CVE-2026-103057Published
AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints
cve-program ·
Vendor product: AiSOC
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698713 source statements · aliases may refer to the same vulnerabilityCVE-2026-102842Published
gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload
cve-program ·
Vendor product: HospitalManagement
CVE-2026-102845Published
gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure
cve-program ·
Vendor product: HospitalManagement
CVE-2026-102874Published
HKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection
cve-program ·
Vendor product: AnyTool
CVE-2026-103109Published
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A cr…
cve-program ·
Vendor product: Infinity
CVE-2026-102909Published
SourceCodester Online Reviewer Management System btn_functions.php sql injection
cve-program ·
Vendor product: Online Reviewer Management System
CVE-2026-102912Published
SourceCodester Online Leave Management System page reports sql injection
cve-program ·
Vendor product: Online Leave Management System
CVE-2026-103041Published
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service
cve-program ·
Vendor product: LightLLM
CVE-2026-102875Published
VLC media player before 3.0.24 Path Traversal via skins2
cve-program ·
Vendor product: vlc
CVE-2026-79625Published
Improper Synchronization in Monitoring in CODESYS Control Runtime
cve-program ·
Vendor product: Control RTE (SL) · Vendor product: Control RTE (for Beckhoff CX) SL · Vendor product: Control Win (SL)
CVE-2026-74221Published
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
cve-program ·
Vendor product: u-boot
CVE-2026-103114Published
OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
cve-program ·
Vendor product: openSIS-Classic
CVE-2026-102879Published
ClaraVerse through 0.3.1 SSRF Protection Bypass
cve-program ·
Vendor product: ClaraVerse
CVE-2026-95104Published
Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition.
cve-program ·
Vendor product: WSR-300HP · Vendor product: WEX-G300
CVE-2026-18417Published
Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
CVE-2024-42002Published
Unsafe use of eval() method in ros2 topic hz tool
cve-program ·
Vendor product: ros2topic
CVE-2026-103117Published
OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
cve-program ·
Vendor product: openSIS-Classic
CVE-2026-6223Published
OTP Bypass in Bahçelievler Muncipality's BiHayat App
cve-program ·
Vendor product: BiHayat App
CVE-2026-100143Published
FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email
cve-program ·
Vendor product: FluentCart A New Era of eCommerce
CVE-2026-75823Published
WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption
cve-program ·
Vendor product: User Frontend
CVE-2026-75824Published
WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled
cve-program ·
Vendor product: User Frontend
CVE-2026-80333Published
Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes
cve-program ·
Vendor product: Solace Extra
CVE-2026-82127Published
Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
cve-program ·
Vendor product: Schema & Structured Data for WP & AMP
CVE-2026-83560Published
New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass
cve-program ·
Vendor product: New User Approve
CVE-2026-85001Published
EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute
cve-program ·
Vendor product: EmbedPress
CVE-2026-85415Published
Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL
cve-program ·
Vendor product: Audio Player Block
CVE-2026-85573Published
All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload
cve-program ·
Vendor product: All in One Files Upload
CVE-2026-85576Published
All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
cve-program ·
Vendor product: All in One Files Upload
CVE-2026-86789Published
Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes
cve-program ·
Vendor product: Connections Business Directory
CVE-2026-87777Published
Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute
cve-program ·
Vendor product: Hostinger Reach
CVE-2026-88791Published
Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules
cve-program ·
Vendor product: Safe Redirect Manager
CVE-2026-88797Published
Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation
cve-program ·
Vendor product: Vayu X
CVE-2026-89190Published
Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax
cve-program ·
Vendor product: Robin Image Optimizer
CVE-2026-89193Published
Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser
cve-program ·
Vendor product: Robin Image Optimizer
CVE-2026-90953Published
Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks
cve-program ·
Vendor product: Image Optimizer
CVE-2026-91051Published
EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
cve-program ·
Vendor product: EWWW Image Optimizer
CVE-2026-91072Published
EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler
cve-program ·
Vendor product: EWWW Image Optimizer
CVE-2026-91832Published
WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
cve-program ·
Vendor product: WP Mobile Menu
CVE-2026-92424Published
Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue
cve-program ·
Vendor product: Content Egg
CVE-2026-92994Published
Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API
cve-program ·
Vendor product: Verge3D Publishing and E-Commerce
CVE-2026-93580Published
InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
cve-program ·
Vendor product: InPost PL
CVE-2026-94274Published
YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API
cve-program ·
Vendor product: YayReviews
CVE-2026-94297Published
Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation
cve-program ·
Vendor product: Media Library Organizer
CVE-2026-96886Published
Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export
cve-program ·
Vendor product: Course Booking System
CVE-2026-97196Published
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: give
CVE-2026-96342Published
WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: wpappninja
CVE-2026-102399Published
WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability
cve-program ·
https://wordpress.org/plugins: gallery-by-supsystic
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.