Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

693857 source statements · aliases may refer to the same vulnerability

CVE-2026-72766Published

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-72765Published

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the express…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-72764Published

n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter othe…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.8 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-72763Published

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shar…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-72762Published

n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-72750Published

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, exte…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-72749Published

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65599Published

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65598Published

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but bef…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65597Published

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass al…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65596Published

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65595Published

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65594Published

n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65593Published

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing config…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-119122Published

Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119126Published

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107091Published

An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119130Published

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

cve-program ·

Vendor product: wasmtime

CVSS 4.0 2.1 · CVSS 3.1 2.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119134Published

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handles

cve-program ·

Vendor product: wasmtime

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119138Published

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trap

cve-program ·

Vendor product: wasmtime

CVSS 4.0 5.9 · CVSS 3.1 4.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119142Published

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Drop

cve-program ·

Vendor product: wasmtime

CVSS 4.0 5.9 · CVSS 3.1 4.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-31158Published

SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119118Published

Crawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107020Published

An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116097Published

CloudClassroom-PHP-Project addnewstudent.php cross site scripting

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116094Published

EyouCMS function.php remote_file_to_local server-side request forgery

cve-program ·

Vendor product: EyouCMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116061Published

SourceCodester Performance Indicator System edit_dealer.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-101987Published

Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113896Published

A race condition was addressed with additional validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116057Published

KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload

cve-program ·

Vendor product: KodExplorer

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116054Published

SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash

cve-program ·

Vendor product: SH3

CVSS 4.0 2.1 · CVSS 3.1 2.2 · CVSS 3.0 2.2 · CVSS 2.0 1.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107026Published

Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116185Published

OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

cve-program ·

Vendor product: core

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107032Published

Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116211Published

YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107037Published

Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note id.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116205Published

YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax

cve-program ·

Vendor product: yeswiki

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116201Published

Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

cve-program ·

Vendor product: snipe-it

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107042Published

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116197Published

Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

cve-program ·

Vendor product: contrast

CVSS 4.0 2.1 · CVSS 3.1 2.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116193Published

Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

cve-program ·

Vendor product: rclone

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107047Published

Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116189Published

rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

cve-program ·

Vendor product: rclone

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116181Published

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116177Published

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116169Published

SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

cve-program ·

Vendor product: siyuan

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107052Published

Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116165Published

Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116161Published

Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 6.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107058Published

An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

cve-program ·

Vendor product: n/a

Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.