Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698127 source statements · aliases may refer to the same vulnerabilityGitea Actions memory exhaustion through large static matrices
cve-program ·
Vendor product: gitea.dev
Gitea review and execution mismatch through duplicate tree entries
cve-program ·
Vendor product: gitea.dev
Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentially modify files inside installation folder during application upgrade, leading to privilege escalat…
cve-program ·
Vendor product: Dell Command Configure (DCC)
node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
cve-program ·
Vendor product: node-uuid
Gitea push mirror local path check uses the repository owner
cve-program ·
Vendor product: gitea.dev
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
Gitea push mirror API bypass of DISABLE_NEW_PUSH policy
cve-program ·
Vendor product: gitea.dev
Postgres-exporter: net/http/pprof exposed on metrics listener
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9
Gitea OAuth2 refresh token grant accepts access tokens
cve-program ·
Vendor product: gitea.dev
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
Gitea tag delete route deletes releases without release permission
cve-program ·
Vendor product: gitea.dev
XStream is vulnerable to a Remote Command Execution attack
cve-program ·
Vendor product: xstream
Gitea profile feed disclosure bypassing user visibility
cve-program ·
Vendor product: gitea.dev
Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.
cve-program ·
Vendor product: Samsung Mobile Devices
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling
cve-program ·
Vendor product: xstream
Gitea WebAuthn bypass during OAuth and OIDC sign-in
cve-program ·
Vendor product: gitea.dev
A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.
cve-program ·
Vendor product: Samsung Mobile Devices
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
Incorrect authorization in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medi…
cve-program ·
Vendor product: Chrome
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
XStream is vulnerable to an Arbitrary Code Execution attack
cve-program ·
Vendor product: xstream
Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
cve-program ·
Vendor product: Chrome
Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium se…
cve-program ·
Vendor product: Chrome
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium securit…
cve-program ·
Vendor product: Chrome
Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Mediu…
cve-program ·
Vendor product: Chrome
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
cve-program ·
Vendor product: excelize
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
cve-program ·
Vendor product: excelize
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader
cve-program ·
Vendor product: excelize
SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
cve-program ·
Vendor product: SimpleHelp
WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: post-title-marquee-scroll
WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: wp-post-author
Cisco NX-OS Software Python Sandbox Escape Vulnerability
cve-program ·
Vendor product: Cisco NX-OS Software
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.