Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
693857 source statements · aliases may refer to the same vulnerabilityImageMagick before 7.1.2-30 Heap-use-after-free via GetList
cve-program ·
Vendor product: ImageMagick · Vendor product: ImageMagick
ImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race
cve-program ·
Vendor product: ImageMagick · Vendor product: ImageMagick
ImageMagick before 7.1.2-30 Memory Leak via MSL decoder
cve-program ·
Vendor product: ImageMagick · Vendor product: ImageMagick
ImageMagick before 7.1.2-30 Denial of Service Memory Budget
cve-program ·
Vendor product: ImageMagick · Vendor product: ImageMagick
n8n before 2.36.2 Missing Authorization via Insights API
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 1.123.73 Credential Exposure via Error Logging
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.73 Remote Code Execution via Git Node
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
cve-program ·
Vendor product: n8n · Vendor product: n8n
Kimai before 2.65.0 Authentication Bypass via Team Creation
cve-program ·
Vendor product: kimai
Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
cve-program ·
Vendor product: nodemailer
openssl-encrypt before 1.4.9 Output Injection via Unsanitized Filenames in verify-usb Command
cve-program ·
Vendor product: openssl_encrypt
CodeWhale before 0.8.64 Argument Injection via git_show
cve-program ·
Vendor product: CodeWhale · Vendor product: CodeWhale · Vendor product: CodeWhale
CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact
cve-program ·
Vendor product: CodeWhale · Vendor product: CodeWhale · Vendor product: CodeWhale
SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget
cve-program ·
Vendor product: siyuan
actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
cve-program ·
Vendor product: actix-http
Grav before 2.0.13 Stored XSS via quoted-attribute bypass
cve-program ·
Vendor product: grav
Grav through 2.0.11 Authentication Bypass via Flex Objects
cve-program ·
Vendor product: grav · Vendor product: grav-plugin-flex-objects
Grav API Plugin before 1.0.13 Scope Bypass via createApiKey
cve-program ·
Vendor product: grav-plugin-api
Grav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController
cve-program ·
Vendor product: grav-plugin-api
actix-files before 0.6.10 Information Disclosure via Files
cve-program ·
Vendor product: actix-files
actix-files before 0.6.10 Denial of Service via empty Range header
cve-program ·
Vendor product: actix-files
SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews
cve-program ·
Vendor product: siyuan
n8n before 1.123.67 SQL Injection via PostgresTrigger Node
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Authentication Bypass via HTTP Request Node
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 2.32.1 Path Traversal via computer-use search_files
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 2.32.1 Authentication Bypass via Token Exchange
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Path Traversal via Git Node Operations
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Prototype Pollution via VM Expression Engine
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 2.32.1 SSRF Protection Bypass via MCP Client
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Remote Code Execution via Git node
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Arbitrary File Read via Send Email Node
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 2.32.1 Remote Code Execution via Expression Sandbox Escape
cve-program ·
Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Module Cache Poisoning via Code Node
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Credential Exfiltration via Sub-Workflow
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 Arbitrary File Write via Edit Image Node
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
n8n before 1.123.67 SQL Injection via executeQuery Operation
cve-program ·
Vendor product: n8n · Vendor product: n8n · Vendor product: n8n
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.