Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698419 source statements · aliases may refer to the same vulnerabilityMalicious code in kartykgithub-ph-f (npm)
osv · GHSA-x2m2-w3gv-m5wg
npm: kartykgithub-ph-f
VxWorks 7 improper privilege management
cve-program ·
Vendor product: VxWorks 7
Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration
cve-program ·
Vendor product: TL-WR841N v14
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root pri…
cve-program ·
Vendor product: Router
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalati…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escala…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an array index. A successful exploit of this vulnerability might lead to code executio…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of servic…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability mi…
cve-program ·
Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged user can cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of priv…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial …
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A su…
cve-program ·
Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution…
cve-program ·
Vendor product: RTX, Quadro, NVS · Vendor product: GeForce · Vendor product: GeForce
NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclo…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privile…
cve-program ·
Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS
NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling where an attacker with local access could bypass an authorization check that is intended to restrict certain operations based on client execution …
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from an uncontrolled search path. A successful exploit of this vulnerability might lead to code execution…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible
cve-program ·
Vendor product: IntelliJ IDEA
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
cve-program ·
Vendor product: YouTrack
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; Q…
cve-program ·
Vendor product: QTS · Vendor product: QTS · Vendor product: QTS
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbi…
cve-program ·
Vendor product: Palo Alto Networks GlobalProtect Portal/Gateway Interface
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
cve-program ·
Vendor product: YouTrack
Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow
cve-program ·
Vendor product: HG7 · Vendor product: HG9 · Vendor product: HG10
Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflow
cve-program ·
Vendor product: HG7 · Vendor product: HG9 · Vendor product: HG10
Tenda HG7/HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflow
cve-program ·
Vendor product: HG7 · Vendor product: HG9 · Vendor product: HG10
Malicious code in kartykgithub-ph-e (npm)
osv · GHSA-7hq7-x7ww-7cxr
npm: kartykgithub-ph-e
Malicious code in kartykgithub-ph-b (npm)
osv · GHSA-27m4-jjxc-69wf
npm: kartykgithub-ph-b
The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection
cve-program ·
Vendor product: CPython
Capgo - Two-Factor Authentication Bypass via Organization Management API
cve-program ·
Vendor product: Capgo
Malicious code in homestack-cheer (npm)
osv · GHSA-x567-p88w-3697
npm: homestack-cheer
Malicious code in illusion-datalab (npm)
osv · GHSA-834w-x8gq-8rmx
npm: illusion-datalab
Ultimate POS Stored XSS via First Name Field in Leave Notifications
cve-program ·
Vendor product: Ultimate POS (Stock Management & Point of Sale)
Prime Mover < 2.2.1 Stored XSS via Package Metadata
cve-program ·
Vendor product: Prime Mover
Prime Mover < 2.2.1 Path Traversal via wprime-config.json
cve-program ·
Vendor product: Prime Mover
Prime Mover < 2.2.1 Zip Slip Path Traversal File Write
cve-program ·
Vendor product: Prime Mover
Eclipse Equinox OSGi 3.7.2 Remote Code Execution via Console
cve-program ·
Vendor product: Equinox OSGi
Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution
cve-program ·
Vendor product: Equinox OSGi
Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass
cve-program ·
Vendor product: Anevia Flamingo XL/XS · Vendor product: SoapLive · Vendor product: SoapSystem
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.