Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694746 source statements · aliases may refer to the same vulnerabilityundici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
cve-program ·
Vendor product: undici
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
cve-program ·
Vendor product: undici
OpenNMS REST authorization bypass via non-canonical HTTP method
cve-program ·
Vendor product: Meridian · Vendor product: Horizon
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
cve-program ·
Vendor product: undici
OpenNMS denial of service via XML entity expansion
cve-program ·
Vendor product: Meridian · Vendor product: Horizon
ZoneMinder: Authenticated RCE via command injection in monitor Device Path
cve-program ·
Vendor product: zoneminder
AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
cve-program ·
Vendor product: aipexbase
EnergizeLab Eilik User-ID Mass Assignment Account Takeover
cve-program ·
Vendor product: NestJS auth service
EnergizeLab Station Middleware Admin APIs Missing Role Checks
cve-program ·
Vendor product: station-middleware
EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching
cve-program ·
Vendor product: FastAPI AI inference server
EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read
cve-program ·
Vendor product: station-middleware
IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints
cve-program ·
Vendor product: IceCMS
EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks
cve-program ·
Vendor product: Robot firmware (mode 104000) · Vendor product: AI Station firmware (RK3562) · Vendor product: Windows desktop app (EnergizeLabSetup-3.1.2-Win.exe)
EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key
cve-program ·
Vendor product: FirmwareUpdater
yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints
cve-program ·
Vendor product: yshop-crm
EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers
cve-program ·
Vendor product: NestJS auth service
EnergizeLab AI Station Default Root Credentials with SSH Enabled
cve-program ·
Vendor product: AI Station firmware (RK3562)
EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write
cve-program ·
Vendor product: FastAPI AI inference server
MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
cve-program ·
Vendor product: mp4v2
WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup
cve-program ·
Vendor product: whaticket-community
Dragonfly through 2.0.2 Unbounded Memory Allocation via Negative COUNT in HRANDFIELD, ZRANDMEMBER and SRANDMEMBER
cve-program ·
Vendor product: dragonfly
Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
cve-program ·
Vendor product: Aureus ERP
Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API
cve-program ·
Vendor product: Archon
HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
cve-program ·
Vendor product: HUIZHI-ChargeOS-cloud
Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns
cve-program ·
Vendor product: recipes
unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name
cve-program ·
Vendor product: unarr
Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id
cve-program ·
Vendor product: aureuserp
HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
cve-program ·
Vendor product: hestiacp
Malicious code in @beloved-lenora/opencode-goal (npm)
osv · GHSA-c78h-wwhq-g6j8
npm: @beloved-lenora/opencode-goal
Malicious code in @beloved-lenora/opencode-shared-rpc (npm)
osv · GHSA-8c9g-fwgq-rqq5
npm: @beloved-lenora/opencode-shared-rpc
Malicious code in @beloved-lenora/opencode-stats (npm)
osv · GHSA-f4h2-68pg-ffhj
npm: @beloved-lenora/opencode-stats
Malicious code in @beloved-lenora/opencode-btw (npm)
osv · GHSA-xv54-6gmc-3xph
npm: @beloved-lenora/opencode-btw
Malicious code in @beloved-lenora/opencode-todo (npm)
osv · GHSA-9rjq-6mhc-46c5
npm: @beloved-lenora/opencode-todo
Malicious code in @beloved-lenora/opencode-orchestrator (npm)
osv · GHSA-7wq2-8pc2-wm26
npm: @beloved-lenora/opencode-orchestrator
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
osv · CVE-2026-76894
npm: @aborruso/ckan-mcp-server
smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri
cve-program ·
Vendor product: smart-sso
WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints
cve-program ·
Vendor product: WHartTest
netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
cve-program ·
Vendor product: netdisk-fast-download
Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
cve-program ·
Vendor product: Linux · Vendor product: Linux
serial: amba-pl011: synchronize DMA teardown
cve-program ·
Vendor product: Linux · Vendor product: Linux
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
cve-program ·
Vendor product: Linux · Vendor product: Linux
net: gro: properly validate BIG TCP aggregation criteria
cve-program ·
Vendor product: Linux · Vendor product: Linux
of: reserved_mem: prevent OOB when too many dynamic regions are defined
cve-program ·
Vendor product: Linux · Vendor product: Linux
wifi: mac80211: validate individual TWT params before driver setup
cve-program ·
Vendor product: Linux · Vendor product: Linux
Bluetooth: ISO: ensure no dangling hcon references in iso_conn
cve-program ·
Vendor product: Linux · Vendor product: Linux
sctp: validate Adaptation Indication parameter length
cve-program ·
Vendor product: Linux · Vendor product: Linux
ALSA: pcm: wake linked drain waiters on unlink
cve-program ·
Vendor product: Linux · Vendor product: Linux
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.