Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694333 source statements · aliases may refer to the same vulnerability

CVE-2026-47250Published

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enab…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-49252Published

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to Prototype Pollution. Exploitation can lead to potential privilege escalation fro…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-49357Published

Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. `line-desktop-mcp` supports a `--http-mode` Streamable HT…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-49444Published

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows containing a Python Code Node could escape the sandbox and achieve arbitrary code…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 8.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-49465Published

n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's C…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-49982Published

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-50008Published

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured li…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-50196Published

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-50267Published

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from `VCAP_SE…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-50268Published

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable …

nvd ·

CVSS 3.1 · [email protected] · Secondary 1.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-53724Published

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.79 and 9.9.1-alpha.4, the default file upload extension blocklist can be bypassed by appending a trailing dot to a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-53725Published

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.5, apps that enable MFA and deny get on the _User class via Class-Level Permissions cou…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-53726Published

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-53781Published

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 4.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-53782Published

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54301Published

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54302Published

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webho…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54303Published

n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabli…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.8 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54304Published

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54309Published

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. An…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Primary 10.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54310Published

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54311Published

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox conte…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54314Published

n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on decompressed output size. An unauthenticated atta…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-9804Published

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an expor…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-80465Published

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.29). Affected versions …

cve-program ·

Vendor product: Mendix SAML (Mendix 10 compatible) · Vendor product: Mendix SAML (Mendix 11 compatible) · Vendor product: Mendix SAML (Mendix 9.24 compatible)

CVSS 3.1 8.7 · CVSS 4.0 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115602Published

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: kadence-blocks

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110377Published

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: bopo-woo-product-bundle-builder

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112865Published

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: royal-elementor-addons

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-97295Published

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: media-library-assistant

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-97254Published

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: royal-elementor-addons

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-97255Published

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: royal-elementor-addons

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115614Published

WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: booking-and-rental-manager-for-woocommerce

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115949Published

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: better-post-filter-widgets-for-elementor

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114709Published

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ad-inserter

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-94295Published

Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature

cve-program ·

Vendor product: Chikkili- Google Pay India for Woocommerce

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112828Published

WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ai-engine

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-15705Published

Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS

cve-program ·

Vendor product: Contact Form by Supsystic

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111841Published

WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: wp-marketing-automations

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110285Published

WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret

cve-program ·

Vendor product: WP Stripe Checkout

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110376Published

WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: depart-deposit-and-part-payment-for-woo

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111976Published

GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

cve-program ·

Vendor product: GiveWP

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115958Published

WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-discussion-board

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111978Published

GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import

cve-program ·

Vendor product: GiveWP

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115613Published

WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: 3d-image-gallery

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111979Published

GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color

cve-program ·

Vendor product: GiveWP

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111980Published

GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant

cve-program ·

Vendor product: GiveWP

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111981Published

GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

cve-program ·

Vendor product: GiveWP

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114740Published

WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard

cve-program ·

Vendor product: WPVR

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114741Published

WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR

cve-program ·

Vendor product: WPVR

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114742Published

WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR

cve-program ·

Vendor product: WPVR

Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.