Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694331 source statements · aliases may refer to the same vulnerability

CVE-2026-74043Published

Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 8.5 · CVSS 3.1 9.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74040Published

Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 9.4 · CVSS 3.1 9.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74037Published

Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74036Published

Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies

cve-program ·

Vendor product: wazuh-agent

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74035Published

Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74034Published

Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74033Published

Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 8.4 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74032Published

Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74031Published

Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 7.0 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-22599Published

Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-query injection vulnerability existed in the Strapi Content-Type Builder write API.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Primary 7.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-22706Published

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing refresh-token sessions by default. The refresh-token invalidatio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-22707Published

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints did not enforce the administrator-configured MIME type restrictions (`plugin.upload.security.allowedT…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-23998Published

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-24000Published

Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-24899Published

Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures us…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-25705Published

A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEnd…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-26062Published

Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-26191Published

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33380Published

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable.

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33381Published

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41050Published

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by thei…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42281Published

MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2 · CVSS 3.1 · [email protected] · Primary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42334Published

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor oper…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42559Published

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allow…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42602Published

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configure…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43644Published

podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content directly to the response without setting explicit Content-Type or X-Conten…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 5.4 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44015Published

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requ…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44216Published

Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked on overflow. This overflow is possible to trigger, and thus pa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44301Published

Hugo is a static site generator. From 0.43 to before 0.161.0, when building a Hugo site that uses Node-based asset pipelines (PostCSS, Babel, TailwindCSS), Hugo invoked the configured Node tools without restrictions on file system access. A…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.2 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44302Published

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44309Published

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44310Published

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() wit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44351Published

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44372Published

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is f…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44374Published

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticate…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44375Published

Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declar…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44427Published

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft …

nvd ·

CVSS 4.0 · [email protected] · Secondary 0.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44428Published

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry in…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Primary 4.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44429Published

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site sc…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44430Published

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44437Published

The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to before 19.2.25, 20.3.25, 21.2.9, and 22.0.0-next.7, a vulnerability exists in the X-Forwarded-Prefix header processing logic within Angular SSR.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44455Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, Improper handling of JSX element tag names in hono/jsx allowed unvalidated tag names to be directly inserted into the generated HTML out…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44456Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g. Transfer-Encoding: chunked). Oversized …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44457Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: Authorization or Vary: Cookie. As a result…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44458Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted input in a style object value or property nam…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44459Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, improper validation of the JWT NumericDate claims exp, nbf, and iat in hono/utils/jwt allows tokens with non-spec-compliant claim values…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44471Published

gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out with gitoxide, permit writing an attacker-controlled symlink into any existing directory the user has wri…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44503Published

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44514Published

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user wit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44522Published

Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, where the asset filename is provided thro…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.