Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694275 source statements · aliases may refer to the same vulnerability

CVE-2026-112197Published

Missing Authentication for Critical Function in Tactis' NoviGest Desktop App

cve-program ·

Vendor product: NoviGest Desktop App

CVSS 4.0 9.4Source modified 28 Oct 2026Recorded 28 Oct 2026

RUSTSEC-2026-0414Published

Exponential event growth with `ENABLE_WIKILINKS`

osv ·

crates.io: pulldown-cmark

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-3415Published

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

cve-program ·

Vendor product: WSO2 API Manager · Vendor product: WSO2 Universal Gateway · Vendor product: WSO2 Traffic Manager

CVSS 3.1 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2025-13590Published

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

cve-program ·

Vendor product: WSO2 API Manager · Vendor product: WSO2 API Control Plane · Vendor product: WSO2 Universal Gateway

CVSS 3.1 9.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-118008Published

Privilege escalation in the DOM: Navigation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-48356Published

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

cve-program ·

Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source

CVSS 3.1 9.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2025-60475Published

A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

cve-program ·

Vendor product: n/a

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114730Published

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215…

cve-program ·

Vendor product: Webmail

CVSS 3.1 7.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114577Published

oretnom23 php-travel-agency-system Insertion insert.php sql injection

cve-program ·

Vendor product: php-travel-agency-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114726Published

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so …

cve-program ·

Vendor product: Webmail

CVSS 3.1 5.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114143Published

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-ta…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114139Published

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114130Published

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114126Published

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114122Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for webContents.beginFrameSubscr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.9Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113798Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused se…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114661Published

OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints

cve-program ·

Vendor product: openremote

CVSS 4.0 9.0 · CVSS 3.1 8.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114657Published

Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

cve-program ·

Vendor product: grav

CVSS 4.0 6.9 · CVSS 3.1 5.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114640Published

Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router

cve-program ·

Vendor product: traefik

CVSS 4.0 7.0 · CVSS 3.1 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114636Published

Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router

cve-program ·

Vendor product: traefik

CVSS 4.0 7.0 · CVSS 3.1 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114722Published

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle select…

cve-program ·

Vendor product: Webmail

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114718Published

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML…

cve-program ·

Vendor product: Webmail

CVSS 3.1 4.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114714Published

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path sepa…

cve-program ·

Vendor product: Webmail

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114574Published

massCodeIO massCode Local HTTP Service index.ts information disclosure

cve-program ·

Vendor product: massCode

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-76406Published

Information Disclosure through REST API Authentication in Splunk SOAR

cve-program ·

Vendor product: Splunk SOAR

CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-76305Published

Improper Access Control during App Downloads in Splunk SOAR

cve-program ·

Vendor product: Splunk SOAR

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-76301Published

Security Hardening in Splunk Enterprise - October 2026

cve-program ·

Vendor product: Splunk Enterprise

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-76297Published

Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 4.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114439Published

oretnom23 php-travel-agency-system Session session.php missing authentication

cve-program ·

Vendor product: php-travel-agency-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114382Published

TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow

cve-program ·

Vendor product: EX200

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-29001Published

TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization

cve-program ·

Vendor product: TastyIgniter

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-96640Published

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-96778Published

Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

cve-program ·

Vendor product: Pillow

CVSS 4.0 7.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-96641Published

Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise

cve-program ·

Vendor product: Pillow

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114379Published

EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion

cve-program ·

Vendor product: ekko-studio

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114143Published

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

cve-program ·

Vendor product: toml-node

CVSS 4.0 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114139Published

Sentry-Javascript: Middleware Bypass when using Tunnel route

cve-program ·

Vendor product: sentry-javascript

CVSS 4.0 9.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114376Published

leomoon-studios wiki-go API editor.go SourceHandler path traversal

cve-program ·

Vendor product: wiki-go

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114135Published

Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

cve-program ·

Vendor product: jupyter_server

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114438Published

Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-services

CVSS 3.1 4.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111809Published

Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 9.3 · CVSS 4.0 6.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114362Published

HarnessRouter Targets Test Endpoint app.py server-side request forgery

cve-program ·

Vendor product: HarnessRouter

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114267Published

SourceCodester Food Order Management System Admin Endpoint authorization

cve-program ·

Vendor product: Food Order Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114264Published

ProjectWorlds Advanced Library Management System edit_member.php sql injection

cve-program ·

Vendor product: Advanced Library Management System

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114130Published

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

cve-program ·

Vendor product: nuxt

CVSS 4.0 2.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114126Published

Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

cve-program ·

Vendor product: storybook

CVSS 4.0 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-89035Published

MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass

cve-program ·

Vendor product: RouterOS

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114261Published

MomoTommy file-management-system Files API FileController.php destroy missing authentication

cve-program ·

Vendor product: file-management-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114122Published

Electron: Frame subscription trusts GPU-supplied frame geometry

cve-program ·

Vendor product: electron

CVSS 3.1 3.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114258Published

oretnom23 file-management-system-php File Management files.php sql injection

cve-program ·

Vendor product: file-management-system-php

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.