Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698242 source statements · aliases may refer to the same vulnerabilitySecurity Advisory 0188
cve-program ·
Vendor product: CloudVision Portal · Vendor product: CloudVision Sensor
Hydra: Mutable instantiate policy sets allow target blocklist bypass
cve-program ·
Vendor product: hydra
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
cve-program ·
Vendor product: handlebars.js
Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of P…
cve-program ·
Vendor product: Command | Configure (DCC)
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerabi…
cve-program ·
Vendor product: System Update
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
cve-program ·
Vendor product: langchainjs · Vendor product: mongodb
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
cve-program ·
Vendor product: ImageSharp
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
cve-program ·
Vendor product: quasar · Vendor product: app-vite
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
cve-program ·
Vendor product: quasar · Vendor product: icongenie
Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medi…
cve-program ·
Vendor product: Chrome
Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chro…
cve-program ·
Vendor product: Chrome
Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security s…
cve-program ·
Vendor product: Chrome
Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity…
cve-program ·
Vendor product: Chrome
Missing authorization in Media in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Lo…
cve-program ·
Vendor product: Chrome
URI name constraints checked against a mis-parsed host
cve-program ·
https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography
Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix
cve-program ·
https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography
Unbounded PBE iteration count when decrypting PKCS#8 private keys
cve-program ·
https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography
Reflected XSS in Akıllı Ticaret's E-Commerce Pack
cve-program ·
Vendor product: E-Commerce Pack
PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail
cve-program ·
Vendor product: Expert Mail
libmikmod before 3.3.14 Heap Buffer Overflow via DSM Loader Integer Overflow
cve-program ·
Vendor product: libmikmod
lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader() Pathname
cve-program ·
Vendor product: lrzsz
OS Command Injection in Felisify Informatics' SambaBox
cve-program ·
Vendor product: SambaBox
Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
cve-program ·
Vendor product: Mooncake
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Inf…
cve-program ·
Vendor product: Container Storage Modules
Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information tam…
cve-program ·
Vendor product: Container Storage Modules
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
cve-program ·
Vendor product: quasar · Vendor product: app-vite
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
cve-program ·
Vendor product: ImageSharp
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
cve-program ·
Vendor product: WeasyPrint
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
osv · CVE-2026-86540
npm: knowns
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
osv · BIT-prometheus-2026-40179 · CVE-2026-40179 · GO-2026-5662
Go: github.com/prometheus/prometheus · Go: github.com/prometheus/prometheus · Go: github.com/prometheus/prometheus
Duplicate Advisory: knowns vulnerable to command injection
osv ·
npm: knowns
In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation…
cve-program ·
Vendor product: Android
In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed …
cve-program ·
Vendor product: Android
In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not …
cve-program ·
Vendor product: Android
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
cve-program ·
Vendor product: rabbitmq-java-client · Vendor product: amqp-client
cut: -s ignored in -z -d '' newline-delimiter mode
osv · CVE-2026-35381
crates.io: uu_cut
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.