Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698828 source statements · aliases may refer to the same vulnerabilityUnbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc
cve-program ·
https://repo.hex.pm: grpc · https://github.com: elixir-grpc/grpc
Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc
cve-program ·
https://repo.hex.pm: grpc · https://github.com: elixir-grpc/grpc
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
cve-program ·
Vendor product: CordysCRM
pg_partman disable maintenance for all partition sets
cve-program ·
Vendor product: pg_partman
SysReptor: Unauthorized file disclosure by broken access control in writable shared notes
cve-program ·
Vendor product: sysreptor
Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)
cve-program ·
Vendor product: Paymenter
Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure
cve-program ·
Vendor product: perses
Icinga 2: Stack overflow via deeply nested JSON objects
cve-program ·
Vendor product: icinga2
LubeLogger: IDOR in DuplicateRecordsToOtherVehicles Allows Copying Records from Any User's Vehicle Without Ownership Check
cve-program ·
Vendor product: lubelog
PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)
cve-program ·
Vendor product: pjproject
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
cve-program ·
Vendor product: anyio
libheif: Incomplete fix for CVE-2026-62292 leaves libheif vulnerable to an out-of-bounds read
cve-program ·
Vendor product: libheif
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding
cve-program ·
https://repo.hex.pm: grpc · https://github.com: elixir-grpc/grpc
CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection
cve-program ·
https://repo.hex.pm: tesla · https://github.com: elixir-tesla/tesla
NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing
cve-program ·
Vendor product: nanomq
libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)
cve-program ·
Vendor product: libheif
OpenImageIO: TIFF 1-bit CMYK bit conversion heap out-of-bounds write
cve-program ·
Vendor product: OpenImageIO
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.