Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695680 source statements · aliases may refer to the same vulnerabilityWukong AICRM through 20260610 Missing Authorization in User and Role Management APIs
cve-program ·
Vendor product: Wukong AICRM
Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: katello · https://access.redhat.com/downloads/content/package-browser/: rubygem-katello
cryptography has incomplete DNS name constraint enforcement on peer names
cve-program ·
Vendor product: cryptography
Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial …
cve-program ·
Vendor product: PowerScale InsightIQ
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
cve-program ·
Vendor product: n/a
HPE NonStop Middleware - Secret key handling vulnerability
cve-program ·
Vendor product: HPE NonStop Middleware
Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping
cve-program ·
Vendor product: Roo-Code
FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
cve-program ·
Vendor product: FFmpeg
dot-access through 1.0.0 Prototype Pollution via set() path argument
cve-program ·
https://www.npmjs.com/package/dot-access: dot-access
Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()
cve-program ·
Vendor product: poppler
Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
cve-program ·
https://github.com/dromara/skyeye: skyeye
Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation
cve-program ·
Vendor product: TSplus Remote Access
Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
cve-program ·
Vendor product: jivejdon
Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed.
cve-program ·
Vendor product: Rakuten Mini · Vendor product: Rakuten Hand · Vendor product: Rakuten Hand 5G
Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
cve-program ·
Vendor product: jivejdon
HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter
cve-program ·
Vendor product: hortusfox-web
Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream
cve-program ·
Vendor product: snappy-java
Improper Multi-Factor Authentication Validation Allows Authentication Bypass
cve-program ·
Vendor product: TSplus Remote Access
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
cve-program ·
https://github.com/ageerle/ruoyi-ai: ruoyi-ai
plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert
cve-program ·
Vendor product: plugNmeet-server
Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access
cve-program ·
Vendor product: TSplus Remote Access
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.
cve-program ·
Vendor product: UniFi Protect AI Key
Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL
cve-program ·
Vendor product: pingvin-share-x
SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing
cve-program ·
Vendor product: SillyTavern
Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
cve-program ·
Vendor product: misskey
SkillHub before 0.2.22 Account Takeover via Account Merge Flow
cve-program ·
Vendor product: skillhub
OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export
cve-program ·
Vendor product: openpanel
argocd-mcp through 0.9.0 Path Traversal via delete_application Tool
cve-program ·
https://www.npmjs.com/package/argocd-mcp: argocd-mcp
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.
cve-program ·
Vendor product: UniFi Protect AI Key
Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
cve-program ·
Vendor product: mealie
Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass
cve-program ·
https://pkg.go.dev: phi
JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint
cve-program ·
Vendor product: JeecgBoot
Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs
cve-program ·
Vendor product: Qt_for_MCUs
JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit
cve-program ·
Vendor product: JeecgBoot
WisdomGarden|Tronclass - Insecure Direct Object Reference
cve-program ·
Vendor product: Tronclass
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus
cve-program ·
Vendor product: JeecgBoot
JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit
cve-program ·
Vendor product: JeecgBoot
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.