Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690485 source statements · aliases may refer to the same vulnerability

CVE-2026-32178Published

Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33031Published

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account d…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33544Published

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct f…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33750Published

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33805Published

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip pro…

nvd ·

CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 8.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33808Published

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via dupl…

nvd ·

CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 9.1 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33815Published

Memory-safety vulnerability in github.com/jackc/pgx/v5.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33877Published

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33889Published

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33891Published

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigIntege…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33895Published

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33904Published

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 in…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33907Published

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS message missing IEs. An attacker able to send crafted NAS messages to Ella Core can c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33916Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without gu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7 · CVSS 3.1 · [email protected] · Primary 4.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33937Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33938Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33939Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled templat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33940Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33941Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file na…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 8.2 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33994Published

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34065Published

nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34067Published

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a malformed proof where `history.len() != positions.len()` due to `assert_eq!(histo…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34068Published

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts `UpdateValidator` transactions that set `new_voting_key=Some(...)` while omitting `new_proo…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34076Published

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versions 2.0.0 to before 2.0.7, @clerk/backend from versions 3.0.0 to before 3.2.3, and…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34148Published

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document l…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34208Published

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random = ...), but this protection can be bypassed through an exposed callable constructor path: this.cons…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0 · CVSS 3.1 · [email protected] · Primary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34211Published

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34217Published

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability exists in @nyariv/sandboxjs. The vulnerability allows untrusted sandboxed code to leak internal interpreter objects through the new operator, …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Primary 7.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34385Published

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or mod…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.2 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34386Published

Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34944Published

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, On x86-64 platforms with SSE3 disabled Wasmtime's compilation of the f64x2.splat WebAssembly instruction with Cranelift may load 8 more bytes than is necess…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.1 · CVSS 3.1 · [email protected] · Primary 5.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34945Published

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a bug where a 64-bit table, part of the memory64 proposal of WebAssembly, incorrectly translated the table.size inst…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34946Published

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler contains a vulnerability where the compilation of the table.fill instruction can result in a host panic. This means that a va…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34971Published

Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Cranelift compilation backend contains a bug on aarch64 when performing a certain shape of heap accesses which means that the wrong address …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.0 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34987Published

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default compiler backend may allow properly constructed guest Wasm to access host memory outside of its linear-m…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34988Published

Wasmtime is a runtime for WebAssembly. From 28.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of its pooling allocator contains a bug where in certain configurations the contents of linear memory can be leaked from one …

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 6.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35041Published

fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service condition exists in fast-jwt when the allowedAud verification option is configured using a regular expression. Because the aud claim is att…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.2 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35186Published

Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's Winch compiler backend contains a bug where translating the table.grow operator causes the result to be incorrectly typed. For 32-bit tables…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.1 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35195Published

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's implementation of transcoding strings between components contains a bug where the return value of a guest component's realloc is not validated be…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.1 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35341Published

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation f…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35342Published

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35343Published

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim f…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35345Published

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been rep…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35346Published

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacemen…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35358Published

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the d…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.4 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35361Published

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove dev…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.4 · CVSS 3.1 · [email protected] · Primary 4.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35364Published

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker wit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35366Published

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rath…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35367Published

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (064…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35375Published

A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided with non-UTF-8 prefix or suffix inputs. The implementation utilizes to_string_lossy() when constructing chunk filenames, which au…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.