Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694160 source statements · aliases may refer to the same vulnerability

CVE-2026-118169Published

Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter

cve-program ·

Vendor product: Hustle – Email Marketing, Lead Generation, Optins, Popups

CVSS 3.1 4.9Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-76005Published

WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute

cve-program ·

Vendor product: WP Inventory Manager

CVSS 3.1 6.5Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-109975Published

Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

cve-program ·

Vendor product: Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox

CVSS 3.1 6.4Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-92797Published

Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter

cve-program ·

Vendor product: Memberpress

CVSS 3.1 8.8Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-101935Published

Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter

cve-program ·

Vendor product: Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search

CVSS 3.1 6.1Source modified 29 Oct 2026Recorded 29 Oct 2026

CVE-2026-85655Published

Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow

cve-program ·

Vendor product: Enable Media Replace

CVSS 3.1 4.3Source modified 29 Oct 2026Recorded 29 Oct 2026

GHSA-w658-mh9p-ww8fPublished

Backstage catalog rules can be bypassed for URL locations using encoded path segments

osv · CVE-2026-115923

npm: @backstage/plugin-catalog-backend · npm: @backstage/plugin-catalog-backend

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-3f7j-7jwc-fxfjPublished

systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

osv · CVE-2026-116576

npm: systeminformation

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111478Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111486Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111575Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2023-54404Rejected

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application…

nvd ·

Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-0631Published

Authenticated Command Injection Vulnerability in Surfshark VPN Login in multiple Archer products

cve-program ·

Vendor product: Archer BE230 v1.2 · Vendor product: Archer AXE75 v1 · Vendor product: Archer BE3600 v1

CVSS 4.0 8.5Source modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-97r2-qh9m-474hPublished

Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

osv · CVE-2026-116581

npm: seroval

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-4w3g-jfj2-cw2qPublished

Go JOSE: Panic during CBC-HMAC processing

osv · CVE-2026-116585

Go: github.com/go-jose/go-jose/v4 · Go: github.com/go-jose/go-jose/v3

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-wp97-x4hv-qvhpPublished

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

osv · CVE-2026-116584

npm: seroval

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-m665-v7pm-7grjPublished

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

osv · CVE-2026-115905

crates.io: zip

CRITICALSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-f86p-h4j2-7qgjPublished

Seroval: Code injection through a typed array's own constructor property

osv · CVE-2026-116583

npm: seroval

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-5324-3w58-qpp2Published

Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

osv · CVE-2026-116575

PyPI: mem0ai · npm: mem0ai

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-vvm8-gf78-28g4Published

Go JOSE: Panics in JSON parsing

osv · CVE-2026-116586

Go: github.com/go-jose/go-jose/v4 · Go: github.com/go-jose/go-jose/v3

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-4vjg-vx72-qq4gPublished

systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net

osv · CVE-2026-116673

npm: systeminformation

LOWSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-7648-jmwf-vw7jPublished

systeminformation has prototype pollution in `networkStats()` via the interface name

osv · CVE-2026-116674

npm: systeminformation

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-mghf-wjfp-p5xmPublished

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

osv · CVE-2026-115893 · RUSTSEC-2026-0379

crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime

CRITICALSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-9wx9-5pv9-3349Published

Seroval: Script injection through RegExp sources in serialized output

osv · CVE-2026-116582

npm: seroval · npm: seroval

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-ch52-4w7c-c8xpWithdrawn

Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses

osv · CVE-2026-93748

npm: http-cache-semantics

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-7rv5-mrxv-xcr9Published

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

osv · CVE-2026-116580

npm: seroval

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-3cmx-xjww-583xPublished

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

osv · CVE-2026-118258

npm: i18next-http-backend

LOWSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-gg6h-894w-4m9cPublished

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

osv · CVE-2026-116795

npm: re2js

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2023-54404Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size lim…

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-70354Published

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8 · CVSS 3.1 · [email protected] · Primary 7.8Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-62898Published

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-62886Published

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-62871Published

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 28 Oct 2026Recorded 29 Oct 2026

GHSA-mp66-8ww2-pcwmPublished

GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

osv · CVE-2026-118666

npm: @graphql-tools/executor-legacy-ws

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-c8p4-j97h-3vg8Published

Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML

osv · CVE-2026-118660

npm: happy-dom

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-83rm-6c8r-g728Published

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

osv · CVE-2026-118257

npm: vue-i18n · npm: vue-i18n · npm: vue-i18n

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-9jhj-wvmw-cfx5Published

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

osv · CVE-2026-115730

npm: i18next-http-backend

LOWSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-434m-5hcj-pxf3Published

GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

osv · CVE-2026-118665

npm: @graphql-tools/executor-legacy-ws

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-5fpq-26gf-qwcrPublished

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

osv · CVE-2026-118661

npm: happy-dom

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-w47m-j727-m843Withdrawn

Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

osv ·

npm: i18next-http-backend

LOWSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-2f48-3555-fpx6Published

nodejs-whisper allows OS command injection through crafted audio file paths

osv · CVE-2026-110644

npm: nodejs-whisper

CRITICALSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-rmxm-3fg6-px4fPublished

@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

osv · CVE-2026-118663

npm: @hono/node-server

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-8rc2-428q-7ww3Published

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

osv · CVE-2026-118256

npm: vue-i18n · npm: vue-i18n · npm: @intlify/core

LOWSource modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-102479Published

In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this l…

cve-program ·

Vendor product: Eclipse Vert.x

CVSS 4.0 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91243Published

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low p…

cve-program ·

Vendor product: Oracle Business Process Management Suite

CVSS 3.1 9.6Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91242Published

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins). The supported version that is affected is 11.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Or…

cve-program ·

Vendor product: Oracle Solaris

CVSS 3.1 7.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91241Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 9.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91240Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91239Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91261Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with ne…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 3.1Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.