Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694331 source statements · aliases may refer to the same vulnerabilityAssimp through 6.0.5 NULL Pointer Dereference via Ogre Animation Track
cve-program ·
https://github.com: assimp
NetSurf libnsbmp through 0.1.7 Out-of-Bounds Read via bmp_decode_mask
cve-program ·
https://github.com/netsurf-browser/libnsbmp: libnsbmp
libansilove 1.3.0 through 1.4.2 NULL Pointer Dereference via ansilove_xbin
cve-program ·
https://github.com/ansilove/libansilove: libansilove
FreeImage through 3.19.23 Heap Out-of-Bounds Read via PICT Unpack32Bits
cve-program ·
https://github.com: FreeImage · Vendor product: FreeImage
Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame
osv ·
crates.io: zstd
Aliasing violations in splice, mutable iteration and cursors
osv · GHSA-924w-mwc9-86m8
crates.io: skiplist
WebAssembly allocator shim corrupts memory on allocation failure
osv ·
crates.io: zstd-sys
Build environment compiled into the library and readable at runtime
osv ·
crates.io: rustpython-vm
Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`
osv ·
crates.io: dahl-salso
Out-of-bounds read when training a dictionary from inconsistent sample sizes
osv ·
crates.io: zstd
SSRF and local file disclosure via unvalidated URLs
osv · GHSA-23hp-j76v-pcwj
crates.io: webpage
Use-after-free from a comparator that answers inconsistently
osv · GHSA-cc53-p78w-23w9
crates.io: skiplist
`PamHandle::get_user` can cause an authentication bypass
osv ·
crates.io: pam-bindings
libTiMidity through 0.2.8 Stack Out-of-Bounds Write via parse_gen in SoundFont Loader
cve-program ·
https://github.com/sezero/libtimidity: libtimidity
libewf through 20260924 Heap Out-of-Bounds Read via L01 Extended Attribute Parsing
cve-program ·
https://github.com/libyal/libewf: libewf
UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module
cve-program ·
https://gitlab.com: uade
Apache bRPC: NULL Pointer Dereference in RTMP createStream Error Path Leading to Remote Denial of Service
cve-program ·
https://github.com: apache/brpc
La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation
cve-program ·
Vendor product: docs
Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
cve-program ·
https://github.com: apache/brpc
Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
cve-program ·
https://github.com: apache/datasketches-cpp
Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
cve-program ·
Vendor product: Apache Answer
Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
cve-program ·
https://github.com: apache/brpc
SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services
cve-program ·
Vendor product: Harbor · Vendor product: Harbor · Vendor product: Harbor
Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
cve-program ·
https://github.com: apache/brpc
Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
cve-program ·
Vendor product: wazuh-manager
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.