CVE-2026-62097Published
WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: business-directory-plugin
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698713 source statements · aliases may refer to the same vulnerabilityCVE-2026-62084Published
WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: user-submitted-posts
CVE-2026-97259Published
WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: woo-vipps
CVE-2026-18783Published
Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES
cve-program ·
Vendor product: Trex MES
CVE-2026-18782Published
SQL Injection in Trex Digital Manufacturing's Trex MES
cve-program ·
Vendor product: Trex MES
CVE-2026-103388Published
MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
cve-program ·
Vendor product: MISP
CVE-2026-103389Published
MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
cve-program ·
Vendor product: MISP
CVE-2026-101042Published
Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
cve-program ·
Vendor product: parse-server · Vendor product: parse-server
CVE-2026-100867Published
spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection
cve-program ·
Vendor product: spaceship-prompt
CVE-2026-100863Published
Heym before 0.0.91 SSRF via image fetching and IPv6 validation
cve-program ·
Vendor product: heym
CVE-2026-100859Published
Heym before 0.0.106 Credential Exfiltration via URL Override
cve-program ·
Vendor product: heym
CVE-2026-100851Published
AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile
cve-program ·
Vendor product: AzuraCast
CVE-2026-100847Published
AzuraCast before 0.23.8 DQL Injection via sortOrder
cve-program ·
Vendor product: AzuraCast
CVE-2026-102422Published
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
cve-program ·
https://www.npmjs.com/package/shell-quote: shell-quote
CVE-2026-100843Published
MONAI before 1.6.0 Remote Code Execution via algo_from_pickle
cve-program ·
Vendor product: MONAI
CVE-2026-102414Published
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
cve-program ·
https://www.npmjs.com: pbkdf2
CVE-2026-100750Published
Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla
cve-program ·
Vendor product: Modules Anywhere (Pro) extension for Joomla
CVE-2026-100835Published
Contrast before 1.16.0 Remote Attestation Relay Attack
cve-program ·
Vendor product: contrast
GHSA-3pq3-5fj3-cg6vPublished
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
osv · CVE-2026-101898
npm: axios
GHSA-c29m-xwm3-cm6rPublished
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
osv · CVE-2026-101903
npm: axios
GHSA-542g-h47m-68v8Published
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
osv · CVE-2026-101901
npm: axios
GHSA-x97p-jq2g-jp4fPublished
Axios: Prototype Pollution Gadget in axios toFormData Options
osv · CVE-2026-101909
npm: axios · npm: axios
GHSA-mghh-pgcx-3jjjPublished
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
osv · CVE-2026-101906
npm: axios
CVE-2026-97685Published
LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
cve-program ·
Vendor product: LimeSurvey
CVE-2026-100747Published
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0
cve-program ·
Vendor product: Event Gallery for Joomla
CVE-2026-100744Published
coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization
cve-program ·
Vendor product: Coolify
CVE-2026-101109Published
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8
cve-program ·
Vendor product: com_vehiclemanager
CVE-2026-83115Published
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated at…
cve-program ·
Vendor product: Oracle Applications Manager
CVE-2023-54400Published
Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname
cve-program ·
Vendor product: Fumeng Cloud
CVE-2025-12999Published
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted p…
cve-program ·
Vendor product: Eclipse Open VSX
CVE-2026-101110Published
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6
cve-program ·
Vendor product: com_booklibrary
CVE-2026-100753Published
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9
cve-program ·
Vendor product: com_realestatemanager
CVE-2026-100698Published
Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
cve-program ·
Vendor product: adminer
CVE-2026-100752Published
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
cve-program ·
Vendor product: com_realestatemanager
CVE-2026-100749Published
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0
cve-program ·
Vendor product: Event Gallery for Joomla
CVE-2026-100751Published
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0
cve-program ·
Vendor product: plg_system_advancedmodules
CVE-2026-97165Published
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0
cve-program ·
Vendor product: Event Gallery for Joomla
CVE-2026-101108Published
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8
cve-program ·
Vendor product: com_vehiclemanager
CVE-2026-84894Published
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a…
cve-program ·
Vendor product: moxygen
CVE-2026-100694Published
Hugo before 0.166.0 Cross-Site Scripting via text/org
cve-program ·
Vendor product: hugo
CVE-2026-100690Published
Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks
cve-program ·
Vendor product: hugo
CVE-2026-92103Published
Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
cve-program ·
https://repo.hex.pm: mint · https://github.com: elixir-mint/mint
CVE-2026-100678Published
stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
cve-program ·
Vendor product: stoatchat
GHSA-96h4-vgxj-gvm2Published
Nest: Unbounded memory growth in the NestJS TCP microservice transport
osv ·
npm: @nestjs/microservices · npm: @nestjs/microservices
GHSA-9c5c-9qcx-q35qPublished
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
osv ·
npm: @nestjs/platform-fastify · npm: @nestjs/platform-fastify
CVE-2026-100674Published
stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization
cve-program ·
Vendor product: stoatchat
CVE-2026-100670Published
Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
cve-program ·
Vendor product: grav
CVE-2026-100666Published
Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
cve-program ·
Vendor product: netty · Vendor product: netty
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.