Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698185 source statements · aliases may refer to the same vulnerabilityHybrid Encapsulation from Seed Panics on Short Seed
osv ·
crates.io: libcrux-kem
Auto-Reseeding HMAC-DRBG could panic for some output lengths
osv ·
crates.io: libcrux-hmac-drbg
WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability
cve-program ·
https://wordpress.org/plugins: buddyforms
WordPress BuddyForms plugin <= 2.10.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: buddyforms
WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.5 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: woocommerce-catalog-enquiry
WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: social-rocket
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: easy-digital-downloads
WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: optimole-wp
WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: if-so
KVM: x86/mmu: Check write tracking in all address spaces
cve-program ·
Vendor product: Linux · Vendor product: Linux
Malicious code in e2e-test-utils (npm)
osv · GHSA-cjp6-4vw5-fw77 · SNYK-JS-E2ETESTUTILS-13351072
npm: e2e-test-utils
Malicious code in windows_registry_editor (npm)
osv ·
npm: windows_registry_editor
Malicious code in eslint-config-support (npm)
osv · GHSA-r4rc-r99x-p8cp
npm: eslint-config-support
PhonePe App SQLite Database databases cleartext storage in file
cve-program ·
Vendor product: PhonePe App
Mechrevo Control Center GX V2 reg File uncontrolled search path
cve-program ·
Vendor product: Control Center GX V2
Mechrevo Control Center GX V2 Powershell Script Command uncontrolled search path
cve-program ·
Vendor product: Control Center GX V2
Malicious code in checkmate-remediation-assistant (npm)
osv ·
npm: checkmate-remediation-assistant
Rubygem-katello: improper authorization logic allows resource enumeration
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: rubygem-katello · https://access.redhat.com/downloads/content/package-browser/: rubygem-katello · https://access.redhat.com/downloads/content/package-browser/: rubygem-katello
Foreman: ssti and insecure deserialization in foreman-rake configuration
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: foreman · https://access.redhat.com/downloads/content/package-browser/: foreman · https://access.redhat.com/downloads/content/package-browser/: foreman
Apache log4net: NUL character truncates EventLogAppender records
cve-program ·
NuGet: log4net · NuGet: log4net
Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.bcel:bcel
Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secur…
cve-program ·
Vendor product: Chrome
Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security seve…
cve-program ·
Vendor product: Chrome
Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium s…
cve-program ·
Vendor product: Chrome
Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium sec…
cve-program ·
Vendor product: Chrome
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.