Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698903 source statements · aliases may refer to the same vulnerabilityNetcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
cve-program ·
Vendor product: NBR200V2
PaperCut Hive Embedded App for Ricoh: Javascript injection
cve-program ·
Vendor product: PaperCut Hive
dmlc dgl utils.py _read_torch_data deserialization
cve-program ·
Vendor product: dgl
ezGlobal｜GPM LIGHT - Sensitive Data Exposure
cve-program ·
Vendor product: GPM LIGHT
Authorization Bypass Through User-Controlled Key in DIAEnergie
cve-program ·
Vendor product: DIAEnergie
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
cve-program ·
Vendor product: WP Multilang – Translation and Multilingual Plugin
Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor
cve-program ·
Vendor product: PRTG Network Monitor
Path Traversal in HAVELSAN's Liman MYS
cve-program ·
Vendor product: Liman MYS
Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module
cve-program ·
Vendor product: qt
Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor
cve-program ·
Vendor product: PRTG Network Monitor
D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure
cve-program ·
Vendor product: DIR-X1860Z
Uncontrolled Search Path Element in Evope Collector
cve-program ·
Vendor product: Evope Collector
newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
cve-program ·
Vendor product: newbee-mall
vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
cve-program ·
Vendor product: TaxHacker
SerenityOS LibGfx BMPLoader.cpp decode_bmp_pixel_data integer overflow
cve-program ·
Vendor product: SerenityOS
Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure
cve-program ·
Vendor product: Spectra Legacy – Gutenberg Blocks
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
cve-program ·
Vendor product: CF-N1-S
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
cve-program ·
Vendor product: nivocart
code-projects Assessment Management add-single-mark.php cross site scripting
cve-program ·
Vendor product: Assessment Management
SourceCodester Online Reviewer Management System btn_functions.php sql injection
cve-program ·
Vendor product: Online Reviewer Management System
WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: w4-post-list
WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent
cve-program ·
Vendor product: WPForms
CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler
cve-program ·
Vendor product: CMB2
wpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields
cve-program ·
Vendor product: wpForo Forum
10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
cve-program ·
Vendor product: 10Web Booster
Masteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR
cve-program ·
Vendor product: Masteriyo LMS
Masteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure
cve-program ·
Vendor product: Masteriyo LMS
The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
cve-program ·
Vendor product: The Post Grid
MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation
cve-program ·
Vendor product: MasterStudy LMS WordPress Plugin
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
cve-program ·
Vendor product: Events Manager
Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
cve-program ·
Vendor product: Events Manager
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
osv · CVE-2026-56855
Go: golang.org/x/crypto
Malicious code in triage_bot_using_sdkv3 (npm)
osv ·
npm: triage_bot_using_sdkv3
Malicious code in system-performance-helper (npm)
osv · GHSA-fhpw-32cw-j76m · SNYK-JS-SYSTEMPERFORMANCEHELPER-19003271
npm: system-performance-helper
Malicious code in @sapappgyver/appgyver-descriptors (npm)
osv · GHSA-33x7-6mwq-xg5j · SNYK-JS-SAPAPPGYVERAPPGYVERDESCRIPTORS-18758933
npm: @sapappgyver/appgyver-descriptors
Malicious code in wos-library-ui (npm)
osv · GHSA-j5rq-m53m-6xfx · GHSA-wh36-rj36-m3ff
npm: wos-library-ui
Malicious code in ring-device-settings-library (npm)
osv · GHSA-c9hf-9c62-jcfq · GHSA-f4f7-3wwr-hxfx
npm: ring-device-settings-library
Malicious code in simplisafe-gatsby (npm)
osv · GHSA-4h74-54qw-vx37 · GHSA-grcq-xfr7-4vpm
npm: simplisafe-gatsby
Malicious code in axis-datagrid (npm)
osv · GHSA-7f64-56gx-r4cm · GHSA-c6gq-r9w4-xg7j
npm: axis-datagrid
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.