Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690489 source statements · aliases may refer to the same vulnerability

CVE-2026-41137Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide a command injection p…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41208Published

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API k…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41238Published

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default config…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41246Published

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modif…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41265Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the run method of the Airtable_Agents class. The issue results from the lack of proper sandboxing when …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41268Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter o…

nvd ·

CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 3.0 · [email protected] · Secondary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41272Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41275Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.com sends a reset password link over the unsecured HTTP protocol instead of HTTPS. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41276Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, this vulnerability allows remote attackers to bypass authentication on affected installations of FlowiseAI Flowise. Authentication is n…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41319Published

MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 5.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41433Published

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41602Published

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41642Published

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP due to a nil pointer dereference. When a malformed BGP UPD…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41648Published

Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated use…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 5.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42254Published

Hickory DNS hickory-recursor 0.1 through 0.25.2 allows cross-zone poisoning because cached data is not directly associated with a query that triggered a response.

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42285Published

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP peer can trigger a fatal panic in GoBGP by sending a specially crafted BGP UPDATE message. …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5323Published

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local po…

nvd ·

CVSS 4.0 · [email protected] · Secondary 1.9 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 2.0 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5327Published

A security flaw has been discovered in efforthye fast-filesystem-mcp up to 3.5.1. The affected element is the function handleGetDiskUsage of the file src/index.ts. Performing a manipulation results in command injection. The attack is possib…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5807Published

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate op…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5986Published

A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of the argument timestamp causes inefficient regular expression complexity. It is…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 2.0 · [email protected] · Secondary 5.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6290Published

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.0 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6383Published

A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6437Published

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) before v3.0.1 allows remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount …

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 6.9 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6874Published

A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing a manipulation of the argument Host can lead to reliance on reverse dns resol…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6970Published

authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the account was created with authd p…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6993Published

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended int…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 2.0 · [email protected] · Secondary 5.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112626Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing mal…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112688Published

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Parsing a file may lead to a…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116747Published

Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret

cve-program ·

Vendor product: kener

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116745Published

QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation

cve-program ·

Vendor product: qloapps

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116743Published

libyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data

cve-program ·

Vendor product: libmsiecf

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116741Published

Speex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes

cve-program ·

Vendor product: speex

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116739Published

VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

cve-program ·

Vendor product: vmime

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116737Published

libphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path

cve-program ·

Vendor product: libphdi

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116733Published

flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number

cve-program ·

Vendor product: flatcc

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116731Published

Furnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import

cve-program ·

Vendor product: furnace

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116729Published

libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a

cve-program ·

Vendor product: libfvde

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116727Published

gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c

cve-program ·

Vendor product: gbsplay

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116725Published

gbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index

cve-program ·

Vendor product: gbsplay

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116723Published

FLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field

cve-program ·

Vendor product: fltk

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112637Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing maliciously crafted web content m…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116514Published

itsourcecode Airline Reservation System book_flight.php cross site scripting

cve-program ·

Vendor product: Airline Reservation System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116588Published

Datadog dd-trace-py: ReDOS in URL query string obfuscation

cve-program ·

Vendor product: dd-trace-py

CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116584Published

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 28 Oct 2026

CVE-2026-116581Published

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 28 Oct 2026

CVE-2026-116580Published

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 26 Oct 2026Recorded 28 Oct 2026

CVE-2026-116576Published

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellStr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 26 Oct 2026Recorded 28 Oct 2026

CVE-2026-77924Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65686Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65685Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.