Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694331 source statements · aliases may refer to the same vulnerability

CVE-2026-116394Published

WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability

cve-program ·

https://wordpress.org/plugins: mage-eventpress

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-82388Published

Use of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-82389Published

Bluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116403Published

WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability

cve-program ·

https://wordpress.org/plugins: easy-digital-downloads

CVSS 3.1 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116396Published

WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ameliabooking

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116388Published

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ameliabooking

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115597Published

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: learnpress

CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114710Published

WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: photoblocks-grid-gallery

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115598Published

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: learnpress

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116395Published

WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: lightbox-block

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116007Published

YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication

cve-program ·

Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116046Published

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

cve-program ·

Vendor product: sdk

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116049Published

krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection

cve-program ·

Vendor product: EmployeeRecruitmentSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-60489Published

A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-60493Published

A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-60487Published

A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-60490Published

A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-60494Published

A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-55640Published

A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-52167Published

A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-109346Published

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43997Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to ob…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43998Published

vm2 is an open source vm/sandbox for Node.js. In 3.10.5, NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in host context. Beca…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43999Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The module builtin exposes Node's Module._load(), which loads any…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44000Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host objec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 7.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44001Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44002Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44003Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandb…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 5.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44004Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44005Published

vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and o…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44006Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0.

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44232Published

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe. This vulnerability is fixed in 1.0.3.

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44240Published

basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44373Published

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved out…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44573Published

Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44574Published

Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deploymen…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44575Published

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44576Published

Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44577Published

Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory w…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45028Published

Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or paramete…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.9 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45033Published

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directo…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Primary 7.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-6959Published

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 an…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7474Published

HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8052Published

HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-15044Published

Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis

cve-program ·

https://github.com/trustyai-explainability/trustyai-service-operator: trustyai-service-operator · https://access.redhat.com/downloads/content/package-browser/: rhoai/odh-trustyai-service-operator-rhel9

CVSS 3.1 6.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116068Published

Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

cve-program ·

Vendor product: dokploy

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116072Published

Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity

cve-program ·

Vendor product: Infinity for Reddit

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116139Published

WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116143Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116147Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.