Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694472 source statements · aliases may refer to the same vulnerabilityA2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
cve-program ·
Vendor product: a2a-java
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
cve-program ·
Vendor product: a2a-java
Malicious code in kvarzo8f3atestmetest (npm)
osv · GHSA-8vpc-rm6r-5m6c
npm: kvarzo8f3atestmetest
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
cve-program ·
Vendor product: filelock
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
cve-program ·
Vendor product: filelock
Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme
cve-program ·
Vendor product: Desktop
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
cve-program ·
Vendor product: filelock
DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
cve-program ·
Vendor product: Vigor2960
DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
cve-program ·
Vendor product: Vigor2960
Optimal IdM OptimalCloud social redirect
cve-program ·
Vendor product: OptimalCloud
Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
cve-program ·
Vendor product: dockhand
OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
cve-program ·
Vendor product: OpenCATS
OpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints
cve-program ·
Vendor product: OpenCATS
Keycloak: keycloak: user enumeration via differential error messages
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: Red Hat build of Keycloak 26.4.12 · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9
Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: Red Hat build of Keycloak 26.4.9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-quarkus-server · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: keycloak-quarkus-server
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource acti…
cve-program ·
Vendor product: Webmail
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
cve-program ·
Vendor product: LangAlpha
TS4500 Tape Library Insufficient Session Expiration
cve-program ·
Vendor product: Storage TS4500 Library
H3C Magic NX15 usrlist sub_416874 os command injection
cve-program ·
Vendor product: Magic NX15
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
cve-program ·
Vendor product: Pillow
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
cve-program ·
Vendor product: Pillow
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
cve-program ·
Vendor product: opensre
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.