Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694779 source statements · aliases may refer to the same vulnerabilityJivejdon through 5.0 SQL Injection via username in userListAction
cve-program ·
Vendor product: jivejdon
Improper XML external entity restriction in Progress MarkLogic Server SAML processing
cve-program ·
Vendor product: MarkLogic Server
HTTP response splitting in Progress MarkLogic Server Query Console
cve-program ·
Vendor product: MarkLogic Server
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
cve-program ·
Vendor product: Kirby
Netcore NR268 DDNS DDNSset.cgi execvp argument injection
cve-program ·
Vendor product: NR268
IBM Maximo Application Suite - IoT Component Denial of Service
cve-program ·
Vendor product: Maximo Application Suite - IoT Component
Edimax BR-6208AC formFilter cross site scripting
cve-program ·
Vendor product: BR-6208AC
Missing Authentication Vulnerability in JTL-WMS
cve-program ·
Vendor product: JTL-WMS
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerability is exploited, a local authenticated attacker who can log in to the Windows system where Manage…
cve-program ·
Vendor product: AssetView · Vendor product: AssetView CLOUD · Vendor product: AssetView Cloud +
Cross-Site Scripting in the YouMind web application
cve-program ·
Vendor product: YouMind web application
calcom cal.com/cal.diy Credentials delete credentials.delete privileges management
cve-program ·
Vendor product: cal.com · Vendor product: cal.diy
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the per…
cve-program ·
Vendor product: SIMATIC WinCC V7.5 · Vendor product: SIMATIC WinCC V8.0 · Vendor product: SIMATIC WinCC V8.1
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.
cve-program ·
Vendor product: SIMATIC Drive Controller CPU 1504D TF · Vendor product: SIMATIC Drive Controller CPU 1507D TF · Vendor product: SIMATIC ET 200SP CPU 1510SP F-1 PN
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept an…
cve-program ·
Vendor product: Industrial Edge App Publisher
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configurati…
cve-program ·
Vendor product: RUGGEDCOM CROSSBOW
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privil…
cve-program ·
Vendor product: RUGGEDCOM CROSSBOW
TYPO3 CMS - Security Misconfiguration in Form Framework
cve-program ·
https://packagist.org: typo3/cms-form
MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal
cve-program ·
Vendor product: Composer
PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect
cve-program ·
Vendor product: PublicCMS
IBM WebSphere Application Server Liberty Path Traversal
cve-program ·
Vendor product: WebSphere Application Server - Liberty
IBM WebSphere Application Server Liberty is affected by an improper access control
cve-program ·
Vendor product: WebSphere Application Server - Liberty
IBM WebSphere Application Server Liberty Denial of Service
cve-program ·
Vendor product: WebSphere Application Server - Liberty
LASzip through 3.5.0 Invalid Free via Truncated VLR Header in laszip_read_header
cve-program ·
https://github.com: LASzip
BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive
cve-program ·
https://github.com/BizSpringSource/bizspring-shop-opensource: BizSpring Shop · https://github.com/bizspring-open/BizSpring-Java-Mall: BizSpring Java Mall
SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API
cve-program ·
Vendor product: SmsForwarder
Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
cve-program ·
https://github.com/papermerge/papermerge-core: papermerge-core
Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment
cve-program ·
https://github.com: kan
doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path
cve-program ·
https://www.npmjs.com/package/doc-recog: doc-recog
transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath
cve-program ·
https://registry.npmjs.org: transcribe2texts
@offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names
cve-program ·
https://www.npmjs.com: compress-fonts
Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718
cve-program ·
Vendor product: XPress-DR · Vendor product: XPress-DR-I
Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access
cve-program ·
https://github.com/ModelEngine-Group/nexent: nexent
FreeRDP before 3.32.0 Unbounded Memory Retention via RDPDR Proxy
cve-program ·
Vendor product: FreeRDP
FreeRDP shadow before 3.32.0 Pre-Authentication Input Injection via Confirm Active bypass
cve-program ·
Vendor product: FreeRDP
n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
cve-program ·
Vendor product: n8n
n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
cve-program ·
Vendor product: n8n
n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
cve-program ·
Vendor product: n8n
GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
cve-program ·
Vendor product: GitPython
Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
cve-program ·
Vendor product: sso
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
cve-program ·
Vendor product: renovate · Vendor product: renovate-ce · Vendor product: renovate-ee-server
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.