Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690320 source statements · aliases may refer to the same vulnerability

CVE-2026-118029Published

Unverified ownership of the default Athena query result location in AWS SDK for pandas

cve-program ·

Vendor product: aws-sdk-pandas

CVSS 4.0 5.9 · CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111044Published

Disabled Sunshine clients can bypass revocation with a derived client certificate

cve-program ·

Vendor product: Sunshine

CVSS 3.1 7.6Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-50543Published

Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices

cve-program ·

Vendor product: xibo-cms

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114079Published

Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111057Published

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

cve-program ·

Vendor product: mercury

CVSS 3.1 10.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114074Published

Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-pjr3-86v4-5p7wPublished

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

osv · CVE-2026-111920 · GO-2026-6745

Go: code.vikunja.io/api

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-vmg4-6gfg-83qxPublished

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

osv · CVE-2026-71553

npm: apostrophe

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111064Published

aiohttp server lacks an initial request/header timeout

cve-program ·

Vendor product: aiohttp

CVSS 4.0 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111750Published

AIOHTTP: Pure-Python parser request smuggling

cve-program ·

Vendor product: aiohttp

CVSS 4.0 6.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114064Published

Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint

cve-program ·

Vendor product: snipe-it

CVSS 4.0 5.1 · CVSS 3.1 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-116676Published

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-116682Published

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the re…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-116683Published

CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team password…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-116693Published

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-55369Published

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When e…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-59158Published

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nux…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-59176Published

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-59179Published

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `FlowS…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.3Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-78661Published

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short t…

nvd ·

Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-97045Published

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented …

nvd ·

Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114076Published

Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112395Published

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

cve-program ·

Vendor product: Pillow

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114081Published

Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114059Published

ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization

cve-program ·

Vendor product: arcadedb

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114086Published

Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114071Published

Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-116687Published

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-116688Published

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes inc…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-54462Published

Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through j…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114066Published

Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112399Published

Pillow: APNG background disposal allocates full canvas before decompression bomb check

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114061Published

SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

cve-program ·

Vendor product: kit

CVSS 4.0 2.3 · CVSS 3.1 4.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-67187Published

Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

cve-program ·

Vendor product: Ninja Forms

CVSS 4.0 5.1 · CVSS 3.1 7.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112404Published

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114056Published

ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH

cve-program ·

Vendor product: arcadedb

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112945Published

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114054Published

vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114051Published

vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112898Published

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

cve-program ·

Vendor product: Pillow

CVSS 4.0 6.9Source modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-hh27-hf48-9f5qPublished

LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

osv · CVE-2026-45357

npm: liquidjs

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-44xr-mrhh-qm78Published

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

osv · CVE-2026-84312 · GO-2026-6773

Go: github.com/0xJacky/Nginx-UI

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-wmg3-h8mf-wgvrPublished

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

osv · CVE-2026-61459 · PYSEC-2026-3685

npm: mcp-server-kubernetes

CRITICALSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-gfrc-g87h-7h5wPublished

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

osv · CVE-2026-84313 · GO-2026-6786

Go: github.com/0xJacky/Nginx-UI

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114049Published

vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense

cve-program ·

Vendor product: vllm

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112893Published

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114044Published

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2021-48020Published

Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

cve-program ·

Vendor product: vyper

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112911Published

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

cve-program ·

Vendor product: filelock

CVSS 3.1 6.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114091Published

Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.