Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694331 source statements · aliases may refer to the same vulnerability

CVE-2026-115915Published

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

cve-program ·

Vendor product: vllm

CVSS 3.1 8.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-81509Published

nforwardauth: Unvalidated r parameter allows post-authentication open redirect

cve-program ·

Vendor product: nforwardauth

CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115919Published

ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

cve-program ·

Vendor product: onnx

CVSS 3.1 6.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116634Published

OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens

cve-program ·

Vendor product: OmniRoute

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116467Published

ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2014-125135Published

OctoPrint Flask Secret Key hard-coded key

cve-program ·

Vendor product: OctoPrint

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110110Published

JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints

cve-program ·

Vendor product: JetLinks Community

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110117Published

SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController

cve-program ·

Vendor product: SmartAdmin

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110122Published

PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint

cve-program ·

Vendor product: lilishop

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110127Published

waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints

cve-program ·

Vendor product: waynboot-mall

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-109428Published

Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation

cve-program ·

Vendor product: mistral-vibe

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-23870Published

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packag…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-24118Published

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-24781Published

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arb…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-26332Published

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · [email protected] · Primary 10.0 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-26956Published

vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host coopera…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-30246Published

Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-40171Published

In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting is…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-40195Published

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-40197Published

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-40243Published

Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable …

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 4.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-40251Published

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41161Published

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/auth/login endpoint contains a logic flaw that allows unauthenticated remote attackers to enumerate val…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41310Published

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41483Published

OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class makes HTTP requests to the Azure VM instance metadata service and reads the respon…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 5.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41484Published

OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In versions 1.15.0 and earlier, when a request to the configured back-end or collector results in an unsuccessful HTTP 4xx or …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 5.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41507Published

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrar…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41571Published

Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/db/models.go falls back to a hard-coded bcrypt("null") placeholder whenever a user has no stored password. OIDC-registered users are created …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41572Published

Note Mark is an open-source note-taking application. Prior to version 0.19.3, after a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41686Published

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91.1, the BetaLocalFilesystemMemoryTool in the Anthropic TypeScript SDK created memo…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.8 · CVSS 3.1 · [email protected] · Primary 4.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42075Published

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path traversal vulnerability in the skill download (fetch) command allows attackers to write files to arbitrary locations on the filesystem. The --out= …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42076Published

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a command injection vulnerability in the _extractLLM() function allows attackers to execute arbitrary shell commands on the server. The function construct…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42077Published

Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows attackers to modify the behavior of all JavaScript objects by injecting malicious p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42091Published

goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unco…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42220Published

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by Auth…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42221Published

Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup w…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42222Published

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patc…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42223Published

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs to JSON and returns them to authenticated users. Many sensitive …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43868Published

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 5.3 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43870Published

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulner…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6863Published

Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can is…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7734Published

A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data lea…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 2.0 · [email protected] · Secondary 5.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7736Published

A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 2.0 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7737Published

A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation l…

nvd ·

CVE-2026-7738Published

A security flaw has been discovered in puchunjie doc-tools-mcp 1.0.18. This affects the function create_document/open_document of the file src/mcp-server.ts of the component MCP Interface. The manipulation of the argument filePath results i…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7776Published

Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener may open a …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8026Published

A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 3.7 · CVSS 3.1 · [email protected] · Primary 5.3 · CVSS 2.0 · [email protected] · Secondary 2.6Source modified 26 Oct 2026Recorded 27 Oct 2026

MAL-2026-18178Published

Malicious code in event-emitter-testmetest (npm)

osv ·

npm: event-emitter-testmetest

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18099Published

Malicious code in formatting-subtitles-for-claude (npm)

osv · GHSA-xxr7-33gg-pcg6

npm: formatting-subtitles-for-claude

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110205Published

Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution

cve-program ·

Vendor product: Roo-Code

CVSS 4.0 7.7 · CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.