Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

693894 source statements · aliases may refer to the same vulnerability

CVE-2026-28854Published

The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified app may not be prevented from launching.

cve-program ·

Vendor product: macOS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118656Published

Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

cve-program ·

Vendor product: echo

CVSS 3.1 6.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118660Published

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

cve-program ·

Vendor product: happy-dom

CVSS 3.1 8.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118664Published

decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

cve-program ·

Vendor product: decode-uri-component

CVSS 4.0 8.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118668Published

LangGraph JavaScript custom authentication may permit cross-user Store access

cve-program ·

Vendor product: langgraph-api

CVSS 4.0 8.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118690Published

Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

cve-program ·

Vendor product: signalk-server

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118694Published

python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations

cve-program ·

Vendor product: python-markdown2

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118755Published

Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path

cve-program ·

Vendor product: personal-management-system

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118804Published

Bricks Broken Access Control via query_result Endpoint

cve-program ·

Vendor product: Bricks Builder

CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54455Published

OpenCATS: Authenticated SQL injection in activity DataGrid date filters

cve-program ·

Vendor product: OpenCATS

CVSS 3.1 7.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-111946Published

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

cve-program ·

https://cpan.org/modules: Plack-Middleware-ETag

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-61573Published

AVideo-Encoder: reflected cross-site scripting in the login interface

cve-program ·

Vendor product: AVideo-Encoder

CVSS 3.1 6.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-61575Published

AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

cve-program ·

Vendor product: AVideo-Encoder

CVSS 3.1 4.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118538Published

a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

cve-program ·

Vendor product: a2ui

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-82411Published

Objects API: Cross-object-type authorization bypass on the object history-detail endpoint

cve-program ·

Vendor product: open-object

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118579Published

D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

cve-program ·

Vendor product: DIR-505

CVSS 4.0 9.3 · CVSS 3.1 9.8 · CVSS 3.0 9.8 · CVSS 2.0 10.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118589Published

nschloe meshio VTK Reader _vtk_42.py memory allocation

cve-program ·

Vendor product: meshio

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-117859Published

Keycloak-services: keycloak-services: par single-use bypass via flow restart

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-services

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119027Published

oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

cve-program ·

Vendor product: oapi-codegen

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119048Published

JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module

cve-program ·

Vendor product: JeeSite

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119052Published

llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-60111Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118092Published

WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: masterstudy-lms-learning-management-system

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-39737Published

WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-elements

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54853Published

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: profile-builder

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97073Published

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: mycred

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-48200Published

WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: document-library-lite

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110688Published

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110244Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119141Published

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the hos…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-119137Published

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-lev…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-110190Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113576Published

Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

cve-program ·

Vendor product: Adobe Digital Editions

CVSS 3.1 6.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-104314Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103092Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-90991Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-42690Published

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: learnpress

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54858Published

WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Printy

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54866Published

WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: razorpay-payment-button-elementor

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-61993Published

WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: blockonomics-bitcoin-payments

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62001Published

WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Marcell

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62006Published

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Nuts

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62012Published

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Coinpress

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62017Published

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Good Homes

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116867Published

WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: dynamic-qr-code

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110687Published

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118075Published

WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-media-folders

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118080Published

WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: socialsnap

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119121Published

Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119125Published

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.