Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690778 source statements · aliases may refer to the same vulnerability

CVE-2026-33814Published

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-39823Published

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escap…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-39825Published

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query p…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-39826Published

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-39836Published

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41645Published

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's expression evaluation engine makes it possible for a malicious target server to inject and execute s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41650Published

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when bui…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41684Published

Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41685Published

Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41691Published

Copilot said: i18nextify is a JavaScript library that adds

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41692Published

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw strin…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7 · CVSS 3.1 · [email protected] · Primary 4.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41900Published

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Primary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42047Published

Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulnerability that allows unauthenticated remote attackers to exfiltr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42241Published

ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker decl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42272Published

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42273Published

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can resul…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42274Published

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42275Published

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restricts path traversal through lexical normalization but does not prevent symlink following. Wh…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42449Published

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path (N8NDocumentationMCPServer constructor, getN8nApiClient(), and vali…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42880Published

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43824Published

In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7446Published

A vulnerability was detected in VetCoders mcp-server-semgrep 1.0.0. This affects the function analyze_results/filter_results/export_results/compare_results/scan_directory/create_rule of the file src/index.ts of the component MCP Interface. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 2.0 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7600Published

A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The …

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7645Published

A vulnerability was found in ruvnet sublinear-time-solver 1.5.0. Affected by this vulnerability is the function export_state of the file src/consciousness-explorer/mcp/server.js of the component MCP Interface. The manipulation results in pa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 2.0 · [email protected] · Secondary 6.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8115Published

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in p…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 2.0 · [email protected] · Secondary 5.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-91539Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privile…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91537Published

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Ora…

cve-program ·

Vendor product: Oracle Solaris

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91536Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91535Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allo…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91534Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91532Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91530Published

Vulnerability in Oracle GoldenGate (component: Admin Client Executable). Supported versions that are affected are 23.4-23.26.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromi…

cve-program ·

Vendor product: Oracle GoldenGate

CVSS 3.1 4.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91528Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91527Published

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP…

cve-program ·

Vendor product: Oracle ZFS Storage Appliance Kit

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-70382Published

Stored Cross-Site Scripting in Web Interface

cve-program ·

Vendor product: Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro · Vendor product: Cynap Pure (Next Gen), Cynap Bridge · Vendor product: Cynap Videobar

CVSS 4.0 5.1 · CVSS 3.1 4.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91526Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attack…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 4.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115728Published

@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

cve-program ·

Vendor product: @hapi/content

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116144Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116146Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116150Published

ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116154Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91524Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91523Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91521Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows lo…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91520Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows lo…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65630Published

Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65632Published

ECDSA signature length is not validated in jose, allowing signature malleability

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 5.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65631Published

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 6.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91519Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65629Published

Weak PBKDF2 parameters for password-encrypted private-key export in jose

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 7.4Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.