Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690407 source statements · aliases may refer to the same vulnerability

CVE-2026-114126Published

Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

cve-program ·

Vendor product: storybook

CVSS 4.0 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-89035Published

MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass

cve-program ·

Vendor product: RouterOS

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114261Published

MomoTommy file-management-system Files API FileController.php destroy missing authentication

cve-program ·

Vendor product: file-management-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114122Published

Electron: Frame subscription trusts GPU-supplied frame geometry

cve-program ·

Vendor product: electron

CVSS 3.1 3.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114258Published

oretnom23 file-management-system-php File Management files.php sql injection

cve-program ·

Vendor product: file-management-system-php

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113798Published

Electron: Pointer lock permission requests can be attributed to the wrong frame

cve-program ·

Vendor product: electron

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113794Published

pypdf: Possible infinite loop when hitting EOF in standard xref table

cve-program ·

Vendor product: pypdf

CVSS 4.0 6.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113790Published

pypdf: Possible large memory usage when parsing arrays and dictionaries

cve-program ·

Vendor product: pypdf

CVSS 4.0 6.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114255Published

oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection

cve-program ·

Vendor product: file-management-system-php

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-5821Published

Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection

cve-program ·

Vendor product: Image Optimizer – Compress Images and Convert to WebP or AVIF

CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-11592Published

Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

cve-program ·

Vendor product: Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-103995Published

Lenient parsing of integers for response body and chunk framing

cve-program ·

Vendor product: CPython

CVSS 4.0 2.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-92925Published

Redis: redis: out-of-bounds read via crafted cluster bus packets

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: valkey · https://access.redhat.com/downloads/content/package-browser/: valkey · https://access.redhat.com/downloads/content/package-browser/: redis:7

CVSS 3.1 7.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-110879Published

jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

cve-program ·

https://repo.maven.apache.org/maven2: com.fasterxml.jackson.core:jackson-databind · https://repo.maven.apache.org/maven2: tools.jackson.core:jackson-databind

CVSS 3.1 9.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-110747Published

jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

cve-program ·

https://repo.maven.apache.org/maven2: com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf · https://repo.maven.apache.org/maven2: tools.jackson.dataformat:jackson-dataformat-protobuf

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-104895Published

jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

cve-program ·

https://repo.maven.apache.org/maven2: com.fasterxml.jackson.dataformat:jackson-dataformat-smile · https://repo.maven.apache.org/maven2: tools.jackson.dataformat:jackson-dataformat-smile

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-104016Published

jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

cve-program ·

https://repo.maven.apache.org/maven2: com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf · https://repo.maven.apache.org/maven2: tools.jackson.dataformat:jackson-dataformat-protobuf

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2026-118129Published

jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication

cve-program ·

Vendor product: Chitchatter

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2024-58379Published

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-58257Published

GRR vulnerable to Arbitrary File Read and Deletion

cve-program ·

Vendor product: GRR

CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-58256Published

GRR vulnerable to Remote Code Execution Via PHP Code Injection

cve-program ·

Vendor product: GRR

CVSS 3.1 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114252Published

itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection

cve-program ·

Vendor product: Sales-and-Inventory-System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-22063Published

CVE-2026-22063 eMudhra CA Certificate Compromise in NetApp Products

cve-program ·

Vendor product: ONTAP 9 · Vendor product: StorageGRID (formerly StorageGRID Webscale) · Vendor product: E-Series SANtricity OS Controller Software

CVSS 4.0 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113786Published

pypdf: Unvalidated JPEG image data loading

cve-program ·

Vendor product: pypdf

CVSS 4.0 2.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112155Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111467Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18326Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111479Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-12534Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111563Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-58496Published

ThorVG: Out-of-bounds Read in SFNT/TTF Font Loader via Memory API

cve-program ·

Vendor product: thorvg

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114249Published

dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization

cve-program ·

Vendor product: Insurance-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114113Published

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114103Published

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114088Published

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_E…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114073Published

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.8 · CVSS 3.1 · [email protected] · Secondary 5.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114402Published

Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

cve-program ·

Vendor product: trudesk

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114397Published

Trudesk through 1.2.11 Missing Authentication on Debug Routes

cve-program ·

Vendor product: trudesk

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114392Published

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid

cve-program ·

Vendor product: trudesk

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114387Published

Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

cve-program ·

Vendor product: shopper

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114242Published

dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection

cve-program ·

Vendor product: Insurance-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-71195Published

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public s…

cve-program ·

Vendor product: Manila

CVSS 3.1 9.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113743Published

Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal

cve-program ·

Vendor product: tt-metal

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114118Published

Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound

cve-program ·

Vendor product: vyper

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114113Published

Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

cve-program ·

Vendor product: sharp

CVSS 4.0 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114108Published

HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

cve-program ·

Vendor product: Vibe-Trading

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114103Published

adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

cve-program ·

Vendor product: adm-zip

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-6893Published

Dracut: dracut: root code execution via dhcp options command injection

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: dracut · https://access.redhat.com/downloads/content/package-browser/: dracut · https://access.redhat.com/downloads/content/package-browser/: dracut

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114098Published

Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

cve-program ·

Vendor product: dulwich

CVSS 4.0 7.3 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114093Published

Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.