Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694331 source statements · aliases may refer to the same vulnerability

CVE-2026-116631Published

External protocol handler (tel:) address bar spoof

cve-program ·

Vendor product: Firefox for iOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110210Published

Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query

cve-program ·

Vendor product: Phase Console

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116632Published

Facetime protocol handler enabled spoofing

cve-program ·

Vendor product: Firefox for iOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115897Published

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influ…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-110215Published

youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation

cve-program ·

Vendor product: youlai-boot

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110220Published

Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

cve-program ·

Vendor product: Model Registry

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110225Published

Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route

cve-program ·

Vendor product: Shaarli

CVSS 4.0 5.1 · CVSS 3.1 2.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115889Published

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wa…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-111766Published

markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark preset is enabled and the constructs occur inside a paragraph, attacker-controlled Markdown containing repeated unterminated inline HTML commen…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-110231Published

muCommander through 1.6.2 Path Traversal via Archive Extraction to FTP/SFTP

cve-program ·

Vendor product: muCommander

CVSS 4.0 5.6 · CVSS 3.1 4.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-102941Published

The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath gua…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-110236Published

KDE Dolphin 24.08.0 through 26.08.2 OS Command Injection via Crafted Folder Name

cve-program ·

Vendor product: Dolphin

CVSS 4.0 7.1 · CVSS 3.1 7.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110111Published

Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi

cve-program ·

Vendor product: xen-orchestra

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-10759Published

BUG-000171040 Portal for ArcGIS has a security vulnerability

cve-program ·

Vendor product: Portal for ArcGIS

CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110256Published

Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth

cve-program ·

Vendor product: dockhand

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-4980Published

Improper Restriction of XML External Entity Reference in Inkscape

cve-program ·

Vendor product: Inkscape

CVSS 3.1 6.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-35433Published

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41070Published

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41432Published

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41495Published

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their req…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41511Published

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File B…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41583Published

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-script version 5.0.2, after a refactoring, Zebra failed to validate a consensus rule that restricted the possible values of sighash hash types …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41683Published

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language respon…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41690Published

18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41885Published

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the confi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41889Published

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that wou…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42072Published

Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRESS / server.host config key) is plumbed t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42180Published

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42181Published

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. Whi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42189Published

Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based serv…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42191Published

OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempP…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 7.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42199Published

Grid is a data structure grid for rust. From version 0.17.0 to before version 1.0.1, an integer overflow in Grid::expand_rows() can corrupt the relationship between the grid’s logical dimensions and its backing storage. After the internal i…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42260Published

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do n…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42282Published

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.13, when n8n-mcp runs in HTTP transport mode, authenticated MCP tools/call requests had their full argu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42300Published

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42338Published

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they re…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42348Published

OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42349Published

Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.6 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42353Published

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42541Published

Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy or AdmissionPolicyGroup create permissions (which isn't the default) can craft a policy that makes use of the can_i host callback. The call…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42554Published

Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes atta…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42565Published

@workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42856Published

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42882Published

oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware and the bucket handler. The authentication…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42899Published

Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43893Published

exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43929Published

ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlier, ssrfcheck fails to block Server-Side Request Forgery attacks when the target private IP address is encoded as an IPv4-mapped IPv6 address…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43930Published

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76 and 9.9.0-alpha.2, a race condition in the MFA SMS one-time password (OTP) login path allows two concurrent /login reque…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Primary 5.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43995Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. The…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44217Published

sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.6Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.