Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690463 source statements · aliases may refer to the same vulnerability

CVE-2026-66302Published

Skype for Business Remote Code Execution Vulnerability

cve-program ·

Vendor product: Skype for Business Server 2015 CU13 · Vendor product: Skype for Business Server 2019 CU8 · Vendor product: Skype for Business Server Subscription Edition CU1

CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-76654Published

Subpath symlinking on Windows nodes permits NTLM coercion

cve-program ·

Vendor product: Kubernetes

CVSS 3.1 5.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116827Published

YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.2 · CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116825Published

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116823Published

YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116821Published

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116819Published

OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

cve-program ·

Vendor product: openpanel

CVSS 4.0 8.4 · CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116817Published

OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

cve-program ·

Vendor product: openpanel

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116814Published

OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

cve-program ·

Vendor product: openpanel

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116812Published

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

cve-program ·

Vendor product: openpanel

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116810Published

OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

cve-program ·

Vendor product: openpanel

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116808Published

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

cve-program ·

Vendor product: openpanel

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116806Published

OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation

cve-program ·

Vendor product: openpanel

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116804Published

DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116802Published

DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116800Published

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-62688Published

Windows MIDI Service Module Elevation of Privileges Vulnerability

cve-program ·

Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2 · Vendor product: Windows 11 version 26H1

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-61346Published

Windows Graphics Kernel Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2 · Vendor product: Windows 10 Version 22H2

CVSS 3.1 7.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-90848Published

Governikus AusweisApp StartPAOSResponse cross site scripting

cve-program ·

Vendor product: AusweisApp

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116555Published

Argilla Sandbox.vue cross site scripting

cve-program ·

Vendor product: Argilla

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112556Published

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the applic…

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-63706Published

NPM package next-npm-version1.0.1 is vulnerable to Command injection.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-21727Published

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-25542Published

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource sou…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-26171Published

Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-28291Published

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-29050Published

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file — for example through pull-request-driven CI or build…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-29051Published

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) cons…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.4 · CVSS 3.1 · [email protected] · Primary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-29180Published

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boun…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.9 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-32178Published

Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33031Published

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account d…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33544Published

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct f…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33750Published

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33805Published

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip pro…

nvd ·

CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 8.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33808Published

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via dupl…

nvd ·

CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 9.1 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33815Published

Memory-safety vulnerability in github.com/jackc/pgx/v5.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33877Published

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33889Published

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33891Published

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigIntege…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33895Published

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33904Published

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 in…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33907Published

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS message missing IEs. An attacker able to send crafted NAS messages to Ella Core can c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33916Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without gu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7 · CVSS 3.1 · [email protected] · Primary 4.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33937Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33938Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33939Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled templat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33940Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33941Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file na…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 8.2 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33994Published

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34065Published

nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.