Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694346 source statements · aliases may refer to the same vulnerability

CVE-2026-90648Published

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2…

cve-program ·

Vendor product: wabt

CVSS 4.0 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95721Published

Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 3.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95720Published

Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 4.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95719Published

Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 4.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95717Published

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 5.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95716Published

Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95715Published

Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 6.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95713Published

Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95712Published

Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95710Published

Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79955Published

Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79895Published

Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79894Published

Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79893Published

Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79851Published

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79850Published

Authentication Bypass Leading to Remote Code Execution in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79849Published

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79848Published

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79847Published

Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79844Published

Authentication Bypass Leading to Remote Code Execution in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-18676Published

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetc…

nvd ·

CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary 5.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-18678Published

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

nvd ·

CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary 5.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-18679Published

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connecti…

nvd ·

CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary 5.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-45819Published

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

nvd ·

CVSS 4.0 · 22e2d327-25fe-45d7-9f0c-dcd23b7108df · Secondary 6.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47717Published

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47718Published

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5Source modified 23 Oct 2026Recorded 25 Oct 2026

GHSA-r3g7-r4hr-m258Published

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

osv · CVE-2026-115478

npm: obsidian-tc

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-111603Published

PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints

cve-program ·

Vendor product: PlayEdu

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-vg9q-fc8f-43f3Withdrawn

Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

osv ·

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-989h-w3q9-3m2fWithdrawn

Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

osv ·

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-pqh8-4pj7-32xxPublished

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

osv · CVE-2026-77363

npm: obsidian-tc

CRITICALSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-43r2-c7g8-prc8Published

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

osv · CVE-2026-77362

npm: obsidian-tc

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-6xvp-3rfv-g2g2Withdrawn

Duplicate Advisory: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

osv ·

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-hg5w-8ppq-wpjqWithdrawn

Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6

osv ·

Go: github.com/siyuan-note/siyuan/kernel

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-111608Published

Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

cve-program ·

Vendor product: jeepay

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111613Published

AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test

cve-program ·

Vendor product: alldata

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111618Published

CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints

cve-program ·

Vendor product: CoAI

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111623Published

Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance

cve-program ·

Vendor product: xiaozhi-esp32-server-java

CVSS 4.0 6.3 · CVSS 3.1 5.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111628Published

10up Distributor before 2.3.2 PHP Object Injection via set_meta()

cve-program ·

Vendor product: Distributor

CVSS 4.0 2.3 · CVSS 3.1 5.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114400Published

Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

cve-program ·

Vendor product: trudesk

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111633Published

ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key

cve-program ·

Vendor product: ZKEACMS

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-19754Published

Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

cve-program ·

Vendor product: Baserow

CVSS 4.0 8.6Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-mrhx-c7xc-m3w5Published

Zod can exhaust memory while validating oversized constrained collections

osv · CVE-2023-54404

npm: zod

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-109219Published

Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

cve-program ·

Vendor product: Mang Board

CVSS 3.1 9.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-48702Published

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

GHSA-c5xx-h28h-f682Published

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

osv · CVE-2026-77361

npm: obsidian-tc

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-84c9-qqpq-2pq5Published

obsidian-tc tokens can access arbitrary configured vaults

osv · CVE-2026-77366

npm: obsidian-tc

CRITICALSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-cvp8-vvgf-69q4Published

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

osv · CVE-2026-77364

npm: obsidian-tc

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-737x-cwfr-5vvcPublished

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

osv · CVE-2026-115477

npm: obsidian-tc

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-84682Published

TDDPv2 setProductVer Command Injection in Archer AX90

cve-program ·

Vendor product: Archer AX90 v1

CVSS 4.0 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.