Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694345 source statements · aliases may refer to the same vulnerability

CVE-2026-73500Published

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In cl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73501Published

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without che…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73505Published

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73506Published

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subje…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73561Published

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-cl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73562Published

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose updat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73564Published

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73565Published

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73566Published

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73567Published

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73569Published

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passe…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73603Published

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73604Published

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensit…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73605Published

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute pa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73606Published

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73607Published

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any d…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73609Published

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73617Published

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can in…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 7.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73618Published

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Att…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 8.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73643Published

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection us…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73645Published

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint op…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73647Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, targe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73649Published

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the #set assignment handler in src/compile/set.ts, …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73851Published

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-112855Published

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: redy

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112859Published

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: little-birdies

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112858Published

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: rhodos

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112856Published

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: vagabonds

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112852Published

WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: helion

CVSS 3.1 8.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112851Published

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: hotlock

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112846Published

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: save-life

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112847Published

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: zensoul

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112854Published

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: holistic-center

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112850Published

WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability

cve-program ·

https://themeforest.net: your-dress

CVSS 3.1 8.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112848Published

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: hostmev2

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-111402Published

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: newsletters-lite

CVSS 3.1 9.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-94075Published

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: newsletters-lite

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112866Published

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woo-product-filter

CVSS 3.1 9.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114190Published

WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: litespeed-cache

CVSS 3.1 5.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110892Published

WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: suredash

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114196Published

WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: paytium

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114705Published

WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: insta-gallery

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114192Published

WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: mage-eventpress

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114704Published

WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: relevanssi

CVSS 3.1 7.2Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114191Published

WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: upi-qr-code-payment-for-woocommerce

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112863Published

WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://themeforest.net: kallyas

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114179Published

WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: bp-better-messages

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112844Published

WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wp-event-solution

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112869Published

WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: opening-hours

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114178Published

WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: w3-total-cache

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.