CVE-2026-100111Published
Photoshop Desktop | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695688 source statements · aliases may refer to the same vulnerabilityCVE-2026-95639Published
Photoshop Desktop | Incorrect Authorization (CWE-863)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-97312Published
Photoshop Desktop | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-95637Published
Photoshop Desktop | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-104346Published
Photoshop Desktop | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-96523Published
Photoshop Desktop | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-95638Published
Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-95635Published
Photoshop Desktop | Double Free (CWE-415)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-83661Published
Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-96522Published
Photoshop Desktop | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-96521Published
Photoshop Desktop | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-103821Published
Substance3D - Designer | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-100127Published
Bridge | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Adobe Bridge · Vendor product: Adobe Bridge
CVE-2026-100129Published
Bridge | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Adobe Bridge · Vendor product: Adobe Bridge
CVE-2026-100128Published
Bridge | Out-of-bounds Write (CWE-787)
cve-program ·
Vendor product: Adobe Bridge · Vendor product: Adobe Bridge
CVE-2021-22922Published
When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of differe…
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2021-22901Published
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances t…
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2021-22898Published
curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for …
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2021-22897Published
curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single…
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2021-22890Published
curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS 1.3 session tickets. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets ar…
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2026-76154Published
CVE-2026-76154 CVE Record
cve-program ·
Vendor product: Grafana OSS · Vendor product: Grafana Enterprise
CVE-2021-22876Published
curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when aut…
cve-program ·
Vendor product: https://github.com/curl/curl
CVE-2021-20305Published
A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scal…
cve-program ·
Vendor product: nettle
CVE-2021-20232Published
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.
cve-program ·
Vendor product: gnutls
CVE-2021-20231Published
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.
cve-program ·
Vendor product: gnutls
CVE-2021-20227Published
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering …
cve-program ·
Vendor product: sqlite
CVE-2021-4209Published
A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare cir…
cve-program ·
Vendor product: GnuTLS
CVE-2021-4189Published
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a …
cve-program ·
Vendor product: python
CVE-2021-4122Published
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user …
cve-program ·
Vendor product: cryptsetup
CVE-2021-4090Published
An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege ma…
cve-program ·
https://git.kernel.org/pub/scm/linux/kernel: kernel
CVE-2021-4037Published
Kernel: security regression for cve-2018-13405
cve-program ·
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/: kernel · https://access.redhat.com/downloads/content/package-browser/: kernel-rt · https://access.redhat.com/downloads/content/package-browser/: kernel
CVE-2021-3759Published
A memory overflow vulnerability was found in the Linux kernel’s ipc functionality of the memcg subsystem, in the way a user calls the semget function multiple times, creating semaphores. This flaw allows a local user to starve the resources…
cve-program ·
Vendor product: kernel
CVE-2021-3737Published
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest t…
cve-program ·
Vendor product: python
CVE-2021-3733Published
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authen…
cve-program ·
Vendor product: python
CVE-2021-3541Published
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
cve-program ·
Vendor product: libxml2
CVE-2021-3537Published
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the …
cve-program ·
Vendor product: libxml2
CVE-2021-3518Published
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentia…
cve-program ·
Vendor product: libxml2
CVE-2021-3517Published
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigge…
cve-program ·
Vendor product: libxml2
CVE-2021-3516Published
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, an…
cve-program ·
Vendor product: libxml2
CVE-2021-3426Published
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to t…
cve-program ·
Vendor product: python
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.