Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698750 source statements · aliases may refer to the same vulnerabilityUninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: …
cve-program ·
Vendor product: Chrome
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: …
cve-program ·
Vendor product: Chrome
Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity…
cve-program ·
Vendor product: Chrome
Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
cve-program ·
Vendor product: org.apache.karaf:org.apache.karaf.instance.core
DataStage on Cloud Pak for Data has several vulnerabilities
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
IBM Guardium Data Protection is affected by multiple vulnerabilities.
cve-program ·
Vendor product: Guardium Data Protection
Use of Hard-coded Credentials in Viidure Dashcam Android Application
cve-program ·
Vendor product: Dashcam Android Application
Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application
cve-program ·
Vendor product: Dashcam Android Application
Use of Weak Credentials in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Active debug code in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
cve-program ·
Vendor product: YSSD-RTMP-H5
Uncaught exception in Baicells Nova 430H
cve-program ·
Vendor product: Nova 430H eNodeB (model pBS3101SH)
NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and retur…
cve-program ·
Vendor product: NetX Duo
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. By then the TCP layer owns the packet chain and may already have released it to the packet pool. The …
cve-program ·
Vendor product: NetX Duo
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
cve-program ·
Vendor product: ADC · Vendor product: Gateway
mcp-chrome-bridge through 1.0.31 CORS Origin Bypass
cve-program ·
Vendor product: mcp-chrome-bridge
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api
Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api
Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.ws.xmlschema:xmlschema-walker
Apache XMLSchema: Denial of service through deeply nested schema structures
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.ws.xmlschema:xmlschema-core
Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.ws.xmlschema:xmlschema-core
Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs
cve-program ·
https://pypi.python.org: apache-airflow-providers-teradata
Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
cve-program ·
https://pypi.python.org: apache-airflow-providers-google
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
cve-program ·
Vendor product: jupyterlab · Vendor product: jupyterlite-core
risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
cve-program ·
Vendor product: WorkFlow-Engine
simple-git allows command execution through unblocked Git configuration includes
cve-program ·
Vendor product: git-js
Marmite through 0.4.2 Path Traversal via Development Server
cve-program ·
Vendor product: marmite
OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
cve-program ·
Vendor product: OpenClaw
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
cve-program ·
Vendor product: russh
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.