CVE-2026-102827Published
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
cve-program ·
Vendor product: git-js
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698419 source statements · aliases may refer to the same vulnerabilityCVE-2026-102823Published
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
cve-program ·
Vendor product: russh
CVE-2026-102677Published
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
cve-program ·
Vendor product: electron
CVE-2026-95385Published
Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium securi…
cve-program ·
Vendor product: Chrome
CVE-2026-95285Published
Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
cve-program ·
Vendor product: Chrome
CVE-2026-102808Published
PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
cve-program ·
Vendor product: PX4-Autopilot
CVE-2026-102630Published
UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host
cve-program ·
Vendor product: unopim
CVE-2026-86035Published
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
cve-program ·
Vendor product: weblate
CVE-2026-102293Published
realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization
cve-program ·
Vendor product: tacomall
CVE-2026-102264Published
mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting
cve-program ·
Vendor product: robo-cafe-rms
CVE-2026-94405Published
WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: download-manager
CVE-2026-94634Published
Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default
cve-program ·
https://pypi.python.org: thrift
CVE-2026-94633Published
Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
cve-program ·
Vendor product: dart bindings
CVE-2026-93926Published
Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
cve-program ·
https://conan.io/center: thrift
CVE-2026-81740Published
Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback
cve-program ·
Vendor product: Paytm Payment Gateway
CVE-2026-85004Published
Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect
cve-program ·
Vendor product: Popup Maker
CVE-2026-90988Published
Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum
cve-program ·
Vendor product: Request a Quote
CVE-2026-13718Published
Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content
cve-program ·
Vendor product: Tabs Responsive
CVE-2026-91828Published
OMGF < 6.3.11 - Unauthenticated DoS via do_optimize
cve-program ·
Vendor product: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
CVE-2026-85016Published
Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
cve-program ·
Vendor product: Unlimited Elements for Elementor
CVE-2026-91022Published
Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color
cve-program ·
Vendor product: Motors
CVE-2026-91023Published
Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured
cve-program ·
Vendor product: Motors
CVE-2026-94298Published
BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter
cve-program ·
Vendor product: BuildKit
CVE-2026-97317Published
Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page
cve-program ·
Vendor product: Giveaways and Contests by RafflePress
CVE-2026-97318Published
Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter
cve-program ·
Vendor product: Giveaways and Contests by RafflePress
CVE-2026-13413Published
CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match
cve-program ·
https://wordpress.org/plugins: CMP – Coming Soon & Maintenance
CVE-2026-1661Published
WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection
cve-program ·
https://wordpress.org/plugins: WP Mail Logging
CVE-2026-79618Published
WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
cve-program ·
https://wordpress.org/plugins: WP User Frontend
CVE-2026-84740Published
The Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter
cve-program ·
https://wordpress.org/plugins: The Events Calendar
CVE-2026-85005Published
Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization
cve-program ·
https://wordpress.org/plugins: Popup Maker WP
CVE-2026-90952Published
WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API
cve-program ·
https://wordpress.org/plugins: WP Edit Password Protected
CVE-2026-90987Published
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price
cve-program ·
https://wordpress.org/plugins: Easy PayPal & Stripe Buy Now Button
CVE-2026-91020Published
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount
cve-program ·
https://wordpress.org/plugins: WebToffee Gift Cards for WooCommerce
CVE-2026-92924Published
Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data
cve-program ·
https://wordpress.org/plugins: Unlimited Elements for Elementor
CVE-2026-97219Published
MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter
cve-program ·
https://wordpress.org/plugins: MStore API
CVE-2026-93925Published
Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id
cve-program ·
https://conan.io/center: thrift
CVE-2026-86325Published
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests…
cve-program ·
Vendor product: MGate MB3170 Series · Vendor product: MGate MB3270 Series
CVE-2026-91137Published
Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements
cve-program ·
https://packagist.org: apache/thrift
GO-2025-4014Published
Unbounded allocation when parsing GNU sparse map in archive/tar
osv · BIT-golang-2025-58183 · CVE-2025-58183
Go: stdlib
GO-2026-5037Published
Inefficient candidate hostname parsing in crypto/x509
osv · BIT-golang-2026-27145 · CVE-2026-27145
Go: stdlib
CVE-2026-86326Published
An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privilege…
cve-program ·
Vendor product: MGate MB3170 Series · Vendor product: MGate MB3270 Series
MAL-2026-17453Published
Malicious code in gocommunity.io/orderedbtree (Go)
osv ·
Go: gocommunity.io/orderedbtree
CVE-2026-56005Published
WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: wp-security-audit-log
CVE-2026-73382Published
WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: site-reviews
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.