Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

689764 source statements · aliases may refer to the same vulnerability

CVE-2026-111585Published

Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

cve-program ·

Vendor product: Full Client · Vendor product: Portable · Vendor product: Remote Control

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111584Published

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

cve-program ·

Vendor product: TeamViewer Remote - Patch Management

CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116587Published

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jos…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116583Published

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2026-111583Published

Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows

cve-program ·

Vendor product: Full Client · Vendor product: Host

CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-4g23-2xm8-66gcPublished

Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

osv · CVE-2026-110872

npm: nodemailer

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-8xx9-69p8-7jp3Published

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

osv · CVE-2026-44645

npm: liquidjs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-2qv6-9wx5-cwv4Published

LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

osv · CVE-2026-44644

npm: liquidjs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-9x9p-qf8f-mvjgPublished

LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

osv · CVE-2026-44646

npm: liquidjs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-fx2h-pf6j-xcffPublished

vite: `server.fs.deny` bypass on Windows alternate paths

osv · CVE-2026-53571

npm: vite · npm: vite · npm: vite

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-4ffr-jq9g-5ffxPublished

Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

osv · CVE-2026-110869

npm: nodemailer

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-g73g-hqqh-jr95Published

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

osv · CVE-2026-110870

npm: nodemailer

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111582Published

Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows

cve-program ·

Vendor product: Remote Management - Monitoring

CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92377Published

Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows

cve-program ·

Vendor product: Full Client · Vendor product: Host

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92376Published

Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

cve-program ·

Vendor product: Remote Management - Monitoring

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92375Published

Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring

cve-program ·

Vendor product: Full Client · Vendor product: Host · Vendor product: Remote Management - Monitoring

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92374Published

Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

cve-program ·

Vendor product: Full Client · Vendor product: Host

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116585Published

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decryp…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2026-116586Published

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsin…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2026-92372Published

Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

cve-program ·

Vendor product: Full Client

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114693Published

WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: all-in-one-video-gallery

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116802Published

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-116803Published

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutral…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-116804Published

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expression…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-117507Published

a2aproject a2a-java TaskManager.saveTaskEvent race condition

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-qrh6-cwg3-343xPublished

Ghost: Authorization Bypass in Comment Like Feature

osv · BIT-ghost-2026-103288 · CVE-2026-103288

npm: ghost

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-rp7c-4prv-9rrgWithdrawn

Duplicate Advisory: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesDuplicate Advisory:

osv ·

Go: github.com/siyuan-note/siyuan

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-c8r8-95hg-mp34Published

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files

osv · CVE-2026-60083

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-wj4w-mc24-pcfmWithdrawn

Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature

osv ·

npm: ghost

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-wx4j-mvgx-mqwpPublished

Satori-generated SVG has improper escaping

osv · CVE-2026-94545

npm: satori

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-q84f-53jg-9ppmPublished

better-auth: Device login approval does not show the requesting client or permissions

osv · CVE-2026-109346

npm: better-auth

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-28167Published

WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability

cve-program ·

https://wordpress.org/plugins: super-forms

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117506Published

a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117604Published

Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105987Published

Stored XSS in KGS Software tia Viewer

cve-program ·

Vendor product: tia Viewer

CVSS 4.0 5.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-115927Published

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

cve-program ·

Vendor product: tornado

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116479Published

a2aproject a2a-java JSON-RPC Error getMessage information exposure

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83398Published

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Data Integrator

CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116575Published

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

cve-program ·

Vendor product: mem0

CVSS 3.1 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116579Published

Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

cve-program ·

Vendor product: autobahn-python

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116504Published

TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection

cve-program ·

Vendor product: A950RG

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116583Published

Seroval: Code injection through a typed array's own constructor property

cve-program ·

Vendor product: seroval

CVSS 4.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116587Published

Go JOSE: DoS when parsing JWKs that contain RSA keys

cve-program ·

Vendor product: go-jose

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116507Published

TOTOLINK A950RG global.so getLanguageCfg information disclosure

cve-program ·

Vendor product: A950RG

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116726Published

gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title

cve-program ·

Vendor product: gbsplay

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-78845Published

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.

cve-program ·

Vendor product: n/a

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116730Published

Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import

cve-program ·

Vendor product: furnace

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116734Published

flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header

cve-program ·

Vendor product: flatcc

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116738Published

VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder

cve-program ·

Vendor product: vmime

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116742Published

HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count

cve-program ·

Vendor product: htslib

CVSS 4.0 4.8 · CVSS 3.1 4.4Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.