Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694340 source statements · aliases may refer to the same vulnerability

MAL-2026-18308Published

Malicious code in @s4yhiitestpoc/scan-echo-b (npm)

osv · GHSA-2wfm-2q62-f937

npm: @s4yhiitestpoc/scan-echo-b

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18302Published

Malicious code in @s4yhiitestpoc/r2-control (npm)

osv · GHSA-mgmq-xcr7-2945

npm: @s4yhiitestpoc/r2-control

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18307Published

Malicious code in @s4yhiitestpoc/scan-dns-c (npm)

osv · GHSA-vhw8-ph25-jc87

npm: @s4yhiitestpoc/scan-dns-c

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18309Published

Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm)

osv · GHSA-5957-rhph-hx5p

npm: @s4yhiitestpoc/scan-https-dualuse-e

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-17766Published

Malicious code in @s4yhiitestpoc/scan-https-d (npm)

osv · GHSA-96fg-4mp3-2hj5

npm: @s4yhiitestpoc/scan-https-d

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2024-3220Published

Default mimetype known files writeable on Windows

cve-program ·

Vendor product: CPython

CVSS 4.0 2.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-12345Published

Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

cve-program ·

Vendor product: CPython

CVSS 4.0 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-26060Published

Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33811Published

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-33943Published

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34388Published

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type va…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.6 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-34727Published

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with T…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-35344Published

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils impleme…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-39820Published

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

nvd ·

CVE-2026-40093Published

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRO…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-40255Published

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, and @adonisjs/core versions prior to 7.4.0, the response.redirect().bac…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-40883Published

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigge…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.1 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-41646Published

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulnerability in Nuclei's JavaScript protocol runtime allows JavaScript templates to read local .js and .json files through th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42190Published

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42229Published

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query str…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-42499Published

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-43897Published

Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP. This could cause internal data leaks. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-54312Published

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 8.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-10601Published

A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source plugins to reach unintended backend endpoints. Depending on the backend configuration this can expose data source credentials, leak internal…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-10609Published

A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-11941Published

Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-12681Published

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this all…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-13311Published

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative t…

nvd ·

CVSS 4.0 · 7ffcee3d-2c14-4c3e-b844-86c6a321a158 · Secondary 8.7 · CVSS 3.1 · 7ffcee3d-2c14-4c3e-b844-86c6a321a158 · Secondary 7.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-24120Published

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-25700Published

Improper Restriction of Security Token Assignment vulnerability in Apache Answer.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.2Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-34750Published

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-35369Published

An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SIGTERM) to PID -1. Sending a signal to PID -1 causes the kernel to terminate all processes visible to…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-35371Published

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a nam…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-40073Published

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. T…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41180Published

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `req.path`, but the downstream tus handler l…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41492Published

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "tok…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-41679Published

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-42089Published

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names wit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-42129Published

A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensitive backend configuration and internal service information.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-42238Published

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-44311Published

Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method. Spec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-44542Published

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to e…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-44645Published

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can be fully bypassed by a {% for %} (or {% tablerow %}) tag whose body is empty. The renderLimi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-44726Published

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-45013Published

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTT…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-45021Published

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and 2.13.5, the default kuma-cp config leaks the admin bootstrap token and signing keys to any …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-45062Published

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-45135Published

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-4525Published

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, an…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 8.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 25 Oct 2026Recorded 27 Oct 2026

CVE-2026-45310Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal ser…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 25 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.