Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

692485 source statements · aliases may refer to the same vulnerability

CVE-2025-60467Published

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

cve-program ·

Vendor product: n/a

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112415Published

An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112646Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt pro…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-84496Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel…

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113939Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113943Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113907Published

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112457Published

A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination …

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112708Published

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112544Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a malicious disk image may cause unexpected system termination.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113913Published

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processi…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86971Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Proces…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112614Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112634Published

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112633Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciou…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112629Published

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112471Published

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected process termination.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-66302Published

Skype for Business Remote Code Execution Vulnerability

cve-program ·

Vendor product: Skype for Business Server 2015 CU13 · Vendor product: Skype for Business Server 2019 CU8 · Vendor product: Skype for Business Server Subscription Edition CU1

CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116802Published

DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-62688Published

Windows MIDI Service Module Elevation of Privileges Vulnerability

cve-program ·

Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2 · Vendor product: Windows 11 version 26H1

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-61346Published

Windows Graphics Kernel Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2 · Vendor product: Windows 10 Version 22H2

CVSS 3.1 7.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-90848Published

Governikus AusweisApp StartPAOSResponse cross site scripting

cve-program ·

Vendor product: AusweisApp

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112556Published

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the applic…

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-63706Published

NPM package next-npm-version1.0.1 is vulnerable to Command injection.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-21727Published

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-25542Published

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, trusted resources verification policies match a resource sou…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-26171Published

Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-28291Published

simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git option manipulation, bypassing safety checks meant to block dangerous options like -u and …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-29050Published

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file — for example through pull-request-driven CI or build…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-29051Published

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, `melange lint --persist-lint-results` (opt-in flag, also usable via `melange build --persist-lint-results`) cons…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.4 · CVSS 3.1 · [email protected] · Primary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-29180Published

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boun…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.9 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-32178Published

Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33031Published

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account d…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33544Published

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct f…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33750Published

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33805Published

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip pro…

nvd ·

CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 8.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33808Published

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via dupl…

nvd ·

CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 9.1 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33815Published

Memory-safety vulnerability in github.com/jackc/pgx/v5.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33877Published

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33889Published

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in the @apostrophecms/color-field module, where color values prefixed with -- bypass TinyColor …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33891Published

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigIntege…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33895Published

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33904Published

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 in…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33907Published

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS message missing IEs. An attacker able to send crafted NAS messages to Ella Core can c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33916Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime resolves partial names via a plain property lookup on `options.partials` without gu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7 · CVSS 3.1 · [email protected] · Primary 4.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33937Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33938Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33939Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled templat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33940Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33941Published

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file na…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 8.2 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.