Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694539 source statements · aliases may refer to the same vulnerability

CVE-2025-1247Published

Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instance

cve-program ·

https://github.com/quarkusio/quarkus/: quarkus-rest · https://access.redhat.com/downloads/content/package-browser/: quarkus-rest · https://access.redhat.com/downloads/content/package-browser/: quarkus-rest

CVSS 3.1 8.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2023-6394Published

Quarkus: graphql operations over websockets bypass

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: Red Hat build of Quarkus 2.13.9 · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.quarkus/quarkus-smallrye-graphql · https://access.redhat.com/downloads/content/package-browser/: graphql-java

CVSS 3.1 7.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-10743Published

IBM MQ Race Condition

cve-program ·

Vendor product: MQ Operator · Vendor product: MQ Advanced container images

CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-83531Published

Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-dynamic-router

CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-88900Published

Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-jgroups

CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-78162Published

Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-hazelcast

CVSS 4.0 10.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-103849Published

Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

cve-program ·

Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source

CVSS 3.1 10.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-97394Published

kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding application/x-www-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-110871Published

Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-110861Published

Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is no…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 3.7Source modified 20 Oct 2026Recorded 27 Oct 2026

CVE-2026-100352Published

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-55480Published

CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)

cve-program ·

Vendor product: cups

CVSS 3.1 5.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-77467Published

Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path

cve-program ·

Vendor product: Lychee

CVSS 4.0 7.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-61610Published

Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

cve-program ·

Vendor product: Lychee

CVSS 4.0 2.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-100352Published

kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path

cve-program ·

Vendor product: kin-openapi

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-97394Published

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

cve-program ·

Vendor product: kin-openapi

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-58390Published

OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

cve-program ·

Vendor product: core

CVSS 3.1 8.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-58391Published

OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout

cve-program ·

Vendor product: core

CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-59994Published

EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received

cve-program ·

Vendor product: espocrm

CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110957Published

Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection

cve-program ·

Vendor product: WL-WN530BE2-A

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-47168Published

EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

cve-program ·

Vendor product: espocrm

CVSS 3.1 9.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110909Published

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code subm…

cve-program ·

Vendor product: Wheels CLI

CVSS 3.1 5.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-109430Published

Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection

cve-program ·

Vendor product: WebAdvisor

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-106701Published

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.

cve-program ·

Vendor product: n/a

CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-104586Published

AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

cve-program ·

Vendor product: n/a

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-88753Published

A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

cve-program ·

Vendor product: n/a

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110871Published

Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

cve-program ·

Vendor product: nodemailer

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110866Published

Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request

cve-program ·

Vendor product: renovate · Vendor product: renovate-ce · Vendor product: renovate-ee-server

CVSS 4.0 5.3 · CVSS 3.1 4.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110861Published

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

cve-program ·

Vendor product: drizzle-adapter · Vendor product: kysely-adapter · Vendor product: better-auth

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110856Published

GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

cve-program ·

Vendor product: GitPython

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110851Published

n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint

cve-program ·

Vendor product: n8n

CVSS 4.0 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110846Published

n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

cve-program ·

Vendor product: n8n

CVSS 4.0 7.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110841Published

n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval

cve-program ·

Vendor product: n8n

CVSS 4.0 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110836Published

FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-77524Published

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled en…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-101896Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-110831Published

FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110698Published

Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

cve-program ·

Vendor product: Praat

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110689Published

OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism

cve-program ·

Vendor product: ClawScan

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-104108Published

FileRise OIDC login can bind an attacker identity to an existing local account

cve-program ·

Vendor product: FileRise

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-103977Published

FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

cve-program ·

Vendor product: FileRise

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-77427Published

FileRise: Insecure default cryptographic key fallback in manual installs

cve-program ·

Vendor product: FileRise

CVSS 3.1 5.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-57493Published

FileRise: Remember-me auto-login uses stale admin role from token instead of current role

cve-program ·

Vendor product: FileRise

CVSS 3.1 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-57489Published

FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

cve-program ·

Vendor product: FileRise

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-55679Published

WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

cve-program ·

Vendor product: WeGIA

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-102985Published

Plane: Any project member can modify (deactivate) other members' records

cve-program ·

Vendor product: plane

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110668Published

cemtan sar2html sar2html.py index sql injection

cve-program ·

Vendor product: sar2html

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-55385Published

InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

cve-program ·

Vendor product: InvoiceShelf

CVSS 3.1 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-54701Published

Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

cve-program ·

Vendor product: vscode-markdown-preview-enhanced

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-82402Published

Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`

cve-program ·

Vendor product: gogs

CVSS 4.0 5.3Source modified 20 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.