Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694159 source statements · aliases may refer to the same vulnerability

CVE-2026-115752Published

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 4.2Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-115730Published

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-r…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 3.1Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-100353Published

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix for GHSA-p6wj-qrr4-pgh5 lack a nil-items guard for legal OpenAPI 3.1 array schemas. An unauth…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 29 Oct 2026Recorded 31 Oct 2026

CVE-2026-77564Published

Talos Linux: Support bundle does not redact registry credentials

cve-program ·

Vendor product: talos

CVSS 3.1 3.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2025-62841Published

Hard-coded Cryptographic Key #2

cve-program ·

Vendor product: HBS 3 Hybrid Backup Sync · Vendor product: Hybrid Backup Sync

CVSS 4.0 8.7Source modified 29 Oct 2026Recorded 29 Oct 2026

RUSTSEC-2026-0417Published

Excessive CPU and memory use on crafted GraphQL documents

osv · GHSA-36rq-8957-mjrx

crates.io: juniper

Source modified 29 Oct 2026Recorded 29 Oct 2026

RUSTSEC-2026-0415Published

Unbounded memory use on large request bodies

osv · GHSA-pfrg-qg4f-grmv

crates.io: juniper_hyper

Source modified 29 Oct 2026Recorded 29 Oct 2026

RUSTSEC-2026-0419Published

Unbounded memory use on large request bodies

osv · GHSA-fj3h-2jc3-973v

crates.io: juniper_warp

Source modified 29 Oct 2026Recorded 29 Oct 2026

RUSTSEC-2026-0418Published

libz-sys build script leaks environment variables in the build directory

osv · GHSA-8p3x-q3q3-q3v5

crates.io: libz-sys

Source modified 29 Oct 2026Recorded 29 Oct 2026

RUSTSEC-2026-0416Published

Stack overflow on deeply nested GraphQL documents

osv · GHSA-34cw-x8g7-rcv5

crates.io: juniper

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-114358Published

SQL Injection Vulnerability in Radius Xenia M2M Platform

cve-program ·

Vendor product: Radius Xenia M2M Platform

CVSS 4.0 9.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115810Published

Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL

cve-program ·

Vendor product: recipes

CVSS 4.0 6.3 · CVSS 3.1 7.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-117611Published

Trust of compromised eMudhra root CA in bundled CA stores

cve-program ·

Vendor product: Checkmk

CVSS 4.0 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97860Published

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.

cve-program ·

Vendor product: YMS-VPN8 · Vendor product: YMS-VPN8-CP

CVSS 3.0 6.7 · CVSS 4.0 8.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-54668Published

Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config)

cve-program ·

Vendor product: kitodo-production

CVSS 4.0 8.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103665Published

The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may …

cve-program ·

Vendor product: Yamaha LAN Monitor for Windows

CVSS 3.0 7.8 · CVSS 4.0 8.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119028Published

oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

cve-program ·

Vendor product: oapi-codegen

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113688Published

Server-Side Request Forgery in BMC ITSM SmartIT

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113689Published

Stored Cross-Site Scripting in BMC ITSM Work Notes

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 5.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113690Published

Stored Cross-Site Scripting in BMC ITSM Attachments

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 4.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-39902Published

Cacti: Authenticated RCE on Data Input

cve-program ·

Vendor product: cacti

CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113691Published

Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 5.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119049Published

FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

cve-program ·

Vendor product: FreeMail

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-119053Published

lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()

cve-program ·

https://savannah.nongnu.org/projects/lwip/: lwIP

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113692Published

Path Traversal in BMC ITSM

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 6.9Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-55463Published

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

cve-program ·

Vendor product: goobi-viewer-core

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113693Published

System Account Credential Disclosure in BMC ITSM

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-46347Published

Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

cve-program ·

Vendor product: goobi-viewer-core

CVSS 3.1 6.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-55442Published

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

cve-program ·

Vendor product: goobi-viewer-core

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-92152Published

F´: Unvalidated Port Index in GenericHub

cve-program ·

Vendor product: fprime

CVSS 4.0 9.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115457Published

baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments

cve-program ·

Vendor product: basercms

CVSS 3.1 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-92158Published

F´: FpySequencer Integer Overflow in Stack Offset/Size Validation Leading to Out-of-Bounds Write

cve-program ·

Vendor product: fprime

CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-56838Published

PraisonAI recipe.run_stream skips dangerous-tool policy enforcement

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 7.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-100413Published

SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

cve-program ·

Vendor product: seaweedfs

CVSS 4.0 7.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113694Published

Improper Authorization in BMC ITSM SmartIT Attachments

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-55572Published

e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

cve-program ·

Vendor product: e107

CVSS 3.1 10.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113695Published

Reflected Cross-Site Scripting in BMC ITSM SmartIT

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 4.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113696Published

Improper Authorization in BMC ITSM SmartIT Change Approvals

cve-program ·

Vendor product: BMC IT Service Management Suite

CVSS 4.0 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-114614Published

Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

cve-program ·

Vendor product: authlib

CVSS 3.1 2.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-113697Published

Reflected Cross-Site Scripting in BMC Helix Operations Management

cve-program ·

Vendor product: BMC Helix Operations Management

CVSS 4.0 4.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-55786Published

Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`

cve-program ·

Vendor product: flyto-core

CVSS 3.1 8.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115355Published

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

cve-program ·

Vendor product: mistune

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-17630Published

Malicious code in virgil-cli (npm)

osv ·

npm: virgil-cli

Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-17710Published

Malicious code in pxnpm (npm)

osv ·

npm: pxnpm

Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-18059Published

Malicious code in claude-desktop-setup (npm)

osv · GHSA-f4mf-vhm8-xxqc

npm: claude-desktop-setup

Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-17891Published

Malicious code in asistenyorstore (npm)

osv · GHSA-qgh5-36wr-3vvw

npm: asistenyorstore

Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-17399Published

Malicious code in monte-md-baileys (npm)

osv ·

npm: monte-md-baileys

Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-17619Published

Malicious code in dzyclutch (npm)

osv · GHSA-36rj-4crv-cmgm

npm: dzyclutch

Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-17622Published

Malicious code in dzyhaxz-baileys (npm)

osv · GHSA-xwv2-25hq-j64g

npm: dzyhaxz-baileys

Source modified 29 Oct 2026Recorded 29 Oct 2026

MAL-2026-17381Published

Malicious code in @wanzlonely/bails4u (npm)

osv · GHSA-4327-j8v7-q48w

npm: @wanzlonely/bails4u

Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.