Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699236 source statements · aliases may refer to the same vulnerability

MAL-2026-16294Published

Malicious code in internallib_v949 (npm)

osv · GHSA-f863-m366-9cfm

npm: internallib_v949

Source modified 18 Sep 2026Recorded 24 Oct 2026

GHSA-pmpg-6pww-fg6qPublished

ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

osv · CVE-2026-56370

NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64

LOWSource modified 18 Sep 2026Recorded 23 Oct 2026

GHSA-9583-h5hc-x8cwPublished

React Router has Path Traversal in File Session Storage

osv · CVE-2025-61686

npm: @react-router/node · npm: @remix-run/node · npm: @remix-run/deno

CRITICALSource modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16295Published

Malicious code in tailwindcss-forms-ui (npm)

osv ·

npm: tailwindcss-forms-ui

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16286Published

Malicious code in test8999-auth (npm)

osv · GHSA-25wf-vfrc-2r82

npm: test8999-auth

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16292Published

Malicious code in @shared-web/utils (npm)

osv ·

npm: @shared-web/utils

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16285Published

Malicious code in test899-auth (npm)

osv · GHSA-jf2q-w77c-99vv

npm: test899-auth

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16289Published

Malicious code in test890-auth (npm)

osv · GHSA-xvpv-wq7p-548c

npm: test890-auth

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2025-889Published

Malicious code in x509-escaping (npm)

osv ·

npm: x509-escaping

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16288Published

Malicious code in test89-auth (npm)

osv · GHSA-7868-hxr7-g8r6

npm: test89-auth

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16291Published

Malicious code in @shared-runtime/modules (npm)

osv ·

npm: @shared-runtime/modules

Source modified 18 Sep 2026Recorded 24 Oct 2026

CVE-2025-55787Published

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.

cve-program ·

Vendor product: n/a

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-57224Published

Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion

cve-program ·

Vendor product: suricata

CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-61721Published

FluidSynth: Heap-based buffer overrun for DLS samples

cve-program ·

Vendor product: fluidsynth

CVSS 3.1 8.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-63647Published

CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

cve-program ·

Vendor product: CordysCRM

CVSS 4.0 9.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-84106Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 8.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-61819Published

pg_partman privilege escalation via SQL injection in when using pg_jobmon and encountering exception

cve-program ·

Vendor product: pg_partman

CVSS 3.1 8.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92963Published

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internal…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-92958Published

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4 · CVSS 3.1 · [email protected] · Secondary 8.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-92953Published

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-92948Published

vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { builtin: ['node:test'] })…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Secondary 9.9Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-92942Published

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout() in lib/vm.js, and…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-92937Published

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when…

nvd ·

CVSS 4.0 · [email protected] · Secondary 10.0 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-84077Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-61781Published

pg_partman has privilege escalation through SQL injection in create_partition_time()

cve-program ·

Vendor product: pg_partman

CVSS 3.1 9.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-84031Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 9.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-82890Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 5.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54343Published

Frappe LMS: Path Traversal in SCORM File Serving

cve-program ·

Vendor product: lms

CVSS 4.0 8.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92579Published

AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-45723Published

Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

cve-program ·

Vendor product: omni

CVSS 3.1 2.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92589Published

Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

cve-program ·

Vendor product: cms

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54627Published

SAIL: Heap out-of-bounds write in SAIL PSD decoder (Bitmap mode ignores depth)

cve-program ·

Vendor product: sail

CVSS 3.1 9.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54594Published

OmniBlocks: Spamming in Discussions tab possible via disc.yml

cve-program ·

Vendor product: monorepo

CVSS 4.0 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-50029Published

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-50149Published

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableFallbackCertificate: true` and `.spec.virt…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-52792Published

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-54570Published

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.9Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-62684Published

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 2.7Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-64859Published

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token becaus…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-64865Published

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because contr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-64866Published

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-64868Published

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies b…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73232Published

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length whi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73428Published

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `<span…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.6Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73509Published

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPath(req.SrcDir) and validate…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.6Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73650Published

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73654Published

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73844Published

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73845Published

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73846Published

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different l…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 18 Sep 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.