Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690438 source statements · aliases may refer to the same vulnerability

CVE-2026-103594Published

Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution

cve-program ·

Vendor product: Fireware OS

CVSS 4.0 9.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-104381Published

Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111107Published

Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service

cve-program ·

Vendor product: Fireware OS · Vendor product: Fireware OS

CVSS 4.0 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109823Published

Host filesystem path disclosure via DNS rebinding

cve-program ·

https://repo.hex.pm: tidewave · https://github.com: tidewave-ai/tidewave_phoenix

CVSS 4.0 2.3Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-r4xp-prcw-77qfPublished

better-auth: OAuth Proxy lets an attacker sign in as another user

osv · CVE-2026-110864

npm: better-auth

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-fpmh-frq8-7rj8Published

compress zstd: Panic on two-block frames

osv · CVE-2026-116591

Go: github.com/klauspost/compress/zstd

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-965c-763c-88jmPublished

better-auth: OAuth state can be used as a Magic Link to sign in as another user

osv · CVE-2026-110862 · CVE-2026-114607

npm: better-auth

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-44jh-23m7-hpcfPublished

@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL

osv · CVE-2026-110861

npm: @better-auth/drizzle-adapter · npm: @better-auth/kysely-adapter · npm: better-auth

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117510Published

Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

cve-program ·

Vendor product: Dexbotic

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-2mjx-qc3c-rqvcPublished

Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

osv · RUSTSEC-2026-0285

crates.io: rustls

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-4hv6-xc92-j86gPublished

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

osv · CVE-2026-111917 · GO-2026-6715

Go: code.vikunja.io/api

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-4g5x-hcwm-82jwPublished

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

osv · CVE-2026-114665 · CVE-2026-53553 · GO-2026-5938

Go: github.com/zhenorzz/goploy

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-fmmf-xq98-g327Published

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

osv · CVE-2026-111921 · GO-2026-6730

Go: code.vikunja.io/api

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-32r8-5843-4qw2Published

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

osv · CVE-2026-76216 · GO-2026-6711

Go: code.vikunja.io/api

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-26rh-24rg-j3vvPublished

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

osv · CVE-2026-53552 · GO-2026-5936

Go: github.com/zhenorzz/goploy

CRITICALSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-fprf-r6rv-xg99Published

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

osv · CVE-2026-111918 · GO-2026-6731

Go: code.vikunja.io/api

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107458Rejected

This CVE has been rejected by Upstream, as they failed to create a meaningful exploit

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-104189Published

3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share

cve-program ·

Vendor product: 3Dviewer-Nextcloud

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111585Published

Integer Overflow in TeamViewer Remote Control Screen Decompression Leading to Heap-Based Buffer Overflow

cve-program ·

Vendor product: Full Client · Vendor product: Portable · Vendor product: Remote Control

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111584Published

Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows

cve-program ·

Vendor product: TeamViewer Remote - Patch Management

CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116587Published

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jos…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116583Published

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2026-111583Published

Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows

cve-program ·

Vendor product: Full Client · Vendor product: Host

CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-4g23-2xm8-66gcPublished

Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

osv · CVE-2026-110872

npm: nodemailer

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-8xx9-69p8-7jp3Published

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

osv · CVE-2026-44645

npm: liquidjs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-2qv6-9wx5-cwv4Published

LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

osv · CVE-2026-44644

npm: liquidjs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-9x9p-qf8f-mvjgPublished

LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

osv · CVE-2026-44646

npm: liquidjs

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-fx2h-pf6j-xcffPublished

vite: `server.fs.deny` bypass on Windows alternate paths

osv · CVE-2026-53571

npm: vite · npm: vite · npm: vite

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-4ffr-jq9g-5ffxPublished

Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

osv · CVE-2026-110869

npm: nodemailer

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-g73g-hqqh-jr95Published

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

osv · CVE-2026-110870

npm: nodemailer

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111582Published

Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows

cve-program ·

Vendor product: Remote Management - Monitoring

CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92377Published

Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows

cve-program ·

Vendor product: Full Client · Vendor product: Host

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92376Published

Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

cve-program ·

Vendor product: Remote Management - Monitoring

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92375Published

Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring

cve-program ·

Vendor product: Full Client · Vendor product: Host · Vendor product: Remote Management - Monitoring

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92374Published

Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

cve-program ·

Vendor product: Full Client · Vendor product: Host

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116585Published

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decryp…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 27 Oct 2026Recorded 28 Oct 2026

CVE-2026-92372Published

Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

cve-program ·

Vendor product: Full Client

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114693Published

WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: all-in-one-video-gallery

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116802Published

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-116804Published

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expression…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-117507Published

a2aproject a2a-java TaskManager.saveTaskEvent race condition

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-qrh6-cwg3-343xPublished

Ghost: Authorization Bypass in Comment Like Feature

osv · BIT-ghost-2026-103288 · CVE-2026-103288

npm: ghost

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-rp7c-4prv-9rrgWithdrawn

Duplicate Advisory: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace filesDuplicate Advisory:

osv ·

Go: github.com/siyuan-note/siyuan

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-c8r8-95hg-mp34Published

SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files

osv · CVE-2026-60083

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-wj4w-mc24-pcfmWithdrawn

Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature

osv ·

npm: ghost

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-wx4j-mvgx-mqwpPublished

Satori-generated SVG has improper escaping

osv · CVE-2026-94545

npm: satori

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-q84f-53jg-9ppmPublished

better-auth: Device login approval does not show the requesting client or permissions

osv · CVE-2026-109346

npm: better-auth

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-28167Published

WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability

cve-program ·

https://wordpress.org/plugins: super-forms

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117506Published

a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117604Published

Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.