Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695690 source statements · aliases may refer to the same vulnerabilityPrivasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session
cve-program ·
Vendor product: rustls
Aegisub executes arbitrary code through automatically loaded Automation scripts
cve-program ·
Vendor product: Aegisub
Tina: Code injection via unescaped Git branch name in generated client source
cve-program ·
Vendor product: tinacms · Vendor product: cli
Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)
cve-program ·
Vendor product: Jexactyl
Contao: Path traversal in the images controller
cve-program ·
Vendor product: contao
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service
cve-program ·
Vendor product: ageLANServer
x64dbg-MCP Server exposes debugger operations to unauthenticated network clients
cve-program ·
Vendor product: x64dbg-mcp-server
OWASP Coraza WAF: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations
cve-program ·
Vendor product: coraza
MariaDB: environment injection via wsrep bootstrap in the mariadb.service file
cve-program ·
Vendor product: server
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
cve-program ·
Vendor product: pyload
LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json
cve-program ·
Vendor product: LobsterAI
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
cve-program ·
Vendor product: nginx-ui
MOVO through 0.2.3 Authorization Bypass via Document Endpoints
cve-program ·
https://github.com/himovo/movo: MOVO
A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.
cve-program ·
Vendor product: EdgeMAX EdgeSwitch
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
cve-program ·
Vendor product: nginx-ui
PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()
cve-program ·
Vendor product: phpnuxbill
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
cve-program ·
Vendor product: open5gs
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit …
cve-program ·
Vendor product: Secure Connect Gateway (SCG) Policy Manager
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerabil…
cve-program ·
Vendor product: Secure Connect Gateway (SCG) Policy Manager
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested b…
cve-program ·
Vendor product: Backdrop
An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.
cve-program ·
Vendor product: n/a
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the se…
cve-program ·
Vendor product: XG-X VisionTerminal · Vendor product: XG VisionTerminal · Vendor product: LJ Series Terminal-Software
SumatraPDF: Untrusted binary record offset used without lower-bound validation
cve-program ·
Vendor product: sumatrapdf
SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open
cve-program ·
Vendor product: sumatrapdf
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
cve-program ·
Vendor product: strawberry
Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type
cve-program ·
Vendor product: jivejdon
Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
cve-program ·
Vendor product: jivejdon
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
cve-program ·
Vendor product: fast-jwt
AdonisJS: Unencoded route parameters can produce open redirects
cve-program ·
Vendor product: http-server
Mechanize sends credential headers to another origin after a meta refresh
cve-program ·
Vendor product: mechanize
System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
cve-program ·
https://github.com/winsiderss/systeminformer: System Informer
MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC
cve-program ·
https://github.com/krb5/krb5: krb5
FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
cve-program ·
Vendor product: freescout
TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login
cve-program ·
Vendor product: TVU Receiver / Transceiver
ppt2png through 0.0.6 OS Command Injection via input and output paths
cve-program ·
https://www.npmjs.com/package/ppt2png: ppt2png
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
cve-program ·
Vendor product: mariadb-connector-nodejs
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
cve-program ·
Vendor product: datamodel-code-generator
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publi…
cve-program ·
Vendor product: Mistral
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
cve-program ·
Vendor product: FFmpeg
msgpack5: Partial options disable prototype protection
cve-program ·
Vendor product: msgpack5
msgpack5: Decoding negative int64 values mutates the input buffer
cve-program ·
Vendor product: msgpack5
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
cve-program ·
Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim
Malicious code in @kre64/hello-npm-test (npm)
osv · GHSA-c43r-xf4h-m548
npm: @kre64/hello-npm-test
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer
cve-program ·
Vendor product: FFmpeg
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
cve-program ·
Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.