Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694472 source statements · aliases may refer to the same vulnerability

CVE-2026-18679Published

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connecti…

nvd ·

CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary 5.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-45819Published

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

nvd ·

CVSS 4.0 · 22e2d327-25fe-45d7-9f0c-dcd23b7108df · Secondary 6.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47717Published

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47718Published

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5Source modified 23 Oct 2026Recorded 25 Oct 2026

GHSA-r3g7-r4hr-m258Published

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

osv · CVE-2026-115478

npm: obsidian-tc

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-111603Published

PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints

cve-program ·

Vendor product: PlayEdu

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-vg9q-fc8f-43f3Withdrawn

Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

osv ·

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-989h-w3q9-3m2fWithdrawn

Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

osv ·

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-pqh8-4pj7-32xxPublished

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

osv · CVE-2026-77363

npm: obsidian-tc

CRITICALSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-43r2-c7g8-prc8Published

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

osv · CVE-2026-77362

npm: obsidian-tc

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-6xvp-3rfv-g2g2Withdrawn

Duplicate Advisory: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

osv ·

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-hg5w-8ppq-wpjqWithdrawn

Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6

osv ·

Go: github.com/siyuan-note/siyuan/kernel

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-111608Published

Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

cve-program ·

Vendor product: jeepay

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111613Published

AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test

cve-program ·

Vendor product: alldata

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111618Published

CoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints

cve-program ·

Vendor product: CoAI

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111623Published

Xiaozhi-esp32-server-java through 6.1.0 Authentication Bypass via OTA Endpoint Token Issuance

cve-program ·

Vendor product: xiaozhi-esp32-server-java

CVSS 4.0 6.3 · CVSS 3.1 5.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111628Published

10up Distributor before 2.3.2 PHP Object Injection via set_meta()

cve-program ·

Vendor product: Distributor

CVSS 4.0 2.3 · CVSS 3.1 5.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114400Published

Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

cve-program ·

Vendor product: trudesk

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111633Published

ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key

cve-program ·

Vendor product: ZKEACMS

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-19754Published

Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

cve-program ·

Vendor product: Baserow

CVSS 4.0 8.6Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-mrhx-c7xc-m3w5Published

Zod can exhaust memory while validating oversized constrained collections

osv · CVE-2023-54404

npm: zod

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-109219Published

Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

cve-program ·

Vendor product: Mang Board

CVSS 3.1 9.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-48702Published

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

GHSA-c5xx-h28h-f682Published

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

osv · CVE-2026-77361

npm: obsidian-tc

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-84c9-qqpq-2pq5Published

obsidian-tc tokens can access arbitrary configured vaults

osv · CVE-2026-77366

npm: obsidian-tc

CRITICALSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-cvp8-vvgf-69q4Published

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

osv · CVE-2026-77364

npm: obsidian-tc

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-737x-cwfr-5vvcPublished

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

osv · CVE-2026-115477

npm: obsidian-tc

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-84682Published

TDDPv2 setProductVer Command Injection in Archer AX90

cve-program ·

Vendor product: Archer AX90 v1

CVSS 4.0 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-18963Published

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

cve-program ·

https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111648Published

BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter

cve-program ·

Vendor product: buildadmin

CVSS 4.0 5.1 · CVSS 3.1 2.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109433Published

Camunda Broken Access Control via Cockpit

cve-program ·

Vendor product: Camunda 7

CVSS 4.0 6.0 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111638Published

sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys

cve-program ·

Vendor product: sshportal

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-47683Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47686Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sand…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-47698Published

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing san…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-56677Published

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-63669Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check f…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-63670Published

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a liter…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-71553Published

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), al…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-73424Published

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-ver…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-111643Published

Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback

cve-program ·

Vendor product: misaka_danmu_server

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-28330Published

SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability

cve-program ·

Vendor product: SolarWinds Observability Self-Hosted

CVSS 3.1 4.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111653Published

53AIHub through 0.5.3 Missing Authentication via PUT /api/enterprises/:id

cve-program ·

Vendor product: 53AIHub

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-28329Published

SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)

cve-program ·

Vendor product: SolarWinds Observability Self-Hosted

CVSS 3.1 6.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-28328Published

SolarWinds Observability Self-Hosted broken authorization schema

cve-program ·

Vendor product: SolarWinds Observability Self-Hosted

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111658Published

SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API

cve-program ·

Vendor product: SSCMS

CVSS 4.0 5.1 · CVSS 3.1 3.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111663Published

Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation

cve-program ·

Vendor product: chaskiq

CVSS 4.0 9.2 · CVSS 3.1 8.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-24401Published

Avahi has Uncontrolled Recursion in lookup_handle_cname function

cve-program ·

Vendor product: avahi

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2014-125133Published

NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php

cve-program ·

Vendor product: NativeChurch

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2012-20003Published

Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php

cve-program ·

Vendor product: Custom Tables

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.