Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694793 source statements · aliases may refer to the same vulnerabilitypupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
cve-program ·
Vendor product: pupnp
Improper Input Validation in Kernel APsys DVFS
cve-program ·
Vendor product: kernel
SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form
cve-program ·
Vendor product: sendportal-core
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.
cve-program ·
Vendor product: rlottie
cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints
cve-program ·
Vendor product: cool-admin-midway
Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
cve-program ·
Vendor product: NetBackup Administration Console web interface
FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
cve-program ·
Vendor product: FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
Interuse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
cve-program ·
Vendor product: i-Bos
Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
cve-program ·
Vendor product: Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting
cve-program ·
Vendor product: InstaWP Connect – 1-click WP Staging & Migration
NULL pointer dereference in the ESP32 I2S driver when triggering an unsupported direction
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State
cve-program ·
Vendor product: miniOrange OTP Login, Verification and SMS Notifications
Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}
cve-program ·
Vendor product: Simply Schedule Appointments
Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter
cve-program ·
Vendor product: Tainacan
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list
cve-program ·
https://cpan.org/modules: ExtUtils-Typemaps-Default
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
cve-program ·
https://cpan.org/modules: ExtUtils-Typemaps-Default
Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch
cve-program ·
https://github.com: apache/datasketches-cpp
Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents
cve-program ·
Vendor product: Endpoint Investigator · Vendor product: Endpoint Forensics & Response · Vendor product: Information Assurance
Denial of Service in Okta RADIUS Agent Packet Parser
cve-program ·
Vendor product: Okta RADIUS Agent
Out-of-Range Timestamp Claim Handling in auth0/java-jwt
cve-program ·
Vendor product: java-jwt
IKEv2 Use-After-Free bug when using IKE-over-TCP
cve-program ·
https://github.com/libreswan/libreswan: libreswan
Denial of Service via sending bogus X.509 certificates
cve-program ·
https://github.com/libreswan/libreswan: libreswan
IKEv2 pre-authentication Null Pointer Dereference in EAP code
cve-program ·
https://github.com/libreswan/libreswan: libreswan
Null Pointer Dereference in PKCS#7 bundle with no certificates
cve-program ·
https://github.com/libreswan/libreswan: libreswan
TEAMPLUS TECHNOLOGY|TeamPlus Messenger - Code Injection
cve-program ·
Vendor product: TeamPlus Messenger
TEAMPLUS TECHNOLOGY|TeamPlus Messenger - Code Injection
cve-program ·
Vendor product: TeamPlus Messenger
NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution
cve-program ·
https://pkg.go.dev: github.com/netbirdio/netbird
WisdomGarden|Tronclass - Insecure Direct Object Reference
cve-program ·
Vendor product: Tronclass
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TL…
cve-program ·
Vendor product: OpenVPN
MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages
cve-program ·
Vendor product: MOVEit Transfer
Account pre-hijacking in the Prowler API through email based social account linking without verification
cve-program ·
Vendor product: Prowler
Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution
cve-program ·
Vendor product: Zimbra Collaboration Suite
Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate Limiting
cve-program ·
Vendor product: Zimbra Collaboration Suite
Cleartext Transmission of Sensitive Information in ADP Desktop SDK
cve-program ·
Vendor product: ADP Desktop SDK
Junos OS and Junos OS Evolved: An attacker causes an rpd crash when inter-AS MVPN ingress replication is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: Malformed MC-LAG ICCP message causes l2ald heap disclosure or crash
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: A routing-policy table reference causes routing-daemon denial of service when source-based forwarding is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: An attacker causes a routing protocol daemon denial of service when EVPN is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: An attacker causes routing daemon denial of service when EVPN BGP is enabled
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used
cve-program ·
Vendor product: Junos OS · Vendor product: Junos OS Evolved
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.