Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695826 source statements · aliases may refer to the same vulnerabilityfast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
osv · CVE-2026-107720
npm: fast-jwt
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
osv · CVE-2026-107723
npm: fast-jwt
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
osv · CVE-2026-107722
npm: fast-jwt
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
osv · CVE-2026-107721
npm: fast-jwt
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
osv · CVE-2026-61426
npm: praisonai
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
osv · CVE-2026-107724
npm: fast-jwt
Bypass of the secureValidation property
cve-program ·
Vendor product: Apache Santuario
Improper Privilege Management in shelljs/shelljs
cve-program ·
Vendor product: shelljs/shelljs
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
cve-program ·
Vendor product: n/a
Local privilege escalation through system temporary directory
cve-program ·
Vendor product: gradle
Panic when decoding Float and Rat types in math/big
cve-program ·
https://pkg.go.dev: math/big
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions …
cve-program ·
Vendor product: BIG-IP APM · Vendor product: BIG-IP APM Clients
Information disclosure through temporary directory permissions
cve-program ·
Vendor product: gradle
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover…
cve-program ·
Vendor product: RSA BSAFE Crypto-J
Arbitrary code execution via specially crafted environment variables
cve-program ·
Vendor product: gradle
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
cve-program ·
Vendor product: n/a
Dependency cache path traversal in Gradle
cve-program ·
Vendor product: gradle
postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow the same ACLs than pg_rorate_logfile. If the adminpack is added to a database, an attacker able to c…
cve-program ·
Vendor product: postgresql
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS atta…
cve-program ·
https://hibernate.org/validator/: hibernate-validator
Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations
cve-program ·
Vendor product: gradle
.NET Denial of Service Vulnerability
cve-program ·
Vendor product: Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) · Vendor product: Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) · Vendor product: Microsoft Visual Studio 2022 version 17.0
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.