Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698821 source statements · aliases may refer to the same vulnerabilityMalicious code in epic-offline-token-verifier-node (npm)
osv ·
npm: epic-offline-token-verifier-node
Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
osv · CVE-2026-12537
npm: @google/gemini-cli · npm: @google/gemini-cli · GitHub Actions: google-github-actions/run-gemini-cli
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to P…
cve-program ·
Vendor product: ThinOS 10
Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform
cve-program ·
Vendor product: ServiceNow AI Platform
Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal
cve-program ·
Vendor product: Velociraptor
Shell script injection via server-supplied database name in Open MongoDB shell
cve-program ·
Vendor product: Compass
Multiple Vulnerabilities in IBM Concert Software
cve-program ·
Vendor product: Concert
Multiple Vulnerabilities in IBM Concert Software
cve-program ·
Vendor product: Concert
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
cve-program ·
Vendor product: Webmail
Multiple Vulnerabilities in IBM Concert Software
cve-program ·
Vendor product: Concert
Multiple Vulnerabilities in IBM Concert Software
cve-program ·
Vendor product: Concert
Multiple Vulnerabilities in IBM Concert Software
cve-program ·
Vendor product: Concert
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
cve-program ·
Vendor product: WSO2 Universal Gateway · Vendor product: WSO2 Traffic Manager · Vendor product: WSO2 API Control Plane
Adobe Commerce | Incorrect Authorization (CWE-863)
cve-program ·
Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source
Malicious code in wallet-connect-adapter (npm)
osv ·
npm: wallet-connect-adapter
Malicious code in n8n-nodes-moonlet-utils (npm)
osv ·
npm: n8n-nodes-moonlet-utils
Malicious code in n8n-nodes-moonlet-helpers (npm)
osv ·
npm: n8n-nodes-moonlet-helpers
Gigatech PDV5701 WebSocket Service index.html missing authentication
cve-program ·
Vendor product: PDV5701
xuxueli xxl-job insert cross site scripting
cve-program ·
Vendor product: xxl-job
vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size
cve-program ·
Vendor product: vllm
DesktopSMS 1.11.0 Unauthorized Access via Local Service
cve-program ·
Vendor product: DesktopSMS
Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool
cve-program ·
Vendor product: chartbrew
lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
cve-program ·
Vendor product: lamp-cloud
Joplin: Pending share recipients can write items into shared folders before accepting invitations
cve-program ·
Vendor product: joplin
Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
cve-program ·
Vendor product: joplin
MaxKB: Sandbox escape via unhooked fexecve
cve-program ·
Vendor product: MaxKB
MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)
cve-program ·
Vendor product: MaxKB
MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
cve-program ·
Vendor product: MaxKB
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.