Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694275 source statements · aliases may refer to the same vulnerability

CVE-2026-113798Published

Electron: Pointer lock permission requests can be attributed to the wrong frame

cve-program ·

Vendor product: electron

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113794Published

pypdf: Possible infinite loop when hitting EOF in standard xref table

cve-program ·

Vendor product: pypdf

CVSS 4.0 6.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113790Published

pypdf: Possible large memory usage when parsing arrays and dictionaries

cve-program ·

Vendor product: pypdf

CVSS 4.0 6.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114255Published

oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection

cve-program ·

Vendor product: file-management-system-php

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-5821Published

Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection

cve-program ·

Vendor product: Image Optimizer – Compress Images and Convert to WebP or AVIF

CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-11592Published

Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action

cve-program ·

Vendor product: Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2024-58379Published

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114252Published

itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection

cve-program ·

Vendor product: Sales-and-Inventory-System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113786Published

pypdf: Unvalidated JPEG image data loading

cve-program ·

Vendor product: pypdf

CVSS 4.0 2.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112155Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111467Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-18326Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111479Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-12534Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111563Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114249Published

dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization

cve-program ·

Vendor product: Insurance-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114113Published

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114103Published

adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous getDataAsync() path in methods/inflater.js. Attackers can craft ZIP entries with falsified …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114088Published

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_E…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114073Published

Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment logs by serializing unredacted envVars. Attackers with access to terminal transcripts, CI debu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.8 · CVSS 3.1 · [email protected] · Secondary 5.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-114402Published

Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload

cve-program ·

Vendor product: trudesk

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114397Published

Trudesk through 1.2.11 Missing Authentication on Debug Routes

cve-program ·

Vendor product: trudesk

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114392Published

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid

cve-program ·

Vendor product: trudesk

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114387Published

Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

cve-program ·

Vendor product: shopper

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114242Published

dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection

cve-program ·

Vendor product: Insurance-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-71195Published

In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public s…

cve-program ·

Vendor product: Manila

CVSS 3.1 9.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113743Published

Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal

cve-program ·

Vendor product: tt-metal

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114118Published

Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound

cve-program ·

Vendor product: vyper

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114113Published

Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders

cve-program ·

Vendor product: sharp

CVSS 4.0 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114108Published

HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE

cve-program ·

Vendor product: Vibe-Trading

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114103Published

adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()

cve-program ·

Vendor product: adm-zip

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114098Published

Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks

cve-program ·

Vendor product: dulwich

CVSS 4.0 7.3 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114093Published

Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114088Published

Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114083Published

Trigger.dev before 4.5.0-rc.3 Path Traversal via Packets Presigned URL Endpoints

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114078Published

Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114073Published

Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114068Published

Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.2 · CVSS 3.1 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

GO-2026-6866Published

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

osv · CVE-2026-97045

Go: golang.org/x/net

Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-gcqx-w48m-w2h4Published

deepmerge mergeObject() allows prototype poisoning of returned objects

osv · CVE-2026-93753

npm: deepmerge

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114063Published

SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

cve-program ·

Vendor product: kit

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114058Published

ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol

cve-program ·

Vendor product: arcadedb

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114053Published

vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision

cve-program ·

Vendor product: vllm

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114048Published

WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.1 · CVSS 3.1 3.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114043Published

Vulnerability in FreeRDP

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2021-48019Published

Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

cve-program ·

Vendor product: vyper

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2020-37286Published

Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

cve-program ·

Vendor product: vyper

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113737Published

R6410418 Jackrong-llm-finetuning-guide qwen_mtp_gguf_pipeline.py validate_indexed_tensors path traversal

cve-program ·

Vendor product: Jackrong-llm-finetuning-guide

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113706Published

a2aproject a2a-rs inmemory.rs information disclosure

cve-program ·

Vendor product: a2a-rs

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113726Published

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.