CVE-2026-103340Published
WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: site-reviews
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698466 source statements · aliases may refer to the same vulnerabilityCVE-2026-88350Published
An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().
cve-program ·
Vendor product: n/a
CVE-2026-97297Published
WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce
CVE-2026-103068Published
WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: bcs-mcp-manager
CVE-2026-13014Published
Remote Code Execution vulnerability in "Suspicious" application
cve-program ·
https://github.com/thalesgroup-cert/suspicious: Suspicious
CVE-2026-94620Published
Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)
cve-program ·
Vendor product: classroom50
CVE-2026-103690Published
itsourcecode Leave Management System controller.php sql injection
cve-program ·
Vendor product: Leave Management System
CVE-2026-9864Published
Fortra BoKS Server Agent adjoin machine-account password generation vulnerability
cve-program ·
Vendor product: Core Privileged Access Manager (BoKS)
CVE-2026-101322Published
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In depl…
cve-program ·
Vendor product: Eclipse BaSyx AAS Web UI
CVE-2026-92172Published
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHO…
cve-program ·
Vendor product: Meta Horizon OS
CVE-2026-97395Published
Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
cve-program ·
Vendor product: Apache Polaris
CVE-2026-51568Published
modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
cve-program ·
Vendor product: n/a
CVE-2026-103004Published
next.js cache leak on warm `use cache` handlers accessing root param
cve-program ·
Vendor product: next.js
CVE-2026-51860Published
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
cve-program ·
Vendor product: n/a
CVE-2026-51866Published
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.
cve-program ·
Vendor product: n/a
CVE-2026-94390Published
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: hide-shipping-method-for-woocommerce
CVE-2026-79896Published
Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability
cve-program ·
Vendor product: BoKS Manager
CVE-2026-97260Published
WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: maxgalleria
CVE-2026-12627Published
Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability
cve-program ·
Vendor product: Fortra's Core Privileged Access Manager (BoKS)
CVE-2026-97277Published
WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: social-boost
CVE-2026-76143Published
Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
cve-program ·
Vendor product: Genian SSL PNS (frodo-core)
CVE-2026-76144Published
Genians, Inc Genian SSL PNS Unrestricted File Upload
cve-program ·
Vendor product: Genian SSL PNS (frodo-core) · Vendor product: Genian SSL PNS (watchcat-ui)
CVE-2026-71899Published
Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api
GHSA-jf8q-945g-9q4cPublished
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
osv · CVE-2026-92952
npm: vm2
GHSA-qhwx-74w5-xhxqPublished
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
osv · CVE-2026-92948
npm: vm2
GHSA-jxxv-8r27-vm4pPublished
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
osv · CVE-2026-92950
npm: vm2
GHSA-xxm9-w59q-m66xWithdrawn
Duplicate Advisory: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
osv ·
Go: github.com/siyuan-note/siyuan/kernel
GHSA-5w4j-hchp-r332Withdrawn
Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
osv ·
Go: github.com/siyuan-note/siyuan/kernel
GHSA-v372-phq5-6mx6Withdrawn
Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
osv ·
Go: github.com/siyuan-note/siyuan/kernel
CVE-2026-76146Published
Genians, Inc Genian SSL PNS OS Command Injection
cve-program ·
Vendor product: Genian SSL PNS (xenics_auther)
CVE-2026-100514Published
WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: wp-rest-api-log
CVE-2026-76142Published
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
cve-program ·
Vendor product: Genian NAC 5.0.75 LTS Release · Vendor product: Genian NAC 5.0.85 Release Stable · Vendor product: Genian NAC 5.0.86 Release
CVE-2026-103347Published
WordPress hCaptcha for WP plugin <= 5.3.0 - Bypass Vulnerability vulnerability
cve-program ·
https://wordpress.org/plugins: hcaptcha-for-forms-and-more
CVE-2026-97280Published
WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: review-schema
CVE-2026-78210Published
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.
cve-program ·
Vendor product: Octopus Server
CVE-2026-100821Published
Site isolation issue in the Panning and Zooming component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-103585Published
attacker-controlled javascript license URL via XSS
cve-program ·
Vendor product: MediaWiki MediaSearch extension
CVE-2026-103584Published
attacker-controlled javascript license URL via XSS
cve-program ·
Vendor product: MediaWiki CommonsMetadata extension
CVE-2026-102805Published
Nothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow
cve-program ·
Vendor product: stb
CVE-2026-101283Published
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the hea…
cve-program ·
Vendor product: iperf3
CVE-2026-102793Published
Ziroom ZHOME A0101 set_time_zone command injection
cve-program ·
Vendor product: ZHOME A0101
CVE-2026-100817Published
Other issue in the JavaScript: WebAssembly component
cve-program ·
Vendor product: Thunderbird · Vendor product: Firefox
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.