Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695978 source statements · aliases may refer to the same vulnerabilityMalicious code in clickfix_npm_delivery (npm)
osv · GHSA-37h8-m54m-784j
npm: clickfix_npm_delivery
Bower decompress-zip has a path traversal vulnerability
cve-program ·
Vendor product: decompress-zip
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api
Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api
Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow)
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api
Command Injection
cve-program ·
Vendor product: Tenable Identity Exposure (SaaS)
Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
cve-program ·
Vendor product: dolibarr
Access of Memory Location Before Start of Buffer in vim/vim
cve-program ·
Vendor product: vim/vim
music-metadata: Uncontrolled memory allocation in APEv2 parser
osv · CVE-2026-107387
npm: music-metadata
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
osv · CVE-2026-107389
npm: music-metadata
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
osv · CVE-2026-107388
npm: music-metadata
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
osv · CVE-2026-107391
npm: music-metadata
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
osv · CVE-2026-107392
npm: music-metadata
Mennekes smart/premium charges systems, Command injection in firmware upgrade
cve-program ·
Vendor product: Smart / Premium charging stations
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
cve-program ·
Vendor product: Zammad
Improper link resolution in asset bundling output handling in aws-cdk-lib
cve-program ·
Vendor product: aws-cdk-lib
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
cve-program ·
Vendor product: music-metadata
IBM Guardium Data Protection Cross-Site Scripting
cve-program ·
Vendor product: Guardium Data Protection
IBM Guardium Data Protection Information Disclosure
cve-program ·
Vendor product: Guardium Data Protection
Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver
cve-program ·
Vendor product: PHP Driver
Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver
cve-program ·
Vendor product: PHP Driver
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked …
cve-program ·
Vendor product: fresh node module
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
cve-program ·
Vendor product: jackson-databind
music-metadata: Uncontrolled memory allocation in APEv2 parser
cve-program ·
Vendor product: music-metadata
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
cve-program ·
Vendor product: Go Driver
Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt
cve-program ·
Vendor product: libmongocrypt
Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
cve-program ·
Vendor product: libmongocrypt
Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
cve-program ·
Vendor product: libmongocrypt
Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts
cve-program ·
Vendor product: Docker Sandboxes
WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: ablocks
Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host
cve-program ·
Vendor product: Docker Sandboxes
Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
cve-program ·
Vendor product: Docker Sandboxes
Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
cve-program ·
Vendor product: C++ Driver
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.