Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
691999 source statements · aliases may refer to the same vulnerabilityA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web cont…
cve-program ·
Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS
A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web conten…
cve-program ·
Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing mal…
cve-program ·
Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitra…
cve-program ·
Vendor product: iOS and iPadOS · Vendor product: macOS
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with ne…
cve-program ·
Vendor product: Workflow
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthe…
cve-program ·
Vendor product: Oracle WebLogic Server
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1…
cve-program ·
Vendor product: Oracle Weblogic Server Proxy Plug-in
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: Oracle Mobile Field Service
Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated atta…
cve-program ·
Vendor product: Oracle Call Center Technology
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the …
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker …
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Multichannel Framework). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to t…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged att…
cve-program ·
Vendor product: PeopleSoft Enterprise FIN Common Objects Argentina
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker w…
cve-program ·
Vendor product: PeopleSoft Enterprise FIN Common Objects Brazil
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon t…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with n…
cve-program ·
Vendor product: Oracle Application Object Library
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon t…
cve-program ·
Vendor product: Oracle Concurrent Processing
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low p…
cve-program ·
Vendor product: Oracle E-Business Suite Integrated SOA Gateway
Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker …
cve-program ·
Vendor product: Oracle Partner Management
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…
cve-program ·
Vendor product: Oracle Applications Framework
Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacke…
cve-program ·
Vendor product: Document Management and Collaboration
A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application…
cve-program ·
https://gstreamer.freedesktop.org/: gst-editing-services
Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos
cve-program ·
https://github.com/keycloak/keycloak: keycloak · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: keycloak · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle
Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value
cve-program ·
https://github.com: libesedb
libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data
cve-program ·
https://github.com: libfwsi
libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_data
cve-program ·
https://github.com: libfwsi
youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List
cve-program ·
Vendor product: youlai-mall
Libyal libpff through 20260926 heap out-of-bounds read via libpff_record_entry_get_multi_value
cve-program ·
Vendor product: libpff
LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
cve-program ·
Vendor product: LearnHouse
3proxy 0.9.7 - 1.0.1 Uninitialized Stack Memory Disclosure via SOCKS4
cve-program ·
Vendor product: 3proxy
Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets
cve-program ·
Vendor product: tink-go
Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
cve-program ·
Vendor product: Squash
eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint
cve-program ·
Vendor product: eladmin
maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
cve-program ·
Vendor product: kubernetes-client
alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer
cve-program ·
Vendor product: google-maps
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
cve-program ·
Vendor product: go-micro
SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
cve-program ·
Vendor product: Smartermail
SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
cve-program ·
Vendor product: Smartermail
SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
cve-program ·
Vendor product: Smartermail
Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint
cve-program ·
Vendor product: Envira Gallery
Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
cve-program ·
Vendor product: Obsidian Desktop
Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
cve-program ·
Vendor product: Obsidian Desktop
Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODE
cve-program ·
Vendor product: coturn
NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
cve-program ·
Vendor product: netbox
HortusFox < 6.2 Remote Code Execution via Theme Import
cve-program ·
Vendor product: hortusfox-web
JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore
cve-program ·
Vendor product: JetBackup
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.