Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698686 source statements · aliases may refer to the same vulnerabilityKrayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field
cve-program ·
Vendor product: laravel-crm
X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
cve-program ·
Vendor product: X-SpringBoot
TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
cve-program ·
https://github.com/TDuckCloud/tduck-survey-form: tduck-survey-form
pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization
cve-program ·
Vendor product: pointcloud
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tamper…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signature verification to be bypassed under memory pressure. A successful exploit of thi…
cve-program ·
Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-bounds read. Successful exploitation of this issue could lead to denial of service and information disclo…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver to dereference an untrusted pointer. A successful exploit of this vulnerability might lead to denial …
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability mi…
cve-program ·
Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel module where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escala…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerabi…
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
cve-program ·
Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vul…
cve-program ·
Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS
Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened t…
cve-program ·
Vendor product: handlebars.java
Use-after-free in the DOM: UI Events & Focus Handling component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Denial-of-service in the Storage: StorageManager component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Use-after-free in the JavaScript Engine: JIT component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Privilege escalation in the Places component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Use-after-free in the CSS Parsing and Computation component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Incorrect boundary conditions in the JavaScript Engine: JIT component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Denial-of-service in the Graphics component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Uninitialized memory in the Graphics: WebGPU component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Sandbox escape due to use-after-free in the Disability Access APIs component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Use-after-free in the JavaScript: WebAssembly component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Privilege escalation in the Address Bar component
cve-program ·
Vendor product: Thunderbird · Vendor product: Firefox
Sandbox escape due to incorrect boundary conditions in the XPCOM component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Sandbox escape due to use-after-free in the Widget: Gtk component
cve-program ·
Vendor product: Thunderbird · Vendor product: Firefox
Sandbox escape due to use-after-free in the DOM: Core & HTML component
cve-program ·
Vendor product: Thunderbird · Vendor product: Firefox
Privilege escalation in the DOM: Service Workers component
cve-program ·
Vendor product: Thunderbird · Vendor product: Firefox
Privilege escalation due to use-after-free in the Graphics: WebRender component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
Information disclosure in the Networking component
cve-program ·
Vendor product: Thunderbird · Vendor product: Firefox
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.