Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

693902 source statements · aliases may refer to the same vulnerability

CVE-2026-62012Published

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Coinpress

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62017Published

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Good Homes

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116867Published

WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: dynamic-qr-code

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110687Published

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118075Published

WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-media-folders

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118080Published

WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: socialsnap

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119121Published

Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119125Published

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119129Published

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119133Published

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags

cve-program ·

Vendor product: wasmtime

CVSS 4.0 2.1 · CVSS 3.1 2.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119137Published

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

cve-program ·

Vendor product: wasmtime

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119141Published

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

cve-program ·

Vendor product: wasmtime

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119145Published

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

cve-program ·

Vendor product: frappe · Vendor product: frappe

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110686Published

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-88010Published

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurren…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110685Published

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115638Published

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

cve-program ·

Vendor product: Ironic

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110684Published

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-8hxf-qr8p-62x4Published

zip: AES Entry HMAC Authentication Bypass on Premature EOF

osv · CVE-2026-115906

crates.io: zip

MODERATESource modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-9hj8-73fh-9963Published

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

osv · CVE-2026-115907

crates.io: zip

HIGHSource modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-hjqx-j4rw-g7xvPublished

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

osv · CVE-2026-115908

crates.io: zip

HIGHSource modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-qr28-fpjm-wq7fPublished

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

osv · CVE-2026-118664

npm: decode-uri-component

HIGHSource modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97629Published

NGINX ngx_http_ssl_module vulnerability

cve-program ·

Vendor product: NGINX Plus · Vendor product: NGINX Open Source

CVSS 3.1 6.5 · CVSS 4.0 8.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-93479Published

NGINX map directive and regex matching vulnerability

cve-program ·

Vendor product: NGINX Plus · Vendor product: NGINX Open Source

CVSS 3.1 8.1 · CVSS 4.0 9.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91215Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91213Published

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low p…

cve-program ·

Vendor product: Oracle Business Process Management Suite

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-111280Published

snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea

cve-program ·

Vendor product: snap7

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91218Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 9.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-88941Published

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence …

cve-program ·

Vendor product: Network Agent · Vendor product: Administration Server

CVSS 4.0 6.2 · CVSS 3.1 5.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91219Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with…

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 8.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116857Published

WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-smart-filters

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116399Published

WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: instawp-connect

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-25467Published

WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

cve-program ·

https://wordpress.org/plugins: user-registration

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-39782Published

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: kali-forms

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-48202Published

WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

cve-program ·

https://wordpress.org/plugins: brave-popup-builder

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116402Published

WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

cve-program ·

https://wordpress.org/plugins: sureforms

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-39736Published

WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

cve-program ·

https://crocoblock.com: jet-engine

CVSS 3.1 8.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115712Published

Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings

cve-program ·

Vendor product: Elastic Cloud Enterprise

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-48884Published

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-frontend

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116846Published

WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-manager

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-52708Published

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-frontend

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116406Published

WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: webba-booking-lite

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116856Published

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: flexible-quantity-measurement-price-calculator-for-woocommerce

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110881Published

WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: suredash

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116849Published

WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: streamcast

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118088Published

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wpfunnels

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-114181Published

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ecab-taxi-booking-manager

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116850Published

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: happy-elementor-addons

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-25450Published

WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: user-registration

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54871Published

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: shopbuilder

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.