Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695766 source statements · aliases may refer to the same vulnerabilityInsufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API
cve-program ·
Vendor product: Amazon Bedrock AgentCore harness
Malicious code in some-very-long-package-name (npm)
osv ·
npm: some-very-long-package-name
Malicious code in exodus-firestore-synchronize (npm)
osv ·
npm: exodus-firestore-synchronize
Joyland AI hostname checking disabled
cve-program ·
Vendor product: Joyland.ai
Joyland AI WebView accepts invalid SSL certificates
cve-program ·
Vendor product: Joyland.ai
Cadmos LTI exposure of sensitive information via debug mode
cve-program ·
Vendor product: Cadmos LTI
Newell Brands DYMO ID document parsing failing file type extension authentication check
cve-program ·
Vendor product: DYMO ID
Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control
cve-program ·
Vendor product: DYMO ID
Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data
cve-program ·
Vendor product: openPDC · Vendor product: openPDC (Docker image) · Vendor product: openHistorian
Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function
cve-program ·
Vendor product: openPDC · Vendor product: openPDC (Docker image) · Vendor product: openHistorian
Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function
cve-program ·
Vendor product: openPDC · Vendor product: openPDC (Docker image) · Vendor product: openHistorian
Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
cve-program ·
Vendor product: openPDC (Docker image)
Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format
cve-program ·
Vendor product: 700 Series
Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
cve-program ·
Vendor product: 700 Series
Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check
cve-program ·
Vendor product: 700 Series
Red Lion Controls N-Tron 700 Series Reachable Assertion
cve-program ·
Vendor product: 700 Series
Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel
cve-program ·
Vendor product: 700 Series
Savannah lwIP SMTP client Classic Buffer Overflow
cve-program ·
Vendor product: lwIP SMTP client
Unauthorized access vulnerability in ZTE Z80 Ultra product
cve-program ·
Vendor product: ZTE Z80 Ultra
Information disclosure vulnerability in ZTE Z80 Ultra product
cve-program ·
Vendor product: Z80 Ultra
Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product
cve-program ·
Vendor product: Z80 Ultra
Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product
cve-program ·
Vendor product: Z80 Ultra
Information disclosure vulnerability in ZTE Z80 Ultra product
cve-program ·
Vendor product: Z80 Ultra
Unauthorized access vulnerability in ZTE Z80 Ultra product
cve-program ·
Vendor product: Z80 Ultra
Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium secu…
cve-program ·
Vendor product: Chrome
Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
cve-program ·
Vendor product: Redux Framework
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
cve-program ·
Vendor product: Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
cve-program ·
Vendor product: Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
cve-program ·
Vendor product: Online Scheduling and Appointment Booking System – Bookly
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
cve-program ·
Vendor product: Advanced Form Integration — Connect Forms to 300+ Apps
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
cve-program ·
Vendor product: Blocksy Companion
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.