Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699801 source statements · aliases may refer to the same vulnerabilityApache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.opennlp:opennlp-symspell
Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
cve-program ·
Vendor product: laravel-magiclink
AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server
cve-program ·
Vendor product: AirSane
Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)
cve-program ·
Vendor product: dobase
Rizwan17 inventory-management-system Login Page index.php cross site scripting
cve-program ·
Vendor product: inventory-management-system
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
cve-program ·
Vendor product: open-webui
Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass
cve-program ·
Vendor product: shelf.nu
libde265: Pixel accessor signed integer overflow causes heap OOB read/write
cve-program ·
Vendor product: libde265
Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration
cve-program ·
Vendor product: doco-cd
Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
cve-program ·
Vendor product: Royal Addons for Elementor – Addons and Templates Kit for Elementor
MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
cve-program ·
Vendor product: MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
Flowise before 3.1.4 Broken Access Control via organizationuser
cve-program ·
Vendor product: Flowise
WWBN AVideo Missing Authorization via playlistsFromUser.json.php
cve-program ·
Vendor product: AVideo
Duplicate Advisory: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS
osv ·
Go: github.com/siyuan-note/siyuan/kernel
WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
cve-program ·
Vendor product: AVideo
SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS
osv · CVE-2026-56395 · CVE-2026-56397 · GO-2026-4720
Go: github.com/siyuan-note/siyuan/kernel
WWBN AVideo Missing Authorization in ImageGallery list.json.php
cve-program ·
Vendor product: AVideo
vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor
cve-program ·
Vendor product: vLLM
sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers
cve-program ·
Vendor product: sngrep
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak crea…
cve-program ·
Vendor product: Flatpak
IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference
cve-program ·
Vendor product: Uninstaller
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.
cve-program ·
Vendor product: CyberPanel
strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.
cve-program ·
Vendor product: strongSwan
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
cve-program ·
Vendor product: strongSwan
PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.
cve-program ·
Vendor product: PCRE2
GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
cve-program ·
Vendor product: GetSimpleCMS-CE · Vendor product: GetSimpleCMS
OpenRemote read-only asset users can write predicted datapoints
cve-program ·
Vendor product: openremote
backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
cve-program ·
Vendor product: CRUD
ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler
cve-program ·
Vendor product: ArduinoCore-avr
Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution
cve-program ·
Vendor product: matrix-rust-sdk
Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode
cve-program ·
Vendor product: hoverfly
aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses
cve-program ·
Vendor product: aiosmtplib
Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method
cve-program ·
Vendor product: Flowise
An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service in the kernel.
cve-program ·
Vendor product: Exynos 8890 firmware
WWBN AVideo Missing Authentication via menuItems.json.php
cve-program ·
Vendor product: AVideo
WWBN AVideo Missing Authorization via videoAddViewCount.json.php
cve-program ·
Vendor product: AVideo
WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint
cve-program ·
Vendor product: AVideo
vLLM before 0.28.0 Denial of Service via audio extraction
cve-program ·
Vendor product: vLLM
Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the gen…
cve-program ·
https://hub.docker.com: socketdev/socket-registry-firewall
Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.
cve-program ·
Vendor product: Floodlight
SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected
cve-program ·
Vendor product: spicedb
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.