Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699801 source statements · aliases may refer to the same vulnerabilityS2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()
cve-program ·
Vendor product: S2OPC
jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization
cve-program ·
Vendor product: Tourism-Management-System
SourceCodester School Registration and Fee System save_class.php sql injection
cve-program ·
Vendor product: School Registration and Fee System
quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting
cve-program ·
Vendor product: shiyi-blog
hashi-vault-js: Vault token and secret values exposed in thrown errors
cve-program ·
Vendor product: hashi-vault-js
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
cve-program ·
Vendor product: pimcore
linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting
cve-program ·
Vendor product: litemall
GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow
cve-program ·
Vendor product: Binutils
Rizwan17 inventory-management-system manage.php update_record sql injection
cve-program ·
Vendor product: inventory-management-system
itsourcecode Sales and Inventory System emp_transac.php add sql injection
cve-program ·
Vendor product: Sales and Inventory System
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
cve-program ·
Vendor product: Cheshire Cat AI
TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
cve-program ·
Vendor product: Java-WebSocket
itsourcecode Sales and Inventory System sup_edit1.php sql injection
cve-program ·
Vendor product: Sales and Inventory System
Maono Link local privilege escalation
cve-program ·
Vendor product: Maono Link
Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting
cve-program ·
Vendor product: Open-Generative-AI
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM HDR driver (due to improper cleanup upon vmap failure) leads to a kernel crash.
cve-program ·
Vendor product: Exynos 1280 firmware
An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Set…
cve-program ·
Vendor product: Exynos 1080 firmware
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, re…
cve-program ·
Vendor product: Exynos 1330 firmware
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds array access vulnerability in the error-handling path leads to memory corruption…
cve-program ·
Vendor product: Exynos 1330 firmware
GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
cve-program ·
Vendor product: GPAC
praisonai: recipe serve auth middleware silently disables itself when no secret is set
cve-program ·
Vendor product: PraisonAI
Malicious code in @aiwfm/communitywfm.scripts.api (npm)
osv ·
npm: @aiwfm/communitywfm.scripts.api
OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
cve-program ·
Vendor product: opentelemetry-operator
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
cve-program ·
Vendor product: langgraph-api
node-opcua: Missing nonce verification in UserNameIdentityToken authentication
cve-program ·
Vendor product: node-opcua
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's compl…
cve-program ·
Vendor product: CrewAI
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
cve-program ·
Vendor product: grpc-go
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
cve-program ·
Vendor product: node-opcua
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
cve-program ·
Vendor product: mcp-context-forge · Vendor product: mcp-contextforge-gateway
GNU Binutils ld cache.c cache_bwrite buffer overflow
cve-program ·
Vendor product: Binutils
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposi…
cve-program ·
Vendor product: Serena
Malicious code in tailwindcss-contact-forms (npm)
osv ·
npm: tailwindcss-contact-forms
Possible information disclosure inside TreeGrid component with default data provider
cve-program ·
https://repo.maven.apache.org/maven2: com.vaadin:vaadin · https://repo.maven.apache.org/maven2: com.vaadin:vaadin-grid-flow
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
cve-program ·
Vendor product: CyberPanel
SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
cve-program ·
Vendor product: sqladmin
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.
cve-program ·
Vendor product: PRTG Network Monitor
GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
cve-program ·
Vendor product: GPAC
praisonai: Jobs API exposes agent-execution endpoints with no authentication
cve-program ·
Vendor product: PraisonAI
An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed message is sent to the camera driver, causing limited information disclosure or denial of service.
cve-program ·
Vendor product: Exynos 1580 firmware
PraisonAI Code agent tools fail open without a workspace boundary
cve-program ·
Vendor product: PraisonAI
0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal
cve-program ·
Vendor product: HexStrike AI
The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
cve-program ·
Vendor product: svg_optimizer
wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization
cve-program ·
Vendor product: Spring-Cloud-Platform
simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication
cve-program ·
Vendor product: api-lambda-send-email-ses
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.