Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694815 source statements · aliases may refer to the same vulnerabilityThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
net: ip/tcp: Null pointer dereference can be triggered by a race condition
cve-program ·
Vendor product: Zephyr
Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.
cve-program ·
Vendor product: Zephyr
ptp: Potential Denial of Service via PTP Interval Shift
cve-program ·
Vendor product: Zephyr
can: Local Denial of Service via SocketCAN Send
cve-program ·
Vendor product: Zephyr
bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
cve-program ·
Vendor product: Zephyr
Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
cve-program ·
Vendor product: Zephyr
net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function
cve-program ·
Vendor product: Zephyr
stm32: usb: Infinite while loop in Interrupt Handler
cve-program ·
Vendor product: Zephyr
net: Stack Overflow with Ping (to own IP Address) via Shell
cve-program ·
Vendor product: Zephyr
net: eswifi socket send payload length not bounded
cve-program ·
Vendor product: Zephyr
dns: memory‑safety issue in the DNS name parser
cve-program ·
Vendor product: Zephyr
net: TLS 1.2 connections allowed on TLS 1.3 sockets
cve-program ·
Vendor product: Zephyr
AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets
cve-program ·
Vendor product: Zephyr
Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
DoS (hard fault) in NXP LPUART driver: unsupported runtime UART config leaves clocks disabled
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
Shared reassembly buffer in Bluetooth BAP Broadcast Assistant enables cross-connection memory corruption
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
Use-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellation
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
crypto: ATAES132A response length allows stack buffer overflow
cve-program ·
Vendor product: Zephyr
io_uring/zctx: check chained notif contexts
cve-program ·
Vendor product: Linux · Vendor product: Linux
x86/CPU/AMD: Add RDSEED fix for Zen5
cve-program ·
Vendor product: Linux · Vendor product: Linux
Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
cve-program ·
Vendor product: Linux · Vendor product: Linux
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
cve-program ·
Vendor product: Linux · Vendor product: Linux
libceph: replace BUG_ON with bounds check for map->max_osd
cve-program ·
Vendor product: Linux · Vendor product: Linux
nvme: fix admin request_queue lifetime
cve-program ·
Vendor product: Linux · Vendor product: Linux
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
cve-program ·
Vendor product: Linux · Vendor product: Linux
smb: client: fix incomplete backport in cfids_invalidation_worker()
cve-program ·
Vendor product: Linux · Vendor product: Linux
nvme-multipath: fix lockdep WARN due to partition scan work
cve-program ·
Vendor product: Linux · Vendor product: Linux
ice: fix PTP cleanup on driver removal in error path
cve-program ·
Vendor product: Linux · Vendor product: Linux
bpf: account for current allocated stack depth in widen_imprecise_scalars()
cve-program ·
Vendor product: Linux · Vendor product: Linux
drm/xe/guc: Synchronize Dead CT worker with unbind
cve-program ·
Vendor product: Linux · Vendor product: Linux
netfilter: nft_ct: add seqadj extension for natted connections
cve-program ·
Vendor product: Linux · Vendor product: Linux
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
cve-program ·
Vendor product: Linux · Vendor product: Linux
wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()
cve-program ·
Vendor product: Linux · Vendor product: Linux
drm/radeon: Remove calls to drm_put_dev()
cve-program ·
Vendor product: Linux · Vendor product: Linux
x86/fpu: Ensure XFD state on signal delivery
cve-program ·
Vendor product: Linux · Vendor product: Linux
drm/radeon: Do not kfree() devres managed rdev
cve-program ·
Vendor product: Linux · Vendor product: Linux
ceph: fix multifs mds auth caps issue
cve-program ·
Vendor product: Linux · Vendor product: Linux
ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
cve-program ·
Vendor product: Linux · Vendor product: Linux
nvmet-fc: avoid scheduling association deletion twice
cve-program ·
Vendor product: Linux · Vendor product: Linux
drm/gpusvm: fix hmm_pfn_to_map_order() usage
cve-program ·
Vendor product: Linux · Vendor product: Linux
NFSD: Fix crash in nfsd4_read_release()
cve-program ·
Vendor product: Linux · Vendor product: Linux
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.