Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698127 source statements · aliases may refer to the same vulnerabilityIncorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Me…
cve-program ·
Vendor product: Chrome
OS command injection in privileged configuration handling
cve-program ·
Vendor product: Secure Email Gateway
Unsafe deserialization in the REST interface
cve-program ·
Vendor product: SEPPmail Secure Email Gateway (SEG)
Mandatory MFA bypass before enrollment
cve-program ·
Vendor product: SEPPmail Secure Email Gateway (SEG)
GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage
cve-program ·
Vendor product: GPTranslate
Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter
cve-program ·
Vendor product: Ultimate Multisite
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call
cve-program ·
Vendor product: Frontend Dashboard
Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR
cve-program ·
Vendor product: Image Photo Gallery Final Tiles Grid
Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes
cve-program ·
Vendor product: Image Photo Gallery Final Tiles Grid
Booking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking Hash
cve-program ·
Vendor product: Booking Calendar
Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block
cve-program ·
Vendor product: Easy Digital Downloads
Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure
cve-program ·
Vendor product: Booking Calendar
LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
cve-program ·
Vendor product: Appointment Booking Plugin
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
cve-program ·
Vendor product: Appointment Booking Plugin
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
cve-program ·
Vendor product: Appointment Booking Plugin
Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF
cve-program ·
Vendor product: Database Addon For WPForms ( wpforms entries )
BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX
cve-program ·
Vendor product: BackWPup
BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
cve-program ·
Vendor product: BackWPup
BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback
cve-program ·
Vendor product: BackWPup
Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export
cve-program ·
Vendor product: Wallet System for WooCommerce
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.