Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694160 source statements · aliases may refer to the same vulnerability

CVE-2026-87880Published

Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

cve-program ·

Vendor product: Acronis Cyber Protect 17

CVSS 3.0 6.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2025-30414Published

Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.

cve-program ·

Vendor product: Acronis Cyber Protect Cloud Agent · Vendor product: Acronis Cyber Protect 17

CVSS 3.0 7.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-87102Published

Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.

cve-program ·

Vendor product: Acronis Cyber Protect 17

CVSS 3.0 7.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-87878Published

Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 42587.

cve-program ·

Vendor product: Acronis Cyber Protect 17

CVSS 3.0 6.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103780Published

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …

cve-program ·

Vendor product: PowerProtect Data Domain

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103792Published

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through …

cve-program ·

Vendor product: PowerProtect Data Domain Management Center

CVSS 3.1 9.6Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-81472Published

Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerabi…

cve-program ·

Vendor product: iDRAC Service Module for Windows · Vendor product: iDRAC Service Module for Linux · Vendor product: iDRAC Service Module for ESXi

CVSS 3.1 4.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-109516Published

Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token

cve-program ·

Vendor product: Bot for Telegram on WooCommerce

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-96741Published

DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption

cve-program ·

Vendor product: DSGVO All in one for WP

CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-96669Published

Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie

cve-program ·

Vendor product: Food Store – Online Food Delivery & Pickup

CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-93855Published

SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter

cve-program ·

Vendor product: SendPress Newsletters

CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-93904Published

Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter

cve-program ·

Vendor product: Social Web Suite – Social Media Auto Post, Social Media Auto Publish

CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-96666Published

Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter

cve-program ·

Vendor product: Schema App Structured Data

CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-96228Published

SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover

cve-program ·

Vendor product: SSL Wireless SMS Notification

CVSS 3.1 8.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-93757Published

Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite

cve-program ·

Vendor product: Wild Apricot Login

CVSS 3.1 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-93293Published

Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler

cve-program ·

Vendor product: Password Protected – Protect Your Site Content With a Password

CVSS 3.1 6.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103485Published

Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property

cve-program ·

Vendor product: Extensions for Leaflet Map

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-118192Published

JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute

cve-program ·

Vendor product: JoomSport – for Sports: Team & League, Football, Hockey & more

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103875Published

Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links

cve-program ·

Vendor product: Media Library Assistant

CVSS 3.1 4.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-110707Published

RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element

cve-program ·

Vendor product: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

CVSS 3.1 4.7Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107629Published

Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText

cve-program ·

Vendor product: Greenshift – animation and page builder blocks

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107627Published

Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block

cve-program ·

Vendor product: Greenshift – animation and page builder blocks

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91152Published

Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter

cve-program ·

Vendor product: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

CVSS 3.1 6.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-109215Published

LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization

cve-program ·

Vendor product: LiteSpeed Cache

CVSS 3.1 6.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-104727Published

Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys

cve-program ·

Vendor product: Sequential Order Numbers for WooCommerce

CVSS 3.1 6.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-116763Published

LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)

cve-program ·

Vendor product: LiteSpeed Cache

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-91153Published

Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

cve-program ·

Vendor product: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI

CVSS 3.1 5.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-111422Published

Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host

cve-program ·

https://pypi.python.org: apache-airflow-providers-ssh

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-107743Published

Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter

cve-program ·

Vendor product: Mapster WP Maps

CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-111318Published

HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink

cve-program ·

Vendor product: HT Mega Addons for Elementor – Elementor Widgets & Template Builder

CVSS 3.1 5.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-105192Published

LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization

cve-program ·

https://pypi.org/project/lmcache/: lmcache

CVSS 3.1 9.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-73581Published

Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

cve-program ·

Vendor product: Apache Tomcat

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-37982Published

Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay

cve-program ·

https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator

CVSS 3.1 6.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-37979Published

Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass

cve-program ·

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2023-3397Published

Kernel: slab-use-after-free write in txend due to race condition

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: kernel · https://access.redhat.com/downloads/content/package-browser/: kernel · https://access.redhat.com/downloads/content/package-browser/: kernel-rt

CVSS 3.1 7.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-117174Rejected

VUL-2026-008368 為先回報之相同問題

cve-program ·

Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-39991Published

Stored Cross-Site Scripting (XSS) in Note Station file upload functionality

cve-program ·

Vendor product: Notes Station 3

CVSS 4.0 4.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-32557Published

WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woocommerce-appointments

CVSS 3.1 9.3Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97324Published

YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization

cve-program ·

Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-97320Published

YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery

cve-program ·

Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-57210Published

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Fo…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115392Published

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux k…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Secondary 7.9Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115388Published

wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write allowance for WASIp2 outgoing HTTP bodies, so oversized writes succeed instead of trapping. A mal…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 6.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-115384Published

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply componen…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Secondary 9.9Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-114665Published

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a sym…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-106764Published

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2022-51026Published

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.8Source modified 29 Oct 2026Recorded 30 Oct 2026

CVE-2026-86385Published

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading …

cve-program ·

Vendor product: PowerProtect Data Domain

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-86380Published

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …

cve-program ·

Vendor product: PowerProtect Data Domain

CVSS 3.1 7.2Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-103779Published

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …

cve-program ·

Vendor product: PowerProtect Data Domain

CVSS 3.1 8.3Source modified 29 Oct 2026Recorded 29 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.