Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694735 source statements · aliases may refer to the same vulnerabilityOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
cve-program ·
Vendor product: OpenVPN
Out-of-bounds Write Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server
cve-program ·
Vendor product: Hitachi Disk Array Driver for AIX · Vendor product: Hitachi Disk Array Driver for Virtual I/O Server
Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server
cve-program ·
Vendor product: Hitachi Disk Array Driver for AIX · Vendor product: Hitachi Disk Array Driver for Virtual I/O Server
Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL
cve-program ·
Vendor product: Unreal Engine
Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component. A high privileged attacker with remote ac…
cve-program ·
Vendor product: Terraform Provider for Redfish
Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP ISO-VPN egress protection is enabled
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: An attacker causes an rpd crash when routing-policy resolution-map processing and policy event tracing are enabled
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: An attacker causes rpd denial of service when EVPN route signaling is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: An attacker causes rpd crash and denial of service when EVPN is configured
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Improper Encoding or Escaping of Output in Crafty Controller
cve-program ·
Vendor product: Crafty Controller
Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
cve-program ·
Vendor product: lomiri-download-manager
Incorrect Permission Assignment for Critical Resource in lomiri-download-manager
cve-program ·
Vendor product: lomiri-download-manager
Gitea blind SSRF through OpenID assertion verification
cve-program ·
Vendor product: code.gitea.io/gitea
Gitea repository ownership escalation by administrators
cve-program ·
Vendor product: gitea.dev
Gitea API token scope escalation through HTTP signatures
cve-program ·
Vendor product: gitea.dev
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
cve-program ·
Vendor product: distribution
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
cve-program ·
Vendor product: svg-sanitizer
Gitea private attachment disclosure through repository mismatch
cve-program ·
Vendor product: gitea.dev
Gitea Runner host isolation bypass through container options
cve-program ·
Vendor product: gitea.com/gitea/runner
Gitea reusable workflow secret exposure in pull_request_target
cve-program ·
Vendor product: gitea/gitea
Gitea external renderer argument injection and code execution
cve-program ·
Vendor product: gitea
Gitea second-factor bypass through OpenID identity linking
cve-program ·
Vendor product: gitea.dev
Gitea GitLab migration denial of service
cve-program ·
Vendor product: code.gitea.io/gitea
Gitea organization repository creation token scope bypass
cve-program ·
Vendor product: code.gitea.io/gitea
phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
cve-program ·
Vendor product: phpMyFAQ
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.