CVE-2026-59785Published
Hidden host credentials inferable via multiselect.get filtering
cve-program ·
Vendor product: Zabbix
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698307 source statements · aliases may refer to the same vulnerabilityCVE-2026-59786Published
Active agent heartbeat missing TLS check
cve-program ·
Vendor product: Zabbix
CVE-2026-59787Published
SNMP trap injection in zabbix_trap_receiver.pl
cve-program ·
Vendor product: Zabbix
CVE-2026-59788Published
Stored XSS vulnerability in OAuth configuration form
cve-program ·
Vendor product: Zabbix
CVE-2026-94669Published
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: fluentformpro
CVE-2025-53345Published
WordPress Thim Core plugin <= 2.3.3 - Arbitrary plugin Installation vulnerability
cve-program ·
https://wordpress.org/plugins: thim-core
CVE-2026-105291Published
feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting
cve-program ·
Vendor product: feelcrm-os
GHSA-mf7q-r4rv-jv94Published
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
osv · CVE-2026-105163 · GO-2026-6302
Go: github.com/crossplane/crossplane-runtime/v2 · Go: github.com/crossplane/crossplane-runtime/v2
GO-2026-6302Published
Signature verification TOCTOU allows installing unverified package content in github.com/crossplane/crossplane-runtime/v2
osv · CVE-2026-105163 · GHSA-mf7q-r4rv-jv94
Go: github.com/crossplane/crossplane-runtime/v2
CVE-2026-17005Published
Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field
cve-program ·
Vendor product: Horizontal scrolling announcements
CVE-2026-104118Published
Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR
cve-program ·
Vendor product: Razorpay for WooCommerce
CVE-2026-104119Published
Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials
cve-program ·
Vendor product: Simple Shopping Cart
CVE-2026-86817Published
Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback
cve-program ·
Vendor product: Five Star Business Profile and Schema
CVE-2026-93549Published
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
cve-program ·
Vendor product: CoCart
CVE-2026-84169Published
UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery
cve-program ·
Vendor product: UPI QR Code Payment Gateway
CVE-2026-13607Published
File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access
cve-program ·
Vendor product: File Uploads Addon for WooCommerce
CVE-2026-78371Published
File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure
cve-program ·
Vendor product: File Uploads Addon for WooCommerce
CVE-2026-20544Published
In meta, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interac…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-80276Published
Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface
cve-program ·
Vendor product: 1456B Multi-User Gateway
CVE-2026-80275Published
Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
cve-program ·
Vendor product: 1456B Multi-User Gateway
CVE-2026-66621Published
WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: ultimate-dashboard-pro
CVE-2026-20525Published
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges need…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20527Published
In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed.…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20532Published
In apu, there is a possible application crash due to double free. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11249024; Issue ID: …
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20534Published
In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privilege…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20538Published
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileg…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20539Published
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges n…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20540Published
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges n…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20541Published
In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileg…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-20543Published
In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY016452…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-18825Published
Origin validation error in the connect-xcors npm package
cve-program ·
https://registry.npmjs.org: connect-xcors
CVE-2025-32220Published
WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: salon-booking-system
CVE-2026-81793Published
WordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: salon-booking-system
CVE-2026-39601Published
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
cve-program ·
https://wordpress.org/plugins: booking
CVE-2026-103345Published
WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: pie-register
CVE-2026-103336Published
WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: wp-ultimate-csv-importer
MAL-2026-17549Published
Malicious code in css-display-reading-polyfill (npm)
osv ·
npm: css-display-reading-polyfill
MAL-2026-17561Published
Malicious code in insomnia-plugin-api-lint-helper (npm)
osv ·
npm: insomnia-plugin-api-lint-helper
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.