Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694346 source statements · aliases may refer to the same vulnerability

CVE-2026-91455Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-xvq9-wjp8-hwqfPublished

i18next-http-backend incomplete URL validation permits SSRF

osv · CVE-2026-105800

npm: i18next-http-backend

LOWSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-pgx6-7jcq-2qffPublished

PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

osv · CVE-2026-82866

npm: @pdfme/common

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91450Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-v3f4-w7r7-v3hmPublished

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

osv · CVE-2026-58497

npm: @zenalexa/unicli

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-m5mm-p8h7-m29vPublished

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

osv · CVE-2026-115754 · CVE-2026-115897

npm: serialize-javascript

LOWSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-2h46-9x5w-4wf7Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind

osv · CVE-2026-57208 · GO-2026-5063

Go: github.com/entireio/cli

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

GO-2026-5063Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli

osv · CVE-2026-57208 · GHSA-2h46-9x5w-4wf7

Go: github.com/entireio/cli

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91449Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-jg4p-7fhp-p32pPublished

@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing

osv · CVE-2026-115728 · CVE-2026-35213

npm: @hapi/content

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91448Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91447Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-106110Published

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row dat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106111Published

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106112Published

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106113Published

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumeri…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106114Published

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataRe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106115Published

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106116Published

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without adv…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-110734Published

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the ima…

cve-program ·

Vendor product: Godot Engine

CVSS 3.1 2.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113378Published

mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

cve-program ·

Vendor product: mcp-ripgrep

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2022-43760Published

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.4 · CVSS 3.1 · [email protected] · Primary 8.4Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2022-47762Published

In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2023-22647Published

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Primary 8.0Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2023-30549Published

Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 7.8Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2023-31135Published

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The la…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-10032Published

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall actio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-34783Published

Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-34841Published

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-34969Published

Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in b…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-34986Published

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-35039Published

fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could caus…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47219Published

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47725Published

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47726Published

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key re…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47768Published

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-48025Published

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master ke…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-48058Published

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plai…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-49258Published

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-49447Published

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-52855Published

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{confi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-52856Published

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-52857Published

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configurati…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-53844Published

OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54609Published

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54638Published

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byt…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54650Published

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing pe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54660Published

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDoc…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54661Published

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54662Published

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.3Source modified 23 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.