Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698276 source statements · aliases may refer to the same vulnerabilityvm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
osv · CVE-2026-100723
npm: vm2
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
osv · CVE-2026-103921
npm: @graphql-tools/executor-legacy-ws
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
osv · CVE-2026-104852
npm: @graphql-tools/utils
Duplicate Advisory: Sensitive information written to logs by Snowflake drivers
osv ·
npm: snowflake-sdk
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
osv · CVE-2026-104182
npm: stream-json
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
osv · CVE-2026-92953
npm: vm2
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
osv · CVE-2026-82662
npm: nodemailer
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
osv · CVE-2026-103922
npm: @capacitor/android · npm: @capacitor/android · npm: @capacitor/ios
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
osv ·
npm: fast-copy · npm: fast-copy · npm: fast-copy
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
osv ·
npm: @vue/server-renderer · npm: @vue/server-renderer
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
osv · CVE-2026-92954
npm: vm2
Tinypool: Prototype Pollution Gadget to RCE in run() options
osv · CVE-2026-104849
npm: tinypool
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
osv · CVE-2026-104872
npm: @opentelemetry/instrumentation-cassandra-driver · npm: @opentelemetry/instrumentation-tedious · npm: @opentelemetry/instrumentation-oracledb
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
osv · CVE-2026-104848
npm: tinypool
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
osv · CVE-2026-104183
npm: stream-json
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
osv · CVE-2026-93657
crates.io: hickory-resolver
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
osv · CVE-2026-104871
npm: @angular/ssr · npm: @angular/ssr · npm: @angular/ssr
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
osv · CVE-2026-92959
npm: vm2
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
osv · CVE-2026-92933
npm: vm2
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
osv · CVE-2026-92934
npm: vm2
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
osv · CVE-2026-92936
npm: vm2
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
osv · CVE-2026-92947
npm: vm2
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.