Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694537 source statements · aliases may refer to the same vulnerabilityArgo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL
osv · BIT-argo-cd-2026-55797 · CVE-2026-55797 · GO-2026-6701
Go: github.com/argoproj/argo-cd/v2 · Go: github.com/argoproj/argo-cd/v3 · Go: github.com/argoproj/argo-cd/v3
ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
osv · BIT-argo-cd-2026-42880 · CVE-2026-42880 · CVE-2026-43824 · GO-2026-5099
Go: github.com/argoproj/argo-cd/v3 · Go: github.com/argoproj/argo-cd/v3
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
osv · CVE-2022-24904 · GO-2022-0453
Go: github.com/argoproj/argo-cd/v2 · Go: github.com/argoproj/argo-cd/v2 · Go: github.com/argoproj/argo-cd/v2
PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
cve-program ·
Vendor product: Open Journal Systems
eladmin through 2.7 Broken Access Control via /api/users Update and Delete
cve-program ·
Vendor product: eladmin
RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
cve-program ·
Vendor product: RIOT
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
cve-program ·
Vendor product: server
Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
cve-program ·
Vendor product: Mailu
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
cve-program ·
Vendor product: countly-server
SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
cve-program ·
Vendor product: SparkyFitness
libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS
cve-program ·
Vendor product: libiec61850
libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
cve-program ·
Vendor product: pupnp
libp2p-rust: Gossipsub GRAFT topics unbounded growth
cve-program ·
Vendor product: rust-libp2p
Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API
cve-program ·
Vendor product: erupt
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another parent'…
cve-program ·
Vendor product: Wheels
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By upload…
cve-program ·
Vendor product: Backdrop
Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
cve-program ·
Vendor product: nezha
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
cve-program ·
Vendor product: FreeRDP
FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title
cve-program ·
Vendor product: FreeRDP
Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection
cve-program ·
Vendor product: FastSAM
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
cve-program ·
Vendor product: n/a
BillionMail through 4.9 Forgeable JWTs via Default Signing Key
cve-program ·
Vendor product: BillionMail
CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift
cve-program ·
Vendor product: CRMEB
Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
cve-program ·
Vendor product: peppermint
Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
cve-program ·
Vendor product: likeshop
pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
cve-program ·
Vendor product: pig
rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
cve-program ·
Vendor product: rustdesk-api
JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch
cve-program ·
Vendor product: JobOps
Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials
cve-program ·
Vendor product: JA-A12
nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim
cve-program ·
Vendor product: nifti_clib
libmodplug through 0.8.9.1 Heap Out-of-Bounds Write via CSoundFile::ReadDSM
cve-program ·
Vendor product: libmodplug
kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name
cve-program ·
https://pypi.org: kedro-datasets
libmikmod through 3.3.15 Out-of-Bounds Read in MTM_Load via Channel Count
cve-program ·
https://github.com: libmikmod
LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization
cve-program ·
Vendor product: LightLLM
libTiMidity through 0.2.8 Out-of-Bounds Read via SoundFont Loader sndfont.c
cve-program ·
https://github.com/sezero/libtimidity: libtimidity
ValleyBell libvgm through commit a6eed945 Heap Out-of-Bounds Read via DecompressDataBlk
cve-program ·
https://github.com: libvgm
ytnef through 2.1.2 Heap Out-of-Bounds Read via DecompressRTF
cve-program ·
https://github.com/Yeraze/ytnef: ytnef
libregf through 20260526 Heap Out-of-Bounds Read via libregf_value_item_read_value_data
cve-program ·
https://github.com/libyal/libregf: libregf
OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position
cve-program ·
https://github.com: openslide
CFITSIO through 4.7.0 Heap Out-of-Bounds Read via HCOMPRESS input_nnybble
cve-program ·
https://github.com: cfitsio
AdPlug through 2.4 Out-of-Bounds Read via CxsmPlayer::play_note in XSM Files
cve-program ·
https://github.com: adplug
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
cve-program ·
https://github.com: pfSense CE
Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
cve-program ·
https://github.com: pfSense CE
Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting
cve-program ·
https://github.com: pfSense CE
Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID
cve-program ·
https://github.com: pfSense CE
NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction
cve-program ·
Vendor product: NetLicensing-MCP
HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
cve-program ·
Vendor product: htmlunit-neko
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.