Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694331 source statements · aliases may refer to the same vulnerability

CVE-2026-44499Published

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discovery pipeline allows an unauthenticated remote attacker to permanently halt all new block discovery on…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44500Published

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against gene…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44572Published

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7 · CVSS 3.1 · [email protected] · Primary 5.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44643Published

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox to execute arbitrary code on the system. T…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Primary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44664Published

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44665Published

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to ins…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44694Published

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45091Published

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload o…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45222Published

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tok…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45224Published

Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the intended /workspace directory. Attackers can c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.8 · CVSS 3.1 · [email protected] · Secondary 7.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45321Published

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher bin…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8349Published

A flaw has been found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGAP Message Handler. Executing a manipulation can lead to memory corruption. The attack can be launched remotely. The exploit h…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-110690Published

Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack

cve-program ·

Vendor product: cloudcmd

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111074Published

JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity()

cve-program ·

Vendor product: Eclipse OpenJ9

CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111075Published

JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization

cve-program ·

Vendor product: Eclipse OpenJ9

CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110938Published

JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing

cve-program ·

Vendor product: Eclipse OpenJ9

CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-72752Published

Routinator exits when requesting the output repeatedly

cve-program ·

Vendor product: Routinator

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-72753Published

Routinator incorrectly handles delta updates

cve-program ·

Vendor product: Routinator

CVSS 3.1 8.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-72754Published

Routinator exits when parsing an incorrect or very large CRL file

cve-program ·

Vendor product: Routinator

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-72755Published

Routinator stores TA certificate in cache without validation

cve-program ·

Vendor product: Routinator

CVSS 3.1 3.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-72756Published

Routinator exits on malformed rsync URIs

cve-program ·

Vendor product: Routinator

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-72757Published

Routinator HTTP server becomes unavailable with many unclosed connections

cve-program ·

Vendor product: Routinator

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-72758Published

Routinator may exit on malformed ranges

cve-program ·

Vendor product: Routinator

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116398Published

WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: content-slider-block

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116400Published

WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: button-block

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115966Published

WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: text-typing

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112839Published

WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woo-customer-coupons

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111404Published

WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability

cve-program ·

https://wordpress.org/plugins: woo-photo-reviews

CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116408Published

WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: photoblocks-grid-gallery

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116217Published

RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php

cve-program ·

Vendor product: rosariosis

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65825Published

OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenants

cve-program ·

Vendor product: appointment-booking-software

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115800Published

UbiquitousLearning mllm Convertor init.py load_model path traversal

cve-program ·

Vendor product: mllm

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115883Published

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

cve-program ·

Vendor product: langgraph · Vendor product: langgraph-checkpoint-postgres · Vendor product: langgraph-checkpoint-sqlite

CVSS 4.0 6.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115889Published

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

cve-program ·

Vendor product: wasmtime

CVSS 3.1 9.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115897Published

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

cve-program ·

Vendor product: serialize-javascript

CVSS 4.0 2.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115803Published

Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization

cve-program ·

Vendor product: Scada-LTS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110018Published

aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute

cve-program ·

Vendor product: aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116011Published

Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

cve-program ·

Vendor product: Crow

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116015Published

yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116019Published

Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115971Published

Travisun Opptrix preParsing handler webhook Buffer.concat denial of service

cve-program ·

Vendor product: Opptrix

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-50787Published

e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, …

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115981Published

phpIPAM index.php cross site scripting

cve-program ·

Vendor product: phpIPAM

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115996Published

Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation

cve-program ·

Vendor product: Unitree Go2

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116000Published

Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery

cve-program ·

Vendor product: PrivateGPT

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2021-48012Published

fast-toml through 0.5.4 Prototype Pollution via proto Keys in Parsed TOML

cve-program ·

Vendor product: fast-toml

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-109561Published

goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations

cve-program ·

Vendor product: goose

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-102941Published

gomarkdown/markdown IsSafeURL panics on short URLs

cve-program ·

Vendor product: markdown

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111766Published

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

cve-program ·

Vendor product: markdown-it

CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-93441Published

IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service

cve-program ·

Vendor product: QRadar Security Information and Event Management

CVSS 3.1 8.6Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.