Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694495 source statements · aliases may refer to the same vulnerability

CVE-2026-114479Published

Not Failing Securely ('Failing Open') in hMailServer

cve-program ·

Vendor product: hMailServer

CVSS 3.1 5.8Source modified 21 Oct 2026Recorded 23 Oct 2026

GHSA-vmgj-9cwm-cf3hPublished

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

osv · CVE-2026-112951

npm: apostrophe

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-5m22-7pfq-vp65Published

ApostropheCMS: Import API bypasses publication roles for protected content

osv · CVE-2026-113649

npm: @apostrophecms/import-export · npm: apostrophe

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-rqgm-cfrp-4hx8Published

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

osv · CVE-2026-112954

npm: apostrophe

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-9g7p-m758-rp72Published

ApostropheCMS: Import archives can exhaust server storage and deny service

osv · CVE-2026-112955

npm: @apostrophecms/import-export

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-c9rx-x947-fp3hPublished

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

osv · CVE-2026-113650

npm: sanitize-html

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-jf5h-36mg-rp6xPublished

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

osv · CVE-2026-112956

npm: @apostrophecms/import-export

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-9jrq-w75r-8gcwPublished

Vite: Cross origin script execution through Vite custom middleware

osv · CVE-2026-112945

npm: vite · npm: vite · npm: vite

LOWSource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-vfpm-58rq-9qcgPublished

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

osv · CVE-2026-112947

npm: vite · npm: vite · npm: vite-plus

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

GHSA-rq7h-c2jc-7f22Published

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

osv · CVE-2026-112946

npm: vite · npm: vite · npm: vite

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

CVE-2024-10306Published

Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests

cve-program ·

https://github.com/modcluster/mod_proxy_cluster: mod_proxy_cluster · https://access.redhat.com/downloads/content/package-browser/: mod_proxy_cluster · https://access.redhat.com/downloads/content/package-browser/: mod_proxy_cluster

CVSS 3.1 5.4Source modified 21 Oct 2026Recorded 23 Oct 2026

GHSA-26w4-8w32-4x3vPublished

Slack Morphism verifier errors disclose valid HMACs in the logs

osv · CVE-2026-113799

crates.io: slack-morphism

MODERATESource modified 21 Oct 2026Recorded 24 Oct 2026

CVE-2026-12254Published

Netskope Client Captive Portal WebView Persistence allowing SWG bypass issue

cve-program ·

Vendor product: Netskope Client

CVSS 4.0 6.4Source modified 21 Oct 2026Recorded 23 Oct 2026

MAL-2026-18123Published

Malicious code in peptide-modify (npm)

osv · GHSA-h643-5mcg-c726

npm: peptide-modify

Source modified 21 Oct 2026Recorded 24 Oct 2026

CVE-2025-50343Rejected

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113710Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lock…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-113670Rejected

Rejected reason: This CVE is a duplicate of another CVE.

nvd ·

Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-113667Published

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpolate an unencoded user-supplied response to…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-113661Published

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that allows meta refresh elements and their h…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-113656Published

ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload size,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-113652Published

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sas: …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-112957Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-112952Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, 'POST /api/v1/@apostrophecms/doc/slugTaken' with body { "slug": "target-slug" } returns a boolean indicating whether a slug is in use across all document ty…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-112947Published

Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-112942Published

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.5Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-91364Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with …

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 6.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91365Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with …

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 5.9Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91366Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with …

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 4.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91367Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with log…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91368Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows high privileged attacker with …

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 4.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-112914Published

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

cve-program ·

Vendor product: filelock

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-112937Published

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

cve-program ·

Vendor product: filelock

CVSS 3.1 6.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-102536Rejected

This CVE has been rejected because it was issued to a development-only issue with no affected distributed version identified.

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-112942Published

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

cve-program ·

Vendor product: launch-editor · Vendor product: vite · Vendor product: vite-plus

CVSS 4.0 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-111763Published

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91369Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-112947Published

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

cve-program ·

Vendor product: vite · Vendor product: vite-plus

CVSS 4.0 6.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113359Published

Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint

cve-program ·

Vendor product: Baserow

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113598Published

Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete

cve-program ·

Vendor product: modoboa

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113603Published

x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource

cve-program ·

Vendor product: @x402/extensions · Vendor product: x402 · Vendor product: github.com/x402-foundation/x402/go/v2

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113608Published

Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var

cve-program ·

Vendor product: moodle-block_configurablereports

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113613Published

FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin

cve-program ·

Vendor product: FlexGet

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113680Published

HarfBuzz 8.0.0 through 14.6.0 WebAssembly Shaper NULL Pointer Dereference DoS

cve-program ·

Vendor product: harfbuzz

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-112952Published

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

cve-program ·

Vendor product: apostrophe

CVSS 3.1 4.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-112957Published

ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users

cve-program ·

Vendor product: apostrophe

CVSS 3.1 4.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113505Published

aaPanel Download Endpoint v2.py send_file path traversal

cve-program ·

Vendor product: aaPanel

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113652Published

ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)

cve-program ·

Vendor product: apostrophe · Vendor product: uploadfs

CVSS 3.1 5.6Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113656Published

ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS

cve-program ·

Vendor product: apostrophe · Vendor product: form

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113661Published

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

cve-program ·

Vendor product: apostrophe · Vendor product: sanitize-html

CVSS 3.1 5.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113667Published

ApostropheCMS: CAPTCHA response token not URL-encoded

cve-program ·

Vendor product: apostrophe · Vendor product: form · Vendor product: login-hcaptcha

CVSS 4.0 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.