Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690097 source statements · aliases may refer to the same vulnerability

GHSA-f65r-h4g3-3h9hPublished

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

osv · CVE-2026-48797 · PYSEC-2026-291

PyPI: backpropagate · npm: @mcptoolshop/backpropagate

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-796p-j2gh-9m2qPublished

dcap-qvl has Missing Verification for QE Identity

osv · CVE-2026-22696 · PYSEC-2026-326

crates.io: dcap-qvl · npm: @phala/dcap-qvl · npm: @phala/dcap-qvl-web

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109088Published

libXtst RECORD EnableContext Reply Endless Loop

cve-program ·

Vendor product: libXtst

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-64394Published

A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108141Published

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path trave…

cve-program ·

Vendor product: Backup and Replication

CVSS 4.0 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106078Published

A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 6.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107671Published

A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

cve-program ·

Vendor product: ONE

CVSS 4.0 8.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108142Published

A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

cve-program ·

Vendor product: Backup and Replication

CVSS 4.0 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106077Published

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106076Published

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote …

cve-program ·

Vendor product: Backup for Microsoft 365

CVSS 4.0 9.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108140Published

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path trave…

cve-program ·

Vendor product: Backup and Replication

CVSS 4.0 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105477Published

A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance are affected.

cve-program ·

Vendor product: Agent for Linux

CVSS 4.0 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109431Published

Camunda Missing Authorization in Task Sub-Resources

cve-program ·

Vendor product: Camunda 7

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82984Published

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated n…

cve-program ·

Vendor product: Server

CVSS 3.0 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77167Published

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions fol…

cve-program ·

Vendor product: server

CVSS 3.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77173Published

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

cve-program ·

Vendor product: Files Confidential

CVSS 3.0 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-67400Published

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

cve-program ·

Vendor product: Richdocuments

CVSS 3.0 3.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77171Published

A public shared collective always allowed recipients of the link to create pages.

cve-program ·

Vendor product: Collectives

CVSS 3.0 3.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-77172Published

App passwords were allowed to bypass password confirmation on sensitive endpoints.

cve-program ·

Vendor product: Server

CVSS 3.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87897Published

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT aut…

cve-program ·

Vendor product: whiteboard

CVSS 3.0 4.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82983Published

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) …

cve-program ·

Vendor product: Tables

CVSS 3.0 3.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82986Published

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.

cve-program ·

Vendor product: Tables

CVSS 3.0 4.6Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-c8m5-c952-6cm4Published

Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

osv · RUSTSEC-2026-0346

crates.io: rustls · crates.io: rustls

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-qq8j-7v2v-3rwpPublished

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

osv · CVE-2026-109855

npm: undici

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-6wfj-92cw-88vgPublished

git-diff: OS command injection vulnerability via crafted strings to the gitDiff API

osv · CVE-2026-110634

npm: git-diff

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-w44r-93j7-qv28Published

rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share

osv · RUSTSEC-2026-0349

crates.io: rustls · crates.io: rustls

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-h2v8-394m-p7vvPublished

Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.

osv · RUSTSEC-2026-0348

crates.io: rustls · crates.io: rustls

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-vp88-798v-h67fPublished

rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert

osv · RUSTSEC-2026-0347

crates.io: rustls · crates.io: rustls

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-6pq8-jhm2-2vcwPublished

qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

osv · CVE-2026-110816

npm: qs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-7f5c-rpf4-86p8Published

hbs: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor

osv · CVE-2021-32822

npm: hbs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-54462Published

knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion

cve-program ·

Vendor product: pkg

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109089Published

libXi XGetDeviceControl Control Type Mismatch Heap Buffer Overflow

cve-program ·

Vendor product: libXi

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102638Published

Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

cve-program ·

Vendor product: Fusion

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102637Published

Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

cve-program ·

Vendor product: Fusion

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102636Published

Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

cve-program ·

Vendor product: Fusion

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116575Published

Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join call…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2026-116591Published

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117511Published

desmondmorris node-tesseract Command Builder tesseract.js process os command injection

cve-program ·

Vendor product: node-tesseract

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2024-38564Published

bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-99090Published

drm/amdgpu: serialize vblank counter reads against GPU reset

cve-program ·

Vendor product: Linux · Vendor product: Linux

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112709Published

Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 9.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-90464Published

Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113881Published

Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution

cve-program ·

Vendor product: Fireware OS

CVSS 4.0 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-93434Published

Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-90442Published

Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112710Published

Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 9.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-82332Published

Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking

cve-program ·

Vendor product: Fireware OS

CVSS 4.0 5.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-93866Published

Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 9.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-103594Published

Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution

cve-program ·

Vendor product: Fireware OS

CVSS 4.0 9.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-104381Published

Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.