Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699801 source statements · aliases may refer to the same vulnerabilityIn OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import…
cve-program ·
Vendor product: Glance
SourceCodester Inventory Management System Product Management products_handler.php cross site scripting
cve-program ·
Vendor product: Inventory Management System
subhajitkhan online-clinic-management-system listdoctor.php sql injection
cve-program ·
Vendor product: online-clinic-management-system
D-Link DWR-M921 formWsc os command injection
cve-program ·
Vendor product: DWR-M921
An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase parameter in the /ajax_table.php API endpoin…
cve-program ·
Vendor product: LibreNMS
Improper Claim Validation in PingAM OIDC Provider
cve-program ·
Vendor product: PingAM
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization
cve-program ·
Vendor product: LightLLM
Possible information disclosure of environment variables in Vaadin Build Plugins via Failed Frontend Build
cve-program ·
https://repo.maven.apache.org/maven2: com.vaadin:flow-plugin-base · https://repo.maven.apache.org/maven2: com.vaadin:flow-maven-plugin · https://repo.maven.apache.org/maven2: com.vaadin:flow-gradle-plugin
Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service
cve-program ·
Vendor product: openclaude
File Browser through 2.63.23 Path Traversal via Symlink Alias
cve-program ·
Vendor product: filebrowser
File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint
cve-program ·
Vendor product: filebrowser
Dvidelabs flatcc semantics.c fb_clear_parser memory leak
cve-program ·
Vendor product: flatcc
MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
cve-program ·
Vendor product: MISP
MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials
cve-program ·
Vendor product: MISP
Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing
cve-program ·
Vendor product: FTK Imager
Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints
cve-program ·
Vendor product: worklenz
python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret
cve-program ·
Vendor product: python-jose
MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
cve-program ·
Vendor product: core-moos
MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration
cve-program ·
Vendor product: essential-moos
MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
cve-program ·
Vendor product: moos-ivp
MOOS core-moos through 10.4.0 MOOSDB Accept Loop Denial of Service
cve-program ·
Vendor product: core-moos
MOOS-IvP through 24.8.1 uFldShoreBroker Unbounded Community State Retention
cve-program ·
Vendor product: moos-ivp
MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting
cve-program ·
Vendor product: core-moos
phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export
cve-program ·
Vendor product: phpMyFAQ
phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode
cve-program ·
Vendor product: phpMyFAQ
In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
cve-program ·
Vendor product: libxml2
In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.
cve-program ·
Vendor product: libxml2
A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All version…
cve-program ·
Vendor product: Desigo CC ClickOnce Client V6 · Vendor product: Desigo CC ClickOnce Client V7 · Vendor product: Desigo CC family V8
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with …
cve-program ·
Vendor product: Reyrolle 7SR5
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validate…
cve-program ·
Vendor product: Reyrolle 7SR5
Waves Central local privilege escalation via Improper XPC Client Authentication in macOS
cve-program ·
Vendor product: Waves Central
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
cve-program ·
Vendor product: open-webui
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
cve-program ·
Vendor product: open-webui
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
cve-program ·
Vendor product: open-webui
Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general
Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)
cve-program ·
Vendor product: Fast-DDS
laradashboard through 1.2.2 Missing Authorization via License API
cve-program ·
Vendor product: laradashboard
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could p…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially explo…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
cve-program ·
https://repo1.maven.org/maven2/com/github/luben/zstd-jni/: zstd-jni
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
knowns before 0.30.0 Path Traversal via Document API
cve-program ·
Vendor product: knowns
Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
cve-program ·
Vendor product: snipe-it
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.