Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699329 source statements · aliases may refer to the same vulnerabilityLink Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1
cve-program ·
https://repo.hex.pm: cowlib · https://github.com: ninenines/cowlib
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · Vendor product: Cisco Secure Firewall Threat Defense (FTD) Software
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
Cisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · Vendor product: Cisco Secure Firewall Threat Defense (FTD) Software
Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check the method called through the proxy created when a sandboxed script coerces a value to an interface, if the value inherits a method of the same name as an inter…
cve-program ·
Vendor product: Jenkins Script Security Plugin
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not intercept operations performed on a null receiver (method calls, property and attribute accesses, and array accesses), allowing attackers with permission to define an…
cve-program ·
Vendor product: Jenkins Script Security Plugin
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier checks the operations Groovy will perform with the elements it reads from a collection that a sandboxed script casts to another type but performs the cast on the collection it…
cve-program ·
Vendor product: Jenkins Script Security Plugin
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary …
cve-program ·
Vendor product: Jenkins Script Security Plugin
An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp file.
cve-program ·
Vendor product: n/a
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the…
cve-program ·
Vendor product: Jenkins Script Security Plugin
Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter.
cve-program ·
Vendor product: n/a
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define…
cve-program ·
Vendor product: Jenkins Script Security Plugin
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not check calls from sandboxed scripts to methods added dynamically to a class at runtime, allowing attackers with permission to define and run sandboxed scripts, includi…
cve-program ·
Vendor product: Jenkins Script Security Plugin
Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture credent…
cve-program ·
Vendor product: Jenkins Pipeline: Multibranch Plugin
Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of…
cve-program ·
Vendor product: Jenkins Pipeline: Groovy Libraries Plugin
GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference
cve-program ·
Vendor product: GPAC
Jenkins Gradle Plugin 2.19.1252.v15196b_5a_6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to…
cve-program ·
Vendor product: Jenkins Gradle Plugin
Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.zookeeper:zookeeper
moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting
cve-program ·
Vendor product: Mogu Blog v2
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
cve-program ·
Vendor product: wire
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass
cve-program ·
Vendor product: orpc
vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption
cve-program ·
Vendor product: vLLM
GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
cve-program ·
Vendor product: GPAC
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.