Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695929 source statements · aliases may refer to the same vulnerability

CVE-2021-33037Published

Incorrect Transfer-Encoding handling with HTTP/1.0

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2016-0762Published

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a ti…

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-42794Published

Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2016-6797Published

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicit…

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2016-6796Published

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parame…

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2017-7525Published

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method …

cve-program ·

Vendor product: jackson-databind

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-14195Published

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2019-12972Published

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx…

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2016-5018Published

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to w…

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-29885Published

EncryptInterceptor does not provide complete protection on insecure networks

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-34305Published

XSS in examples web application

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-7788Published

Prototype Pollution

cve-program ·

Vendor product: ini

CVSS 3.1 7.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2017-15095Published

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the O…

cve-program ·

Vendor product: jackson-databind

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-25122Published

Apache Tomcat h2c request mix-up

cve-program ·

Vendor product: Apache Tomcat

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2019-14893Published

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type …

cve-program ·

Vendor product: jackson-databind

CVSS 3.0 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-26664Published

A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2019-1551Published

rsaz_512_sqr overflow bug on x86_64

cve-program ·

Vendor product: OpenSSL

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23957Published

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

cve-program ·

Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23956Published

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

cve-program ·

Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23954Published

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

cve-program ·

Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23953Published

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

cve-program ·

Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23955Published

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

cve-program ·

Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2018-1270Published

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging mo…

cve-program ·

Vendor product: Spring Framework

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23958Published

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.

cve-program ·

Vendor product: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2018-5968Published

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two differen…

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2018-16301Published

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the va…

cve-program ·

Vendor product: tcpdump

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-23383Published

Prototype Pollution

cve-program ·

Vendor product: handlebars

CVSS 3.1 5.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23926Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23934Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23924Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-23369Published

Remote Code Execution (RCE)

cve-program ·

Vendor product: handlebars

CVSS 3.1 5.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23930Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23928Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23932Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23929Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23925Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23933Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23931Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-0095Published

Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of service via local access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-23927Published

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.

cve-program ·

Vendor product: HP PC BIOS

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-24486Published

Improper input validation in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2018-0734Published

Timing attack against DSA

cve-program ·

Vendor product: OpenSSL

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-62251Published

Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes the user-supplied `rawquery` field directly to DuckDB without calling the `sqlvalidator.ValidateRawSQL` function used thr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-62252Published

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the password `sipcapture` (st…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2020-8700Published

Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-8670Published

Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-12358Published

Out of bounds write in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via local access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-12357Published

Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-22970Published

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in…

cve-program ·

Vendor product: Spring Framework

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-25317Published

cups: ownership of /var/log/cups allows the lp user to create files as root

cve-program ·

Vendor product: SUSE Linux Enterprise Server 11-SP4-LTSS · Vendor product: SUSE Manager Server 4.0 · Vendor product: SUSE OpenStack Cloud Crowbar 9

CVSS 3.1 3.3Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.