Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690506 source statements · aliases may refer to the same vulnerability

CVE-2026-41273Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise contains an authentication bypass vulnerability that allows an unauthenticated attacker to obtain OAuth 2.0 access tokens assoc…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41274Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41277Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore creation endpoint allows authenticated users to control the primary key (id) and i…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.6 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41278Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker valida…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41279Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/text-to-speech/generate) is whitelisted (no auth) and accepts a credentialId direc…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41282Published

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects use of -env-vars for multi-step templates against untrusted targets (not the default configuration).

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.0 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41321Published

@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow'…

nvd ·

CVSS 3.1 · [email protected] · Secondary 2.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41322Published

@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instea…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41324Published

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41427Published

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clientPrivileges option documents a create action, but the OAuth client creation endpoints did not invoke the hook before persisting new clients.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41589Published

Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary fil…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41636Published

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41643Published

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial of Service (DoS) vulnerability exists in GoBGP where a malformed BGP UPDATE message can trigger a r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41647Published

Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41680Published

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline (\x09\x0b\n)—an unauthent…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41907Published

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-pr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.1 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41988Published

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue.

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.2 · CVSS 3.1 · [email protected] · Primary 2.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-4370Published

A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju control…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-4660Published

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerabilit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-4740Published

A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client ce…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5052Published

Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5412Published

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a lo…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5758Published

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5774Published

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 6.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-5842Published

A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attac…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 2.0 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6594Published

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 2.0 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6634Published

A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6654Published

Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting the length to zero.

nvd ·

CVSS 3.1 · [email protected] · Primary 5.1 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 5.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6966Published

Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a valid signat…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.0 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6967Published

Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote authenticated users with delegated signing authority to bypass TUF specification integrity checks for dele…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.1 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7461Published

Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1.103.0 might allow a remote authenticated threat actor to execute shell commands…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.5 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-91633Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes t…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 6.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-66045Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-66044Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-66043Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-66042Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91632Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 7.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91631Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91630Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase. Whil…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91629Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exp…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 4.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91628Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploit…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91627Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitab…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116506Published

TOTOLINK A950RG firewall.so apmib_set command injection

cve-program ·

Vendor product: A950RG

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91625Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows un…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91623Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows …

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 7.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-77216Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-77215Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91622Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows un…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 9.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91617Published

Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily…

cve-program ·

Vendor product: Oracle Middleware Common Libraries and Tools

CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116584Published

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

cve-program ·

Vendor product: seroval

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.