Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

693857 source statements · aliases may refer to the same vulnerability

CVE-2026-56778Published

n8n - Authorization Bypass in Public API Execution Retry Endpoint

cve-program ·

Vendor product: n8n · Vendor product: n8n

CVSS 4.0 5.3 · CVSS 3.1 6.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56777Published

n8n - AST Validator Bypass in Python Code Node

cve-program ·

Vendor product: n8n · Vendor product: n8n

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56776Published

n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint

cve-program ·

Vendor product: n8n · Vendor product: n8n · Vendor product: n8n

CVSS 4.0 5.3 · CVSS 3.1 7.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56775Published

n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints

cve-program ·

Vendor product: n8n · Vendor product: n8n · Vendor product: n8n

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56379Published

ImageMagick - Command Injection via SVG Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56378Published

ImageMagick - Heap Out-of-Bounds Read in PCD Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56377Published

ImageMagick - Policy Bypass via Incorrect Path Validation

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56376Published

ImageMagick - Heap Use-After-Free in Meta Coder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56373Published

ImageMagick - Use-After-Free Write in PDB Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56371Published

ImageMagick - Memory Leak in TXT File Processing via Texture Attribute

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56370Published

ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56369Published

ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56368Published

ImageMagick - Memory Leak in Raw Pixel Data Coders

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56366Published

ImageMagick - Memory Leak in META Reader APP1JPEG Error Path

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56365Published

ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56363Published

ImageMagick - Division by Zero in Binomial Kernel Processing

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56362Published

ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 2.1 · CVSS 3.1 3.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56361Published

ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56359Published

n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL

cve-program ·

Vendor product: n8n · Vendor product: n8n

CVSS 4.0 4.8 · CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56358Published

n8n - Stored Cross-Site Scripting in Form Trigger Node

cve-program ·

Vendor product: n8n · Vendor product: n8n · Vendor product: n8n

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56356Published

n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field

cve-program ·

Vendor product: n8n · Vendor product: n8n · Vendor product: n8n

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56354Published

n8n - Cross-Site Scripting and Open Redirect in Form Node

cve-program ·

Vendor product: n8n · Vendor product: n8n · Vendor product: n8n

CVSS 4.0 5.1 · CVSS 3.1 4.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-55202Published

Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

cve-program ·

Vendor product: tinyproxy

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54390Published

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

cve-program ·

Vendor product: JTL Shop

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-53987Published

Tag Plugin for GLPI 11 before 2.14.4 Stored Cross-Site Scripting in Kanban Badge Rendering

cve-program ·

Vendor product: tag

CVSS 4.0 7.3 · CVSS 3.1 6.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-47119Published

Agent Zero < 1.15 Stored XSS via image_get API Endpoint

cve-program ·

Vendor product: agent-zero

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-43629Published

llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-43628Published

llama.cpp b3978–b9058 Integer Underflow via DRY Sampler

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-43627Published

llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-43622Published

llama.cpp b1886–b7445 Double Free via llama-android.cpp

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-41401Published

libyang - Heap Use-After-Free Write in XML Metadata Parsing

cve-program ·

Vendor product: libyang

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-40037Published

OpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-35632Published

OpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 6.9 · CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-32989Published

Precurio Intranet Portal 4.4: Cross-Site Request Forgery leading to arbitrary file upload

cve-program ·

Vendor product: Precurio Intranet Portal

CVSS 4.0 8.6 · CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-22185Published

OpenLDAP LMDB mdb_load Heap Buffer Underflow in readline()

cve-program ·

Vendor product: OpenLDAP

CVSS 4.0 4.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-109266Published

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105215Published

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105212Published

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105210Published

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105209Published

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 9.3 · CVSS 3.1 9.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105208Published

ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 8.7 · CVSS 3.1 7.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105207Published

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105206Published

ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105081Published

ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 2.0 · CVSS 3.1 3.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-104436Published

Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

cve-program ·

Vendor product: zebra · Vendor product: zebra-chain

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-104085Published

odt2spip < 4.4.0 OS Command Injection via Document Filename

cve-program ·

Vendor product: odt2spip

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-100834Published

http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

cve-program ·

Vendor product: http4k · Vendor product: http4k · Vendor product: http4k

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-100725Published

http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

cve-program ·

Vendor product: http4k · Vendor product: http4k · Vendor product: http4k

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-100724Published

http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

cve-program ·

Vendor product: http4k · Vendor product: http4k · Vendor product: http4k

CVSS 4.0 6.3 · CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-100709Published

Froxlor before 2.3.11 2FA Bypass via Namespace Confusion

cve-program ·

Vendor product: froxlor

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.