Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694779 source statements · aliases may refer to the same vulnerabilitySSLContext.wrap_bio() missing validation of server_hostname parameter
cve-program ·
Vendor product: CPython
Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints
cve-program ·
Vendor product: cube-studio
Token Signing Key Allows Unauthenticated Administrative Access
cve-program ·
Vendor product: Remot Ops Agent
REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint
cve-program ·
Vendor product: rebuild
ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases
cve-program ·
Vendor product: chat-ollama
In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL propert…
cve-program ·
Vendor product: Eclipse Vert.x
99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
cve-program ·
Vendor product: 99AI
Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix
cve-program ·
Vendor product: NR256CN
Arkon through 0.9.2 Missing Authorization via Skills Versions API
cve-program ·
Vendor product: arkon
JIT miscompilation in the JavaScript Engine: JIT component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API
cve-program ·
Vendor product: LingGuo-Drama
Incorrect boundary conditions in the JavaScript Engine component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
cve-program ·
Vendor product: HUIZHI-ChargeOS-cloud
Incorrect boundary conditions in the JavaScript Engine component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Sandbox escape due to uninitialized memory in the Graphics component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest
cve-program ·
Vendor product: FreeRDP
Active Directory Password Change CSRF in AuthTake Technology's authtake
cve-program ·
Vendor product: authtake
Improper Authorization in Divasoft Software's Biletiva Ticketing Platform
cve-program ·
Vendor product: Biletiva Ticketing Platform
RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
cve-program ·
Vendor product: RedAmon
go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
cve-program ·
Vendor product: go-ldap-admin
Apache Allura: Oauth1 Replay Attack
cve-program ·
Vendor product: Apache Allura
Apache Allura: REST API Mass Assignment
cve-program ·
Vendor product: Apache Allura
Apache Allura: OAuth1 missing callback validation
cve-program ·
Vendor product: Apache Allura
Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state
cve-program ·
https://pkg.go.dev: go.temporal.io/server · https://pkg.go.dev: go.temporal.io/server · https://pkg.go.dev: go.temporal.io/server
Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces
cve-program ·
https://pkg.go.dev: go.temporal.io/server
Path traversal in Gleam via unvalidated package application names
cve-program ·
Vendor product: gleam · https://ghcr.io: gleam-lang/gleam · https://github.com: gleam-lang/gleam
psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters
cve-program ·
Vendor product: psqlODBC
Terminal escape sequence injection in Hex via unneutralized server-supplied output
cve-program ·
Vendor product: hex · https://github.com: hexpm/hex
Path traversal in rebar3 via unvalidated dependency app names
cve-program ·
Vendor product: rebar3 · https://github.com: erlang/rebar3
Path traversal in Hex via unvalidated dependency app names
cve-program ·
Vendor product: hex · https://github.com: hexpm/hex
Sensitive information exposure in Progress MarkLogic Server trace logs
cve-program ·
Vendor product: MarkLogic Server
Hex release-age cooldown is lifted package-wide when the locked release is retired
cve-program ·
Vendor product: hex · https://github.com: hexpm/hex
Hex writes unverified package tarballs to standard output in mix hex.package fetch
cve-program ·
Vendor product: hex · https://github.com: hexpm/hex
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
cve-program ·
Vendor product: hex · https://github.com: hexpm/hex
Hex trusts its bundled CA certificates when cacerts_path is set
cve-program ·
Vendor product: hex · https://github.com: hexpm/hex
@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields
cve-program ·
https://registry.npmjs.org: @neo4j/graphql
@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
cve-program ·
https://registry.npmjs.org: @neo4j/graphql
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.