Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityWindows Common Log File System Driver Elevation of Privilege Vulnerability
cve-program ·
Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows Server 2019
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
cve-program ·
Vendor product: n/a
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
osv · BIT-dotnet-2026-47302 · BIT-dotnet-sdk-2026-47302 · CVE-2026-47302
NuGet: System.Security.Cryptography.Xml · NuGet: Microsoft.NetCore.App.Runtime.linux-arm · NuGet: Microsoft.NetCore.App.Runtime.linux-arm64
Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability
osv · BIT-dotnet-2026-50659 · BIT-dotnet-sdk-2026-50659 · CVE-2026-50659
NuGet: Microsoft.NetCore.App.Runtime.linux-arm · NuGet: Microsoft.NetCore.App.Runtime.linux-arm64 · NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
osv · CVE-2026-73088
npm: browserslist
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
osv · CVE-2026-75975
npm: fast-uri · npm: fast-uri · npm: fast-uri
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
osv · CVE-2026-83610
npm: @xmldom/xmldom · npm: @xmldom/xmldom · npm: xmldom
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS)
osv · CVE-2026-71429
npm: stream-json
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
osv · CVE-2026-75931
npm: fast-uri · npm: fast-uri · npm: fast-uri
qs: Denial of Service via Attacker Controlled isBuffer
osv · CVE-2026-82417
npm: qs
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
osv ·
npm: mysql2
kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
osv · CVE-2026-77354 · GO-2026-6275
Go: github.com/getkin/kin-openapi
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
osv · CVE-2026-55677 · GO-2026-6293
Go: github.com/labstack/echo/v5 · Go: github.com/labstack/echo/v4 · Go: github.com/labstack/echo
rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
osv · BIT-rclone-2026-71310 · CVE-2026-71310 · GO-2026-6199
Go: github.com/rclone/rclone
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
osv · CVE-2026-45822
npm: decode-uri-component
Mermaid radar diagrams are vulnerable to DoS
osv · CVE-2026-71439
npm: mermaid
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
osv · CVE-2026-69152
npm: brace-expansion · npm: brace-expansion · npm: brace-expansion
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
osv · CVE-2026-16729
npm: undici · npm: undici · npm: undici
postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service
osv · RUSTSEC-2026-0180
crates.io: postgres-protocol
package pkcs12: Authentication bypass in Decode functions
osv · GO-2026-5052
Go: software.sslmate.com/src/go-pkcs12
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
osv · CVE-2026-69192
npm: ip-address
Russh: Channel-scoped server callbacks can be reached without an open channel
osv · CVE-2026-68930
crates.io: russh
Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts
osv · CVE-2026-55092 · GO-2026-6294
Go: github.com/aquasecurity/trivy
kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
osv · CVE-2026-76905 · GO-2026-6274
Go: github.com/getkin/kin-openapi
undici vulnerable to CRLF Injection via blob-like body 'type' property
osv · CVE-2026-15157
npm: undici · npm: undici · npm: undici
undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
osv · CVE-2026-14643
npm: undici · npm: undici
go-git: Worktree operations may follow symlinks
osv · CVE-2026-71556 · GO-2026-6213
Go: github.com/go-git/go-git/v5 · Go: github.com/go-git/go-git/v6
DeepmergeTS has stack exhaustion when merging recursive object graphs
osv · CVE-2026-40345
npm: deepmerge-ts
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
osv · BIT-rclone-2026-59733 · CVE-2026-59733 · GO-2026-6195
Go: github.com/rclone/rclone
Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
osv · CVE-2026-71850
npm: hono
Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability
osv · BIT-dotnet-2026-32178 · BIT-dotnet-sdk-2026-32178 · CVE-2026-32178
NuGet: Microsoft.NetCore.App.Runtime.linux-arm · NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm · NuGet: Microsoft.NetCore.App.Runtime.linux-arm64
Mermaid configuration APIs allow prototype pollution
osv · CVE-2026-71438
npm: mermaid · npm: mermaid
ImageMagick: Heap Buffer Over-Write in fx operation
osv · CVE-2026-62363
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.