Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694117 source statements · aliases may refer to the same vulnerabilityMalicious code in @greenlake/context-pane (npm)
osv · GHSA-5pp4-pvpc-g2xv
npm: @greenlake/context-pane
Malicious code in tailwind-animatecss-kit (npm)
osv ·
npm: tailwind-animatecss-kit
Malicious code in animatecss-tailwind-graphic (npm)
osv ·
npm: animatecss-tailwind-graphic
Malicious code in @ppa-web-components/ppa-searchform (npm)
osv · GHSA-9p3j-rrmc-jc4p
npm: @ppa-web-components/ppa-searchform
Malicious code in tailwindcss-animatemotion (npm)
osv ·
npm: tailwindcss-animatemotion
Malicious code in tailwind-animaflow-kit (npm)
osv ·
npm: tailwind-animaflow-kit
Malicious code in mock-transactions-sdk (npm)
osv · GHSA-357r-x5jp-3p8f
npm: mock-transactions-sdk
Malicious code in @ppa-web-components/ppa-navigation (npm)
osv · GHSA-vc6h-rv88-87j5
npm: @ppa-web-components/ppa-navigation
Malicious code in @flexmr/survey-conversation (npm)
osv · GHSA-hc8w-gq4q-fr74
npm: @flexmr/survey-conversation
Malicious code in harlow-css-mixer (npm)
osv · GHSA-j658-c56g-qxh4
npm: harlow-css-mixer
Malicious code in animatecss-tailwind-binary (npm)
osv ·
npm: animatecss-tailwind-binary
Malicious code in array-inline (npm)
osv · GHSA-4rc9-v9wp-xwrp
npm: array-inline
Malicious code in animatecss-tailwind-luminary (npm)
osv ·
npm: animatecss-tailwind-luminary
Malicious code in @ppa-web-components/ppa-builder (npm)
osv · GHSA-5q5w-4m9f-ppmg
npm: @ppa-web-components/ppa-builder
Malicious code in @flexmr/utils (npm)
osv · GHSA-hpc9-fxqh-hhf8
npm: @flexmr/utils
Malicious code in @greenlake/mfe-login-url (npm)
osv · GHSA-6vg7-x7p2-c749
npm: @greenlake/mfe-login-url
Malicious code in @ppa-web-components/ppa-banner (npm)
osv · GHSA-mwcw-x8h4-mqcg
npm: @ppa-web-components/ppa-banner
Malicious code in @drone-js-ext/vip-badge (npm)
osv · GHSA-h7v8-65vw-r7wh
npm: @drone-js-ext/vip-badge
Malicious code in @blueskydataplatform/shared-ui (npm)
osv · GHSA-6x9m-j5h8-w3vg
npm: @blueskydataplatform/shared-ui
InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
cve-program ·
Vendor product: InternAgent
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
cve-program ·
Vendor product: wasmtime
VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration
cve-program ·
Vendor product: vnote
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
cve-program ·
Vendor product: langgraph
Angular DevTools (Local DoS)
cve-program ·
Vendor product: angular · Vendor product: DevTools
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
cve-program ·
Vendor product: nezha
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: kadence-blocks
OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
cve-program ·
Vendor product: appointment-booking-software
Malicious code in overarch-windows-x64-yr (npm)
osv · GHSA-v5v8-j5gm-pq8v
npm: overarch-windows-x64-yr
Malicious code in path-stream-utils-testmetest (npm)
osv · GHSA-7pvr-f92m-6fwg
npm: path-stream-utils-testmetest
Malicious code in unicode-title-normalizer (npm)
osv · GHSA-66rv-6q99-h89g
npm: unicode-title-normalizer
Malicious code in tailwind-base-buttons (npm)
osv · GHSA-5j43-343m-gggg
npm: tailwind-base-buttons
Malicious code in ticketcathayoct12 (npm)
osv · GHSA-g7mg-3h9r-c8h3
npm: ticketcathayoct12
Malicious code in zero-baileys (npm)
osv · GHSA-v486-jrrq-rhwx
npm: zero-baileys
Malicious code in transaction-info-generate-sdk (npm)
osv · GHSA-23j5-jj88-v9f3
npm: transaction-info-generate-sdk
Malicious code in zxhgssiyluwxchn (npm)
osv · GHSA-54qq-xhj8-pcjc
npm: zxhgssiyluwxchn
Malicious code in sdk-utils-testmetest (npm)
osv · GHSA-m6qq-33mj-mv9w
npm: sdk-utils-testmetest
Malicious code in string-target-mapper-hash (npm)
osv · GHSA-wfcx-722r-fg5h
npm: string-target-mapper-hash
Malicious code in tellyo-colours (npm)
osv · GHSA-4q6x-w65x-677r
npm: tellyo-colours
Malicious code in csec-form-validatorr (npm)
osv · GHSA-ph3g-jrf5-8792
npm: csec-form-validatorr
Malicious code in paychex-pdftron (npm)
osv · GHSA-9mgv-25w8-jwhf
npm: paychex-pdftron
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.