Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694472 source statements · aliases may refer to the same vulnerability

CVE-2015-20128Published

FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx

cve-program ·

Vendor product: DotNetCMS

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115390Published

Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115386Published

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir implementation that copies uninitialized struct padding into guest memory. Guests with a preop…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 2.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115382Published

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests to panic the host. Guests can specify a zero between-bytes-timeout request option, which is…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Secondary 4.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-114607Published

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeId…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 23 Oct 2026Recorded 27 Oct 2026

CVE-2026-114132Published

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by l…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-114128Published

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-114124Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering wa…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-113800Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionChe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-113796Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.2Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2016-20104Published

EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

cve-program ·

Vendor product: nano NXT

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-104252Published

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP deb…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-113788Published

Lagoon core ssh service vulnerable to remote code execution

cve-program ·

Vendor product: lagoon

CVSS 4.0 9.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113792Published

pypdf: Possible infinite loop in PdfWriter.find_outline_item

cve-program ·

Vendor product: pypdf

CVSS 4.0 6.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113796Published

Electron: SameSite cookie restrictions are not applied to windows opened from links

cve-program ·

Vendor product: electron

CVSS 3.1 4.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113800Published

Electron: HID and USB permission checks can be attributed to the wrong origin

cve-program ·

Vendor product: electron

CVSS 3.1 5.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114124Published

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

cve-program ·

Vendor product: electron

CVSS 3.1 3.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114128Published

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

cve-program ·

Vendor product: astro

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114132Published

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

cve-program ·

Vendor product: nuxt

CVSS 4.0 6.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-110744Published

Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: multicluster-globalhub/multicluster-globalhub-operator-bundle

CVSS 3.1 7.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114492Published

gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

cve-program ·

Vendor product: gin-vue-admin

CVSS 4.0 7.0 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114361Published

HarnessRouter Identity Mode app.py improper authorization

cve-program ·

Vendor product: HarnessRouter

CVSS 4.0 6.3 · CVSS 3.1 5.6 · CVSS 3.0 5.6 · CVSS 2.0 5.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114137Published

Django REST framework: TokenProxy.delete() reports success and revokes nothing

cve-program ·

Vendor product: django-rest-framework

CVSS 3.1 7.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114145Published

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

cve-program ·

Vendor product: GitPython

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-76287Published

Authorization Bypass in the Data Management REST API in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 5.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-76303Published

Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR

cve-program ·

Vendor product: Splunk SOAR

CVSS 3.1 5.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-76307Published

Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR

cve-program ·

Vendor product: Splunk SOAR

CVSS 3.1 7.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114634Published

WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114638Published

Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision

cve-program ·

Vendor product: traefik

CVSS 4.0 7.0 · CVSS 3.1 8.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114642Published

Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

cve-program ·

Vendor product: traefik · Vendor product: traefik

CVSS 4.0 7.0 · CVSS 3.1 8.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2025-60497Published

A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

cve-program ·

Vendor product: n/a

Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2025-60492Published

A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

cve-program ·

Vendor product: n/a

Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114659Published

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

cve-program ·

Vendor product: grav-plugin-flex-objects

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114663Published

Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

cve-program ·

Vendor product: vyper

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115321Published

Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment

cve-program ·

Vendor product: bytebase

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115325Published

Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup

cve-program ·

Vendor product: netmaker

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115329Published

Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet

cve-program ·

Vendor product: lotus

CVSS 4.0 6.0 · CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115333Published

Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

cve-program ·

Vendor product: lotus

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114515Published

OCO-Server: Self-Service Portal uninstall-job authorization bypass

cve-program ·

Vendor product: OCO-Server

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114607Published

better-auth: OAuth state can be used as a Magic Link to sign in as another user

cve-program ·

Vendor product: better-auth

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115356Published

OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocation

cve-program ·

Vendor product: openbao

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115364Published

OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

cve-program ·

Vendor product: openbao

CVSS 4.0 2.1 · CVSS 3.1 2.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115370Published

Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh

cve-program ·

Vendor product: incus

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115374Published

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

cve-program ·

Vendor product: incus

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-106461Published

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115378Published

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

cve-program ·

Vendor product: incus

CVSS 4.0 6.9 · CVSS 3.1 5.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-106486Published

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-req…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115382Published

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoS

cve-program ·

Vendor product: wasmtime

CVSS 4.0 5.9 · CVSS 3.1 4.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115386Published

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdir

cve-program ·

Vendor product: wasmtime

CVSS 4.0 2.1 · CVSS 3.1 2.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115390Published

Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoS

cve-program ·

Vendor product: wasmtime

CVSS 4.0 6.9 · CVSS 3.1 5.7Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.