Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694117 source statements · aliases may refer to the same vulnerability

CVE-2026-119052Published

llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-60111Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118092Published

WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: masterstudy-lms-learning-management-system

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-39737Published

WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-elements

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54853Published

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: profile-builder

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97073Published

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: mycred

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-48200Published

WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: document-library-lite

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110688Published

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110244Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119141Published

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the may_leave flag is not cleared during realloc. Attackers can call into the hos…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-119137Published

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-lev…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-110190Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113576Published

Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

cve-program ·

Vendor product: Adobe Digital Editions

CVSS 3.1 6.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-104314Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103092Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-90991Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-42690Published

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: learnpress

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54858Published

WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Printy

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54866Published

WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: razorpay-payment-button-elementor

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-61993Published

WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: blockonomics-bitcoin-payments

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62001Published

WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Marcell

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62006Published

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Nuts

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62012Published

WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Coinpress

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-62017Published

WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Good Homes

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116867Published

WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: dynamic-qr-code

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110687Published

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118075Published

WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-media-folders

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118080Published

WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: socialsnap

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119121Published

Crawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119125Published

Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119129Published

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval

cve-program ·

Vendor product: zitadel · Vendor product: zitadel

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119133Published

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags

cve-program ·

Vendor product: wasmtime

CVSS 4.0 2.1 · CVSS 3.1 2.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119137Published

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registry

cve-program ·

Vendor product: wasmtime

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119141Published

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via realloc

cve-program ·

Vendor product: wasmtime

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119145Published

Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

cve-program ·

Vendor product: frappe · Vendor product: frappe

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110686Published

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-88010Published

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurren…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110685Published

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115638Published

OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb.

cve-program ·

Vendor product: Ironic

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110684Published

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify

cve-program ·

https://cpan.org/modules: Cpanel-JSON-XS

Source modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-8hxf-qr8p-62x4Published

zip: AES Entry HMAC Authentication Bypass on Premature EOF

osv · CVE-2026-115906

crates.io: zip

MODERATESource modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-9hj8-73fh-9963Published

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

osv · CVE-2026-115907

crates.io: zip

HIGHSource modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-hjqx-j4rw-g7xvPublished

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

osv · CVE-2026-115908

crates.io: zip

HIGHSource modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-qr28-fpjm-wq7fPublished

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

osv · CVE-2026-118664

npm: decode-uri-component

HIGHSource modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97629Published

NGINX ngx_http_ssl_module vulnerability

cve-program ·

Vendor product: NGINX Plus · Vendor product: NGINX Open Source

CVSS 3.1 6.5 · CVSS 4.0 8.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-93479Published

NGINX map directive and regex matching vulnerability

cve-program ·

Vendor product: NGINX Plus · Vendor product: NGINX Open Source

CVSS 3.1 8.1 · CVSS 4.0 9.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91215Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91213Published

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low p…

cve-program ·

Vendor product: Oracle Business Process Management Suite

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-111280Published

snap7 through 1.4.3 Out-of-Bounds Write via TSnap7MicroClient::opReadArea

cve-program ·

Vendor product: snap7

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91218Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 9.6Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.