Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695749 source statements · aliases may refer to the same vulnerabilityA vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions < V3.92), blueplanet 105 TL3 GEN2 (All versions), blueplanet 110 TL3 (All versions < V3.92…
cve-program ·
Vendor product: blueplanet 100 NX3 M8 · Vendor product: blueplanet 100 TL3 GEN2 · Vendor product: blueplanet 105 TL3
A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions < V3.92), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 110 TL3…
cve-program ·
Vendor product: blueplanet 100 NX3 M8 · Vendor product: blueplanet 100 TL3 GEN2 · Vendor product: blueplanet 105 TL3
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230RCEo…
cve-program ·
Vendor product: LOGO! 12/24RCE · Vendor product: LOGO! 12/24RCEo · Vendor product: LOGO! 230RCE
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230RCEo…
cve-program ·
Vendor product: LOGO! 12/24RCE · Vendor product: LOGO! 12/24RCEo · Vendor product: LOGO! 230RCE
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230RCEo…
cve-program ·
Vendor product: LOGO! 12/24RCE · Vendor product: LOGO! 12/24RCEo · Vendor product: LOGO! 230RCE
A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions < V18 Update 6), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP …
cve-program ·
Vendor product: SIMATIC S7-PLCSIM V17 · Vendor product: SIMATIC STEP 7 V17 · Vendor product: SIMATIC STEP 7 V18
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.
cve-program ·
Vendor product: Automation License Manager V6.0 · Vendor product: Automation License Manager V6.2 · Vendor product: CEMAT V10.0
A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions < V6.0 SP1 Update 1), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions…
cve-program ·
Vendor product: SIMATIC PCS neo V4.1 · Vendor product: SIMATIC PCS neo V5.0 · Vendor product: SIMATIC PCS neo V6.0
A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC S7-PLCSIM V18 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 9), SIMATIC STEP 7 Safety V18 (All versions < V18 Update 6), SIMATIC STE…
cve-program ·
Vendor product: SIMATIC S7-PLCSIM V17 · Vendor product: SIMATIC S7-PLCSIM V18 · Vendor product: SIMATIC STEP 7 Safety V17
A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (All versions), SIMATIC STEP 7 Safety V17 (All versions < V17 Update 9), SIMATIC STEP 7 Safety V18 …
cve-program ·
Vendor product: SIMATIC S7-PLCSIM V16 · Vendor product: SIMATIC S7-PLCSIM V17 · Vendor product: SIMATIC STEP 7 Safety V16
Ghost: Server-Side Request Forgery in Bookmark Fetching
osv · BIT-ghost-2026-105647 · CVE-2026-105647
npm: ghost
Ghost: Remote Code Execution via Theme Translation Files
osv · BIT-ghost-2026-104418 · BIT-ghost-2026-105677 · CVE-2026-104418 · CVE-2026-105677
npm: ghost
Ghost: Stored XSS via Bookmark Card Images
osv · BIT-ghost-2026-104413 · BIT-ghost-2026-105651 · CVE-2026-104413 · CVE-2026-105651
npm: ghost
Ghost: Stored XSS via oEmbed Photo Responses
osv · BIT-ghost-2026-104414 · BIT-ghost-2026-105650 · CVE-2026-104414 · CVE-2026-105650
npm: ghost
Ghost: Editors Could Promote Staff Users to Their Own Role
osv · BIT-ghost-2026-104412 · BIT-ghost-2026-105678 · CVE-2026-104412 · CVE-2026-105678
npm: ghost
Ghost: Regular Expression Denial of Service in External Media Inliner
osv · BIT-ghost-2026-105645 · CVE-2026-105645
npm: ghost
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
osv · BIT-ghost-2026-105648 · CVE-2026-105648
npm: ghost
Ghost: Stored XSS via File Uploads on Local Storage
osv · BIT-ghost-2026-104411 · BIT-ghost-2026-105679 · CVE-2026-104411 · CVE-2026-105679
npm: ghost
Ghost: Invite Token Disclosure in Ghost Admin API
osv · BIT-ghost-2026-104416 · BIT-ghost-2026-105675 · CVE-2026-104416 · CVE-2026-105675
npm: ghost
Ghost: Regular Expression Denial of Service in Content Import
osv · BIT-ghost-2026-105646 · CVE-2026-105646
npm: ghost
Ghost: Server-Side Request Forgery in Webhook Trigger
osv · BIT-ghost-2026-103287 · BIT-ghost-2026-105682 · CVE-2026-103287 · CVE-2026-105682
npm: ghost
Ghost: Password Hash Ordering Disclosure in Ghost Admin API
osv · BIT-ghost-2026-104415 · BIT-ghost-2026-105652 · CVE-2026-104415 · CVE-2026-105652
npm: ghost
Ghost : Stored XSS via SVG Files in Content Imports
osv · BIT-ghost-2026-105644 · CVE-2026-105644
npm: ghost
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
osv · BIT-ghost-2026-105649 · CVE-2026-105649
npm: ghost
Ghost: Remote Code Execution via Bookmark Card Images
osv · BIT-ghost-2026-105642 · CVE-2026-105642
npm: ghost
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
osv · BIT-ghost-2026-103290 · BIT-ghost-2026-105683 · CVE-2026-103290 · CVE-2026-105683
npm: ghost
Ghost: Stored XSS via Embed Card Previews
osv · BIT-ghost-2026-105643 · CVE-2026-105643
npm: ghost
Ghost: Path Traversal via Locale Setting
osv · BIT-ghost-2026-104417 · BIT-ghost-2026-105676 · CVE-2026-104417 · CVE-2026-105676
npm: ghost
Ghost: Authorization Bypass in Comments Feature
osv · BIT-ghost-2026-103289 · BIT-ghost-2026-105681 · CVE-2026-103289 · CVE-2026-105681
npm: ghost
Ghost: Authorization Issue Allowed Author Role to Delete any Post
osv · BIT-ghost-2026-105680 · CVE-2026-105680
npm: ghost
Malicious code in test-account-portal-fe (npm)
osv ·
npm: test-account-portal-fe
Malicious code in @lekzo_dev/amprem (npm)
osv · GHSA-8gjr-vm34-h79m
npm: @lekzo_dev/amprem
Malicious code in @nexustechpro/baileys (npm)
osv · GHSA-8w6v-4xp9-rvrr
npm: @nexustechpro/baileys
Malicious code in @chatunity/baileys (npm)
osv · GHSA-2vxg-pmhf-2c8r
npm: @chatunity/baileys
XSS in ammonia via SVG `animateMotion`, `animateTransform`, and/or `animateColor` tags
osv · GHSA-f2pc-rwv3-69mv
crates.io: ammonia
WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: acymailing
WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: dc-woocommerce-multi-vendor
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.