osv · GHSA-x8qg-wc79-vfhh
npm: testmgkregme
Denver SHO-110 IP Camera Unauthenticated Snapshot Access
cve-program ·
Vendor product: SHO-110
Denver SHO-110 IP Camera Unauthenticated Snapshot Access
cve-program ·
Vendor product: SHO-110
WordPress NativeChurch theme < 4.9.5 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: nativechurch
DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution
cve-program ·
Vendor product: Neo · Vendor product: Neo 2 · Vendor product: Flip
Command Injection Vulnerability in Netlink ICT HG323RW Router
cve-program ·
Vendor product: Netlink ICT HG323RW Router
WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability
cve-program ·
https://wordpress.org/plugins: flexible-quantity-measurement-price-calculator-for-woocommerce
WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: event-post
WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability
cve-program ·
https://wordpress.org/plugins: ppv-live-webcams
WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: videowhisper-site-manager
WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: tmds-dropshipping-for-temu-and-woo
WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: event-post
WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability
cve-program ·
https://wordpress.org/plugins: booster-elite-for-woocommerce
WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: post-type-archive-mapping
WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: flexible-subscriptions
WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: wp-user-manager
WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://crocoblock.com: jet-elements
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.