Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698260 source statements · aliases may refer to the same vulnerabilityapko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root
cve-program ·
https://pkg.go.dev: chainguard.dev/apko
lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode
cve-program ·
Vendor product: lrzsz
Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
cve-program ·
Vendor product: langflow · Vendor product: langflow-base
HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates
cve-program ·
Vendor product: ThinPro 8.1 · Vendor product: ThinPro 9
dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection
cve-program ·
Vendor product: eShop
Docling: Configured HTTP headers sent to every remote image host named by a document
cve-program ·
Vendor product: docling · Vendor product: docling-slim
openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)
cve-program ·
Vendor product: openSIS-Classic
Privilege abuse in model formsets with editable primary keys
cve-program ·
https://pypi.org/project/Django/: django
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result i…
cve-program ·
Vendor product: Alveo™ Accelerator Cards · Vendor product: Versal™ Prime Series Adaptive SoCs · Vendor product: Versal™ Premium Series Adaptive SoCs
Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory,…
cve-program ·
Vendor product: Zynq™ UltraScale+ MPSoCs · Vendor product: Zynq™ UltraScale+ RFSoCs · Vendor product: Kria SOMs
Crafted Git build source can bypass certain policy validation
cve-program ·
Vendor product: github.com/moby/buildkit
Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
cve-program ·
Vendor product: penpot
Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
cve-program ·
Vendor product: penpot
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
osv · CVE-2026-102422
npm: shell-quote
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
osv · CVE-2026-102414
npm: pbkdf2
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
cve-program ·
Vendor product: scrapy
Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP
cve-program ·
Vendor product: Chainguard Academy (edu)
Ghost: Server-Side Request Forgery in Webhook Trigger
cve-program ·
Vendor product: Ghost
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
cve-program ·
https://repo.hex.pm: ash · https://github.com: ash-project/ash
Ghost: Remote Code Execution via Theme Translation Files
cve-program ·
Vendor product: Ghost
feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index sql injection
cve-program ·
Vendor product: feelcrm-os
Ghost: Stored XSS via oEmbed Photo Responses
cve-program ·
Vendor product: Ghost
Photoview through 2.4.0 SQL Injection via album download route
cve-program ·
Vendor product: Photoview
ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php
cve-program ·
Vendor product: clipbucket-v5
ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
cve-program ·
https://github.com/MacWarrior/clipbucket-v5: clipbucket-v5
Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanel
cve-program ·
Vendor product: Aureus ERP
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
cve-program ·
Vendor product: Aureus ERP
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
cve-program ·
https://packagist.org: Aureus ERP
QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
cve-program ·
Vendor product: QloApps
QloApps through 1.7.0 Reflected XSS via List Filter Parameters
cve-program ·
Vendor product: QloApps
ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter
cve-program ·
Vendor product: clipbucket-v5
QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
cve-program ·
Vendor product: QloApps
QloApps through 1.7.0 Reflected XSS via Room Type Editor
cve-program ·
Vendor product: QloApps
QloApps through 1.7.0 Reflected XSS via exceptions field
cve-program ·
Vendor product: QloApps
QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
cve-program ·
Vendor product: QloApps
ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
cve-program ·
Vendor product: clipbucket-v5
ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
cve-program ·
Vendor product: clipbucket-v5
ZoneMinder before 1.38.4 Incorrect Authorization in frames API index
cve-program ·
https://github.com/ZoneMinder/zoneminder: zoneminder
ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
cve-program ·
https://github.com/ZoneMinder/zoneminder: zoneminder
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
cve-program ·
https://packagist.org: sylius/sylius
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
cve-program ·
https://packagist.org: sylius/sylius
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
cve-program ·
https://packagist.org: sylius/sylius
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
cve-program ·
https://packagist.org: sylius/sylius
ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php
cve-program ·
Vendor product: clipbucket-v5
UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent
cve-program ·
Vendor product: core-framework · Vendor product: community-skeleton
UVdesk core-framework before 1.1.7 Authorization Bypass via Saved Reply
cve-program ·
Vendor product: core-framework · Vendor product: community-skeleton
UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer
cve-program ·
Vendor product: core-framework · Vendor product: community-skeleton
ZoneMinder 1.37.x Path Traversal via files view
cve-program ·
https://github.com/ZoneMinder/zoneminder: zoneminder
Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
cve-program ·
Vendor product: Mongodb Controllers for Kubernetes
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.