Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694538 source statements · aliases may refer to the same vulnerability

CVE-2026-92539Published

Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

cve-program ·

Vendor product: Grafana Enterprise

CVSS 3.1 6.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-105772Published

Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

cve-program ·

Vendor product: @google/adk

CVSS 4.0 9.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-86831Published

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

cve-program ·

Vendor product: aws-network-policy-agent · Vendor product: amazon-vpc-cni-k8s

CVSS 3.1 8.7 · CVSS 4.0 8.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-8597Published

Missing integrity verification in Triton inference handler in Amazon SageMaker Python SDK

cve-program ·

Vendor product: Amazon SageMaker Python SDK

CVSS 3.1 7.2 · CVSS 4.0 6.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-108709Published

Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113605Published

Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

cve-program ·

Vendor product: Stirling-PDF

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-69080Published

Apache Kylin: Broken Access Control in QuerySQLBlacklistController

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-69077Published

Apache Kylin: JobController allows unauthorized cross-project manipulation

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-69076Published

Apache Kylin: Unauthorized cross-project job discard

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

GHSA-57xq-rjx2-v5xhPublished

@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)

osv · CVE-2026-111751

npm: @angular/router · npm: @angular/router

HIGHSource modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-8r9p-f939-6h3cPublished

follow-redirects sensitiveHeaders regex escaping can expose credential headers

osv · CVE-2026-111755

npm: follow-redirects

HIGHSource modified 20 Oct 2026Recorded 24 Oct 2026

CVE-2026-68573Published

Apache Kylin: Unauthenticated Metastore Cleanup

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-96331Published

WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: ajax-search-pro

CVSS 3.1 9.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-68572Published

Apache Kylin: Unauthorized SQL execution to Spark SQL env

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110005Published

Moghtech Komodo contains an OS command injection vulnerability

cve-program ·

Vendor product: Komodo

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113660Published

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers

cve-program ·

Vendor product: apostrophe

CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113666Published

ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service

cve-program ·

Vendor product: apostrophe · Vendor product: db-connect

CVSS 3.1 7.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112019Published

cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()

cve-program ·

Vendor product: cgltf

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112377Published

CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack

cve-program ·

https://github.com/CCC-Attestation/attested-tls-poc: attested-tls-poc

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-107460Published

Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.fesod:fesod-sheet

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-79608Published

x86/AMD: ineffectual Zenbleed workaround

cve-program ·

Vendor product: Xen

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-79609Published

x86: XPTI may break on huge-memory systems

cve-program ·

Vendor product: Xen

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-79610Published

grant-table: double version change race

cve-program ·

Vendor product: Xen

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-79611Published

VMX: VMentry failure with branch tracing and blocked states

cve-program ·

Vendor product: Xen

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-102699Published

Arm: multiple issues with GNTTABOP_cache_flush

cve-program ·

Vendor product: Xen

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-102702Published

Arm: multiple issues with GNTTABOP_cache_flush

cve-program ·

Vendor product: Xen

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-109700Published

WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: meta-box

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113651Published

ApostropheCMS: Path traversal in uploadfs

cve-program ·

Vendor product: apostrophe · Vendor product: uploadfs

CVSS 3.1 3.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113655Published

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

cve-program ·

Vendor product: apostrophe

CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-111757Published

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection f…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-102700Published

gnttab: cache-flush handling may cause page reference leak

cve-program ·

Vendor product: Xen

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92843Published

Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure

cve-program ·

Vendor product: NetX Duo

CVSS 4.0 8.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113657Published

ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)

cve-program ·

Vendor product: apostrophe · Vendor product: sanitize-html

CVSS 3.1 3.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-95109Published

Cortex-A7 module data validation checks only the first address of a caller-supplied range

cve-program ·

Vendor product: ThreadX

CVSS 4.0 8.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-93003Published

NetX Duo Web HTTP server interprets request body content as HTTP header fields

cve-program ·

Vendor product: NetX Duo

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-95108Published

Deleting a user-mode module thread leaks its privileged kernel stack

cve-program ·

Vendor product: ThreadX

CVSS 4.0 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-95107Published

Module object allocation size overflow corrupts the manager object pool

cve-program ·

Vendor product: ThreadX

CVSS 4.0 7.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-94202Published

Module block-pool create validates two of the four parameter words it reads

cve-program ·

Vendor product: ThreadX

CVSS 4.0 4.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-94192Published

Module object deallocation can free a live ThreadX kernel object

cve-program ·

Vendor product: ThreadX

CVSS 4.0 8.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-94023Published

Module delete dispatchers do not enforce kernel-object ownership before irreversible deletion

cve-program ·

Vendor product: ThreadX

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-94018Published

NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path

cve-program ·

Vendor product: NetX Duo

CVSS 4.0 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-93475Published

Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509

cve-program ·

Vendor product: NetX Duo

CVSS 4.0 9.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92853Published

Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure

cve-program ·

Vendor product: NetX Duo

CVSS 4.0 8.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-91057Published

Out-of-bounds read when a multi-line text view string ends with a carriage return

cve-program ·

Vendor product: GUIX

CVSS 4.0 4.6Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-94024Published

Module Manager object lookup validates one byte of a module's search name

cve-program ·

Vendor product: ThreadX

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113653Published

ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)

cve-program ·

Vendor product: apostrophe

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-28331Published

SolarWinds Patch Manager Sensitive Information Exposure Vulnerability

cve-program ·

Vendor product: Patch Manager

CVSS 3.1 4.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112958Published

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

cve-program ·

Vendor product: apostrophe

CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-104937Published

CVE-2026-104937

cve-program ·

Vendor product: Shopware

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-16753Published

CVE-2026-16753

cve-program ·

Vendor product: Lowcoder

Source modified 20 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.