Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
697868 source statements · aliases may refer to the same vulnerabilityMalicious code in asepxyz-baileys (npm)
osv · GHSA-xv7g-p6pq-vg9q
npm: asepxyz-baileys
Malicious code in razamodsxasepxyz (npm)
osv · GHSA-f3vq-wx4x-jv6w
npm: razamodsxasepxyz
Malicious code in asepxyzxrazamodsnew-baileys (npm)
osv · GHSA-v95p-rhxh-mm8g
npm: asepxyzxrazamodsnew-baileys
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
cve-program ·
Vendor product: User Private Files
SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)
cve-program ·
Vendor product: sumatrapdf
Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB
cve-program ·
Vendor product: Tapo C325WB v2
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
cve-program ·
Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
cve-program ·
Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim
WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability
cve-program ·
https://wordpress.org/plugins: mainwp-child
msgpack5: Reserved byte can cause unbounded stream buffering
cve-program ·
Vendor product: msgpack5
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
cve-program ·
Vendor product: generator-jhipster
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
cve-program ·
Vendor product: svg-sanitizer
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
cve-program ·
Vendor product: amqp091-go
IBM Guardium Data Protection Signature Verification Bypass
cve-program ·
Vendor product: Guardium Data Protection
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
cve-program ·
Vendor product: music-metadata
Indico: Cross-Site-Scripting in link fields
cve-program ·
Vendor product: indico
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
cve-program ·
Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
cve-program ·
Vendor product: banks
fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)
cve-program ·
Vendor product: fast-jwt
Hazelcast: Arbitrary member memory access by low-privileged client
cve-program ·
Vendor product: hazelcast
SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service
cve-program ·
Vendor product: sumatrapdf
SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata
cve-program ·
Vendor product: sumatrapdf
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
cve-program ·
Vendor product: Ocean Pro Demos · Vendor product: Ocean eComm Treasure Box
WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability
cve-program ·
https://wordpress.org/plugins: give
WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: wp-user-avatar
WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: wplms
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: vikbooking
WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: jnews-pay-writer
WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: usc-e-shop
WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: blockstrap-page-builder-blocks
WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: classified-listing
WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: kubio
WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: traveler
WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: asgaros-forum
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: jetpack
WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
cve-program ·
https://themeforest.net: ogency
WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability
cve-program ·
https://themeforest.net: education
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
cve-program ·
Vendor product: nginx-ui
Mechanize sends credential headers to a different scheme or port after a redirect
cve-program ·
Vendor product: mechanize
SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read
cve-program ·
Vendor product: sumatrapdf
Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection
cve-program ·
https://wordpress.org/plugins: Kirki
Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
cve-program ·
https://wordpress.org/plugins: Kirki
Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter
cve-program ·
https://wordpress.org/plugins: Testimonials by BestWebSoft
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.