Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694538 source statements · aliases may refer to the same vulnerability

CVE-2026-101304Published

Multiple jail filesystem root escapes

cve-program ·

Vendor product: FreeBSD

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-63619Published

Apache Kylin: Missing authorization and path-confinement on system meta dump

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112936Published

filelock: ReadWriteLock follows a symlink at the lock path into SQLite

cve-program ·

Vendor product: filelock

CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112946Published

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

cve-program ·

Vendor product: vite · Vendor product: vite-plus

CVSS 4.0 6.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112836Published

WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: vikrentcar

CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112951Published

ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

cve-program ·

Vendor product: apostrophe

CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2025-71436Published

Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag

cve-program ·

Vendor product: Raptor RDF Syntax Library

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113597Published

Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures

cve-program ·

Vendor product: blinko

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113602Published

json-smart through 2.6.0 Strict-Mode Validation Bypass via 0x1A Character

cve-program ·

Vendor product: json-smart

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113607Published

Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data

cve-program ·

Vendor product: moodle-block_configurablereports

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113612Published

SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint

cve-program ·

Vendor product: SparkyFitness

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112953Published

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

cve-program ·

Vendor product: apostrophe · Vendor product: import-export

CVSS 4.0 6.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113679Published

HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string

cve-program ·

Vendor product: harfbuzz

CVSS 4.0 7.3 · CVSS 3.1 7.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113676Published

Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get API

cve-program ·

Vendor product: froxlor

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113609Published

Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts

cve-program ·

Vendor product: Bandizip

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113604Published

Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts

cve-program ·

Vendor product: ghidra

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113599Published

Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation

cve-program ·

Vendor product: modoboa

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113594Published

Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route

cve-program ·

Vendor product: sharkord

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112948Published

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

cve-program ·

Vendor product: vitest · Vendor product: browser · Vendor product: ui

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112824Published

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: bus-ticket-booking-with-seat-reservation

CVSS 3.1 5.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-111764Published

A2A Java SDK has a fail-open default task authorization

cve-program ·

Vendor product: a2a-java

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112956Published

ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content

cve-program ·

Vendor product: apostrophe · Vendor product: mport-export

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-40246Published

free5GC is an open-source implementation of the 5G core network. In versions 1.4.2 and below of the UDR service, the handler for deleting Traffic Influence Subscriptions checks whether the influenceId path segment equals subs-to-notify, but…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-55784Published

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-112240Published

Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

cve-program ·

https://packagist.org/: codingms/fluid-form

CVSS 4.0 6.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-43852Published

A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.

cve-program ·

Vendor product: ADAM-3600

CVSS 4.0 8.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-43838Published

A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.

cve-program ·

Vendor product: ADAM-3600

CVSS 4.0 9.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-111059Published

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

cve-program ·

Vendor product: mercury

CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112159Published

JumpServer Template Rendering os command injection

cve-program ·

Vendor product: JumpServer

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-12660Published

IBM MQ Path Traversal

cve-program ·

Vendor product: MQ Operator · Vendor product: MQ Advanced container images

CVSS 3.1 2.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113404Published

Uniong｜WebITR - Insecure Deserialization

cve-program ·

Vendor product: WebITR

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-11831Published

IBM MQ Heap-based Buffer Overflow

cve-program ·

Vendor product: MQ Operator · Vendor product: MQ Advanced container images

CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-14511Published

IBM MQ Denial of Service

cve-program ·

Vendor product: MQ

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-111066Published

AIOHTTP: File descriptor exhaustion in multipart requests

cve-program ·

Vendor product: aiohttp

CVSS 4.0 8.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112247Published

Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting

cve-program ·

Vendor product: Five-in-One Safety Production Management Information System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-3303Published

IBM Concert Software Permissive Cross-domain Security Policy

cve-program ·

Vendor product: Concert

CVSS 3.1 3.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113402Published

ArmorX Global Technology｜ArmorX Spam - Local File Inclusion

cve-program ·

Vendor product: ArmorX Spam

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-111757Published

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

cve-program ·

Vendor product: hono

CVSS 3.1 5.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2023-38375Published

IBM Cloud Pak System Cross-Site Scripting

cve-program ·

Vendor product: Cloud Pak System

CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112252Published

Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection

cve-program ·

Vendor product: Wubang Five-in-One Safety Production Management Information System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112772Published

Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection

cve-program ·

Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112777Published

Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist Bypass Leading to RCE

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 7.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112782Published

Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service

cve-program ·

Vendor product: grav · Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-71169Published

Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclo…

cve-program ·

Vendor product: Application Store

CVSS 3.1 7.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112300Published

DiffSK configobj init.py _sectionmarker redos

cve-program ·

Vendor product: configobj

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112391Published

Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

cve-program ·

Vendor product: Pillow

CVSS 4.0 6.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112396Published

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

cve-program ·

Vendor product: Pillow

CVSS 3.1 5.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112401Published

Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()

cve-program ·

Vendor product: Pillow

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112360Published

Netis EAP930 CGI Endpoint debug return200 backdoor

cve-program ·

Vendor product: EAP930

CVSS 4.0 8.9 · CVSS 3.1 8.0 · CVSS 3.0 8.0 · CVSS 2.0 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112406Published

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.7Source modified 20 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.