Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694494 source statements · aliases may refer to the same vulnerability

MAL-2026-18130Published

Malicious code in @sudobility/wildduck_client (npm)

osv · GHSA-5ff7-5w72-hm63

npm: @sudobility/wildduck_client

Source modified 22 Oct 2026Recorded 24 Oct 2026

MAL-2026-18129Published

Malicious code in @sudobility/testomniac_client (npm)

osv · GHSA-g7cj-274j-rxqw

npm: @sudobility/testomniac_client

Source modified 22 Oct 2026Recorded 24 Oct 2026

MAL-2026-18128Published

Malicious code in @sudobility/shaperouter_client (npm)

osv · GHSA-x7g4-jh5c-33xr

npm: @sudobility/shaperouter_client

Source modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-389g-gv7q-r4x8Published

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

osv · CVE-2026-107832

npm: fastify

LOWSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-9j65-hcg3-gc64Published

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

osv · CVE-2026-114143

npm: toml

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-98hj-9722-w3j8Published

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

osv · CVE-2026-114128

npm: astro

MODERATESource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-9qmh-m7c6-f92pPublished

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

osv · CVE-2026-114144

npm: toml

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-4qx8-w7c3-pj3pPublished

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

osv · CVE-2026-114141

npm: toml

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-c4qx-w738-7hr3Published

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

osv · CVE-2026-114604

npm: @graphql-tools/utils

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-mpr7-6m5w-76rwPublished

Astro: Arbitrary CSS injection in Astro View Transitions

osv · CVE-2026-114127

npm: astro

LOWSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-px85-f4q5-jh77Published

Storybook dev server vulnerable to code injection from the local network

osv · CVE-2026-114126

npm: storybook · npm: storybook · npm: storybook

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

CVE-2026-87946Published

SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87947Published

SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87948Published

SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87949Published

SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-67597Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-76066Published

IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode

cve-program ·

Vendor product: intentkit

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

GHSA-h694-7cp9-m8p3Published

next.js cache leak across root param values in nested 'use cache' functions

osv · CVE-2026-103004

npm: next

MODERATESource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-p3hm-x653-5rc6Withdrawn

Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

osv ·

npm: ip-address

MODERATESource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-rxp7-6hxx-x8q5Published

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

osv · CVE-2026-111997

npm: ip-address

MODERATESource modified 22 Oct 2026Recorded 24 Oct 2026

CVE-2026-87950Published

SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87951Published

SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-114102Published

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Att…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-114087Published

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauth…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 22 Oct 2026Recorded 25 Oct 2026

GHSA-wxxx-r42m-9rp8Withdrawn

Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

osv ·

npm: nodemailer

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-39m8-27wv-hr27Published

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

osv · CVE-2026-110871

npm: nodemailer

MODERATESource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-cpvr-w4j5-2mpgPublished

Librsvg: Use-after-free when XML includes have duplicated entities

osv · CVE-2026-96889 · RUSTSEC-2026-0305

crates.io: librsvg · crates.io: librsvg · crates.io: librsvg

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

CVE-2026-92892Published

Potential command execution on the host running JFrog CLI.

cve-program ·

Vendor product: jfrog-cli

CVSS 3.1 9.0Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-114107Published

HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool

cve-program ·

Vendor product: Vibe-Trading

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 22 Oct 2026Recorded 23 Oct 2026

GHSA-p3m5-59mp-jv5rPublished

Next.js: Denial of Service in App Router using Server Actions

osv · CVE-2026-94482

npm: next · npm: next

HIGHSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-jj87-hc4r-jwfwPublished

stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service

osv · CVE-2026-114129

npm: stream-json

MODERATESource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-2464-fhr4-w9xwPublished

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

osv ·

npm: next · npm: next

CRITICALSource modified 22 Oct 2026Recorded 24 Oct 2026

GHSA-mchm-gjx6-7h55Published

Sentry-Javascript: Middleware Bypass when using Tunnel route

osv · CVE-2026-114139

npm: @sentry/nextjs · npm: @sentry/nextjs · npm: @sentry/nextjs

CRITICALSource modified 22 Oct 2026Recorded 24 Oct 2026

CVE-2026-114087Published

Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-114092Published

Trigger.dev before 4.5.0 Missing Authentication in Dashboard Run Replay Action

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-114097Published

Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter

cve-program ·

Vendor product: dulwich

CVSS 4.0 7.3 · CVSS 3.1 7.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-23706Published

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiA…

cve-program ·

Vendor product: FortiAnalyzer Cloud · Vendor product: FortiAnalyzer · Vendor product: FortiManager

CVSS 3.1 5.9Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-114102Published

adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event

cve-program ·

Vendor product: adm-zip

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-114112Published

Sharp before 0.35.4 RCE via bundled libheif AVIF decoding

cve-program ·

Vendor product: sharp

CVSS 4.0 8.9Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87952Published

SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87953Published

SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151

cve-program ·

https://www.drupal.org/project/miniorange_saml: SAML SSO - Service Provider

Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101688Published

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthentica…

cve-program ·

Vendor product: Oracle E-Business Suite Integrated SOA Gateway

CVSS 3.1 8.6Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101690Published

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthentica…

cve-program ·

Vendor product: Oracle E-Business Suite Integrated SOA Gateway

CVSS 3.1 8.2Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101694Published

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with netwo…

cve-program ·

Vendor product: Oracle Mobile Field Service

CVSS 3.1 7.2Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101696Published

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with n…

cve-program ·

Vendor product: Oracle Application Object Library

CVSS 3.1 6.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101698Published

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle One-to-One Fulfillment

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101699Published

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle One-to-One Fulfillment

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101703Published

Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access …

cve-program ·

Vendor product: Pasta

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101707Published

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker wit…

cve-program ·

Vendor product: Oracle Concurrent Processing

CVSS 3.1 7.4Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101708Published

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle Payroll

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.