Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699309 source statements · aliases may refer to the same vulnerabilitySIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}
cve-program ·
Vendor product: MyPHR
Open5GS PFCP Session Report Request n4-handler.c smf_n4_handle_session_report_request assertion
cve-program ·
Vendor product: Open5GS
motionEye: Authentication possible via password hash
cve-program ·
Vendor product: motioneye
Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlock
cve-program ·
Vendor product: suricata
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
cve-program ·
Vendor product: org.hl7.fhir.core
N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and pe…
cve-program ·
Vendor product: Mail Assure
Redocly CLI: Path traversal when using `split` command
cve-program ·
Vendor product: redocly-cli
GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free
cve-program ·
Vendor product: GPAC
Tanium addressed an improper access controls vulnerability in Threat Response.
cve-program ·
Vendor product: Threat Response
Tanium addressed a SQL injection vulnerability in Threat Response.
cve-program ·
Vendor product: Threat Response
Tanium addressed an improper access controls vulnerability in Threat Response.
cve-program ·
Vendor product: Threat Response
Vouch Proxy: Unbounded Multipart Cookie Allocation DoS
cve-program ·
Vendor product: vouch-proxy
HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write
cve-program ·
Vendor product: HP AC Print & Scan · Vendor product: HP Output Central
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write
cve-program ·
Vendor product: HP AC Print & Scan · Vendor product: HP Output Central
HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write
cve-program ·
Vendor product: HP AC Print & Scan · Vendor product: HP Output Central
Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software
pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools
cve-program ·
Vendor product: pgAdmin 4
Cisco Identity Services Engine RADIUS Denial of Service Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software
pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode
cve-program ·
Vendor product: pgAdmin 4
Cisco Identity Services Engine Arbitrary File Read Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector
pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool
cve-program ·
Vendor product: pgAdmin 4
Cisco Identity Services Engine SQL Injection Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
cve-program ·
Vendor product: tinacms · Vendor product: auth · Vendor product: next-tinacms-azure
ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion
cve-program ·
Vendor product: ExifReader
vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack
cve-program ·
Vendor product: vm2
vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
cve-program ·
Vendor product: vm2
vm2 before 3.11.7 Memory Disclosure via Buffer Pool
cve-program ·
Vendor product: vm2
RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter
cve-program ·
Vendor product: RosarioSIS
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
cve-program ·
Vendor product: soupsieve
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
cve-program ·
Vendor product: vm2
vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js
cve-program ·
Vendor product: vm2
ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8
cve-program ·
Vendor product: ansi2html
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tam…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
vgmstream mus_acm.c parse_mus resource consumption
cve-program ·
Vendor product: vgmstream
OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types
cve-program ·
Vendor product: openbao
Opencast: Session fixation in login enables account takeover via crafted link
cve-program ·
Vendor product: opencast
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
cve-program ·
Vendor product: payload-plugins · Vendor product: payload-alt-text-plugin
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
cve-program ·
Vendor product: cyclonedx-node-npm
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.