Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690434 source statements · aliases may refer to the same vulnerability

CVE-2024-58357Published

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called on a None result from timestamp_opt. Authorized clients can repeatedly invoke rand::time() to reliabl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58358Published

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assign…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 4.9Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58359Published

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Authorized clients can execute queries with ORDER BY rand() to trigger a panic in the sorting function, cr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58361Published

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empty strings. Authorized clients can execute malformed queries with empty string conversions to record,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58362Published

SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGN…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 8.8Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58364Published

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on line terminator characters. Authorized clients can submit malformed queries that trigger a panic in t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58365Published

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to tri…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58367Published

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit S…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58368Published

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58369Published

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing server panic. Authorized clients can invoke these entities at unsupported levels to crash the Surre…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2024-58370Published

SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements including IF, RELATE, and attribute access idioms. Authorized attackers can submit queries with excessive nesting depth to cause…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-118171Published

CVE-2026-118171

cve-program ·

Vendor product: Strapi Open Source and Enterprise Headless CMS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118172Published

CVE-2026-118172

cve-program ·

Vendor product: Strapi Open Source and Enterprise Headless CMS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118170Published

CVE-2026-118170

cve-program ·

Vendor product: Strapi Open Source and Enterprise Headless CMS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116682Published

FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

cve-program ·

Vendor product: filebrowser

CVSS 3.1 8.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-14255Published

IFC File Parsing Uncontrolled Recursion in Certain Autodesk Products

cve-program ·

Vendor product: Shared Components · Vendor product: Revit

CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-94gr-w3q5-rfqrPublished

Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page

osv · CVE-2025-65719 · PYSEC-2026-371

npm: kubectl-mcp-server · PyPI: kubectl-mcp-server

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116680Published

Homebox generic notifier SSRF via HTTP redirect after URL validation

cve-program ·

Vendor product: homebox

CVSS 3.1 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-88812Published

X.Org Server XKB SetGeometry TextDoodad Double Free

cve-program ·

Vendor product: xorg-x11-server · Vendor product: xwayland

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102816Published

Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305

cve-program ·

Vendor product: RE305 v3

CVSS 4.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102813Published

Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305

cve-program ·

Vendor product: RE305 v3

CVSS 4.0 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102812Published

Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

cve-program ·

Vendor product: RE305 v3 · Vendor product: Archer C7 v5

CVSS 4.0 6.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18330Published

Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7

cve-program ·

Vendor product: RE305 v3 · Vendor product: Archer C7 v5

CVSS 4.0 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118132Published

CVE-2026-118132

cve-program ·

Vendor product: NextChat

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108311Published

Tanium addressed an insufficient logging vulnerability in Tanium Server.

cve-program ·

Vendor product: Tanium Server

CVSS 3.1 2.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108303Published

Tanium addressed an unauthorized code execution vulnerability in Certificate Manager.

cve-program ·

Vendor product: Certificate Manager

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108316Published

Tanium addressed an information disclosure vulnerability in Tanium Server.

cve-program ·

Vendor product: Tanium Server

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116656Published

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108325Published

Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.

cve-program ·

Vendor product: Reputation

CVSS 3.1 6.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116659Published

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108302Published

Tanium addressed an improper access controls vulnerability in Comply.

cve-program ·

Vendor product: Comply

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108306Published

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: end-user-cx

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108329Published

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

cve-program ·

Vendor product: Threat Response

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108332Published

Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: threat-response-cx

CVSS 3.1 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108301Published

Tanium addressed an improper access controls vulnerability in Comply.

cve-program ·

Vendor product: Comply

CVSS 3.1 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108304Published

Tanium addressed a local privilege escalation vulnerability in End-User Notifications.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: end-user-cx

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87086Published

Tanium addressed a denial of service vulnerability in Provision.

cve-program ·

Vendor product: Provision

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108309Published

Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: performance-cx

CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116658Published

Tanium addressed a denial of service vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108313Published

Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.

cve-program ·

Vendor product: Tanium Server

CVSS 3.1 6.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116649Published

Tanium addressed an improper output sanitization vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116647Published

Tanium addressed an improper output sanitization vulnerability in Comply.

cve-program ·

Vendor product: Comply

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116660Published

Tanium addressed an improper access controls vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108326Published

Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: cx-stream

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108330Published

Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: threat-response-cx

CVSS 3.1 3.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116657Published

Tanium addressed a denial of service vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108333Published

Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: threat-response-cx

CVSS 3.1 2.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108307Published

Tanium addressed a heap-based buffer overflow vulnerability in Index.

cve-program ·

Vendor product: Endpoint Configuration Toolset Solution · Vendor product: index-cx

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-108310Published

Tanium addressed a denial of service vulnerability in Tanium Server.

cve-program ·

Vendor product: Tanium Server

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116662Published

Tanium addressed a compression bomb vulnerability in Enforce.

cve-program ·

Vendor product: Enforce

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.