Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

693887 source statements · aliases may refer to the same vulnerability

CVE-2026-62002Published

WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Meals & Wheels

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-61995Published

WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: youtube-showcase

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-67203Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-61988Published

WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: auction-nudge

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54859Published

WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Preservation

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-42692Published

WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wp-crowdfunding

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-67205Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-18894Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-104309Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-104316Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-25448Published

WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: erp

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118097Published

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: html5-video-player

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-65592Published

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65591Published

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achiev…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65590Published

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesys…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65589Published

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can re…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65016Published

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent ass…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-65015Published

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that h…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-59259Published

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-59257Published

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-59254Published

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret valu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-59158Published

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nux…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-58661Published

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56778Published

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execution retry endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56777Published

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypas…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 5.0Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56776Published

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user wi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 7.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56775Published

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating evaluation test-run endpoints that authorize state-changing actions using the workflow:read scope instead of the action-appropriate workflow:e…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56359Published

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.8 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56358Published

n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious sc…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56356Published

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.1…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-56354Published

n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox polic…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 4.1 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-54162Published

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without ne…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-118663Published

@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make rou…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-118655Published

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-116796Published

Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker wh…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2Source modified 29 Oct 2026Recorded 5 Nov 2026

CVE-2026-115893Published

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditio…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-105923Published

Null-pointer dereference in QTriangulator reachable through VectorImage

cve-program ·

Vendor product: Qt

CVSS 4.0 4.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-70387Published

OnePlus OxygenOS exposed dangerous method vulnerability

cve-program ·

Vendor product: OxygenOS

CVSS 4.0 8.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97206Published

DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

cve-program ·

Vendor product: Unbound

CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-96405Published

Aggregate DNS name chained pointer decompression work leads to degradation of service.

cve-program ·

Vendor product: Unbound

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-50106Published

Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

cve-program ·

Vendor product: Unbound

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-35501Published

Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.

cve-program ·

Vendor product: Unbound

CVSS 3.1 3.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-109125Published

Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'

cve-program ·

Vendor product: Unbound

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-92387Published

never-ending loop via server response omission

cve-program ·

Vendor product: curl

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-101103Published

HMS Networks PEAK-System PCAN Windows drivers Classic Buffer Overflow

cve-program ·

Vendor product: PEAK-System Device Driver Setup · Vendor product: PCAN Windows CAN device drivers

CVSS 3.1 5.5 · CVSS 4.0 6.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-92386Published

server-set cookie aborts cookie jar load

cve-program ·

Vendor product: curl

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-87866Published

wolfSSL public-key pinning bypass

cve-program ·

Vendor product: curl

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-114696Published

WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: page-and-post-restriction

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-109576Published

HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write

cve-program ·

Vendor product: PEAK-System Device Driver Setup · Vendor product: PCAN Windows CAN device drivers

CVSS 3.1 5.5 · CVSS 4.0 6.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-112380Published

Missing authorization in the WhatsApp channel in Kiro Crew

cve-program ·

Vendor product: Kiro Crew

CVSS 3.1 9.9 · CVSS 4.0 9.0Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.