Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690414 source statements · aliases may refer to the same vulnerability

CVE-2026-6893Published

Dracut: dracut: root code execution via dhcp options command injection

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: dracut · https://access.redhat.com/downloads/content/package-browser/: dracut · https://access.redhat.com/downloads/content/package-browser/: dracut

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114098Published

Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

cve-program ·

Vendor product: dulwich

CVSS 4.0 7.3 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114093Published

Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-96442Published

Emacs: emacs: arbitrary code execution in flymake mode

cve-program ·

https://git.savannah.gnu.org/cgit/emacs.git/: emacs · https://access.redhat.com/downloads/content/package-browser/: emacs · https://access.redhat.com/downloads/content/package-browser/: emacs

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57199Published

Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 4.0 2.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114088Published

Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114083Published

Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114078Published

Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114073Published

Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114068Published

Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.2 · CVSS 3.1 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

GO-2026-6866Published

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

osv · CVE-2026-97045

Go: golang.org/x/net

Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-gcqx-w48m-w2h4Published

deepmerge mergeObject() allows prototype poisoning of returned objects

osv · CVE-2026-93753

npm: deepmerge

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114063Published

SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

cve-program ·

Vendor product: kit

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114058Published

ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol

cve-program ·

Vendor product: arcadedb

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114053Published

vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

cve-program ·

Vendor product: vllm

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114048Published

WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.1 · CVSS 3.1 3.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114043Published

Vulnerability in FreeRDP

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-97045Published

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

cve-program ·

https://pkg.go.dev: golang.org/x/net/html

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-78661Published

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

cve-program ·

https://pkg.go.dev: golang.org/x/net/html

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2021-48019Published

Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

cve-program ·

Vendor product: vyper

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2020-37286Published

Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

cve-program ·

Vendor product: vyper

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113737Published

R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal

cve-program ·

Vendor product: Jackrong-llm-finetuning-guide

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113706Published

a2aproject a2a-rs inmemory.rs information disclosure

cve-program ·

Vendor product: a2a-rs

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57191Published

Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 4.0 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113726Published

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91668Published

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle Data Integrator

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

GO-2026-6860Published

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

osv · CVE-2026-78661

Go: golang.org/x/net

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91662Published

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase e…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91661Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 7.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91660Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Succe…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91659Published

Vulnerability in Oracle Essbase (component: Build). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While th…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 7.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57192Published

Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 4.0 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91657Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Succe…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91656Published

Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Ess…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116775Published

pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-contr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3Source modified 27 Oct 2026Recorded 30 Oct 2026

CVE-2026-116696Published

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records whil…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 27 Oct 2026Recorded 30 Oct 2026

GHSA-mf2p-h6hf-fcwmPublished

TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

osv · CVE-2026-116675

npm: tinymce · NuGet: TinyMCE · Packagist: tinymce/tinymce

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-rh54-vffm-5fvpPublished

CKEditor: Cross-site scripting (XSS) in the engine package

osv · CVE-2026-116688

npm: ckeditor5 · npm: @ckeditor/ckeditor5-engine · npm: ckeditor5

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-v6mg-96c6-gmpqPublished

CKEditor: Cross-site scripting (XSS) in the engine package

osv · CVE-2026-116687

npm: ckeditor5 · npm: @ckeditor/ckeditor5-engine · npm: ckeditor5

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-x94g-w73q-hpcwPublished

dd-trace: ReDOS in URL query string obfuscation

osv · CVE-2026-116693

npm: dd-trace · npm: dd-trace

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-mgqf-5mf5-prfjPublished

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

osv · CVE-2026-116682

Go: github.com/gtsteffaniak/filebrowser/backend

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-rjh2-4xgw-p2hjPublished

Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

osv · CVE-2026-116676

Go: github.com/runatlantis/atlantis

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-5cp7-fp4j-wwcvPublished

Neko: Authorization bypass in legacy WebRTC input handling

osv · CVE-2026-116679

Go: github.com/m1k1o/neko/server

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-57195Published

Asterisk: NULL Pointer Dereference in HTTP AMI Digest Authentication

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-39928Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106456Published

Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure o…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.8 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-106457Published

Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstage/plugin-auth-backend-module-cloudflare-access-provider package is affected by insufficient audience validation in the cloudflare access aut…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-106458Published

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-108014Published

eMudhra Compromised Certificate vulnerability impacts HCL Domino Server

cve-program ·

Vendor product: Domino Server

CVSS 4.0 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-106460Published

Backstage is an open framework for building developer portals. From 0.3.0 until 0.6.15 and 0.7.5, the @backstage/plugin-auth-node package did not consistently honor explicit negative email verification during shared OAuth profile normalizat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 27 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.