Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694176 source statements · aliases may refer to the same vulnerability

CVE-2026-114079Published

Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111057Published

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

cve-program ·

Vendor product: mercury

CVSS 3.1 10.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114074Published

Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-pjr3-86v4-5p7wPublished

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

osv · CVE-2026-111920 · GO-2026-6745

Go: code.vikunja.io/api

MODERATESource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-vmg4-6gfg-83qxPublished

ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

osv · CVE-2026-71553

npm: apostrophe

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111064Published

aiohttp server lacks an initial request/header timeout

cve-program ·

Vendor product: aiohttp

CVSS 4.0 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111750Published

AIOHTTP: Pure-Python parser request smuggling

cve-program ·

Vendor product: aiohttp

CVSS 4.0 6.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114064Published

Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint

cve-program ·

Vendor product: snipe-it

CVSS 4.0 5.1 · CVSS 3.1 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114076Published

Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112395Published

Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)

cve-program ·

Vendor product: Pillow

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114081Published

Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114059Published

ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization

cve-program ·

Vendor product: arcadedb

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114086Published

Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114071Published

Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114066Published

Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112399Published

Pillow: APNG background disposal allocates full canvas before decompression bomb check

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114061Published

SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

cve-program ·

Vendor product: kit

CVSS 4.0 2.3 · CVSS 3.1 4.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112404Published

Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114056Published

ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH

cve-program ·

Vendor product: arcadedb

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112945Published

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114054Published

vLLM before 0.31.0 Cross-Request Cache Aliasing via EXIF ImageID and Prefix-Cache Keys

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114051Published

vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112898Published

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

cve-program ·

Vendor product: Pillow

CVSS 4.0 6.9Source modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-hh27-hf48-9f5qPublished

LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

osv · CVE-2026-45357

npm: liquidjs

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-44xr-mrhh-qm78Published

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

osv · CVE-2026-84312 · GO-2026-6773

Go: github.com/0xJacky/Nginx-UI

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-wmg3-h8mf-wgvrPublished

mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

osv · CVE-2026-61459 · PYSEC-2026-3685

npm: mcp-server-kubernetes

CRITICALSource modified 28 Oct 2026Recorded 28 Oct 2026

GHSA-gfrc-g87h-7h5wPublished

Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover

osv · CVE-2026-84313 · GO-2026-6786

Go: github.com/0xJacky/Nginx-UI

HIGHSource modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114049Published

vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense

cve-program ·

Vendor product: vllm

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112893Published

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114044Published

FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2021-48020Published

Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

cve-program ·

Vendor product: vyper

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112911Published

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

cve-program ·

Vendor product: filelock

CVSS 3.1 6.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114091Published

Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2020-37287Published

Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

cve-program ·

Vendor product: vyper

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113738Published

R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal

cve-program ·

Vendor product: Jackrong-llm-finetuning-guide

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113707Published

a2aproject a2a-rs inmemory.rs update race condition

cve-program ·

Vendor product: a2a-rs

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113776Published

virtualenv activation scripts run code from a path that contains a placeholder name

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87397Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87396Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87394Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87393Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87392Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network acce…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87388Published

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Configurator

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87377Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87364Published

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle Service Bus

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87391Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker wi…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87390Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87389Published

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Human Resources Management

CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87387Published

Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (component: Homebuilder Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Homebuilder

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87386Published

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with ne…

cve-program ·

Vendor product: JD Edwards EnterpriseOne General Ledger

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.