Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694541 source statements · aliases may refer to the same vulnerability

GO-2026-6707Published

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied in github.com/0xJacky/Nginx-UI

osv · CVE-2026-107810 · GHSA-p8v3-89rh-jxc7

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6708Published

Nginx UI: Node Secret Credential Exposure via URL Query Parameter in github.com/0xJacky/Nginx-UI

osv · CVE-2026-107807 · GHSA-pvgv-gcp7-v38g

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6704Published

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) in github.com/0xJacky/Nginx-UI

osv · CVE-2026-107808 · GHSA-45gv-9wjv-xh7p

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6781Published

Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE in github.com/0xJacky/Nginx-UI

osv · CVE-2026-84318 · GHSA-9jww-cxg5-rj9m

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6755Published

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) in code.vikunja.io/api

osv · CVE-2026-91984 · GHSA-w39f-h553-h2mx

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6706Published

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up in github.com/0xJacky/Nginx-UI

osv · CVE-2026-107813 · GHSA-h246-wpgf-vmq5

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6695Published

Panic via unchecked pivot-cache field index in github.com/xuri/excelize/v2

osv · CVE-2026-107211 · GHSA-mx22-3794-2vpv

Go: github.com/xuri/excelize/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6805Published

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin in github.com/coredns/coredns

osv · CVE-2026-62994 · GHSA-74w3-63xv-x9mv

Go: github.com/coredns/coredns

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6807Published

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) in github.com/getarcaneapp/arcane/backend

osv · CVE-2026-96627 · GHSA-pw5q-rjx4-7f7p

Go: github.com/getarcaneapp/arcane/backend · Go: github.com/getarcaneapp/arcane/backend/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6806Published

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` in github.com/getarcaneapp/arcane/backend

osv · CVE-2026-96628 · GHSA-mp22-58ff-6fhr

Go: github.com/getarcaneapp/arcane/backend · Go: github.com/getarcaneapp/arcane/backend/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6797Published

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module in github.com/dunglas/frankenphp

osv · CVE-2026-82416 · GHSA-v3ph-cgqh-r8p5

Go: github.com/dunglas/frankenphp

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6791Published

containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd

osv · CVE-2026-95837 · GHSA-p7v4-vr35-mj6f

Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6759Published

Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api

osv · CVE-2026-91968 · GHSA-xxc3-xpmc-vmvr

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6802Published

SFTPGo source-side file-pattern filter bypass during copy operations in github.com/drakkan/sftpgo

osv · CVE-2026-103028 · GHSA-wwv9-g5x4-966q

Go: github.com/drakkan/sftpgo · Go: github.com/drakkan/sftpgo/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6794Published

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha

osv · CVE-2026-100394 · GHSA-qjpp-gffx-2wm9

Go: github.com/nezhahq/nezha

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6796Published

containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd

osv · CVE-2026-95838 · GHSA-rp3h-jf77-q9p4

Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6746Published

Vikunja: Unbounded CSV row cardinality permits API process termination in code.vikunja.io/api

osv · CVE-2026-91969 · GHSA-pqf9-h8g4-8gmh

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6754Published

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api

osv · GHSA-w2ch-4xgr-22ww

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6792Published

SFTPGo: Denial of service via malformed SSH channel request in github.com/drakkan/sftpgo

osv · CVE-2026-77375 · GHSA-q7pc-356p-hggc

Go: github.com/drakkan/sftpgo · Go: github.com/drakkan/sftpgo/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6772Published

Gotify: Insufficiently Protected Password Change endpoint in github.com/gotify/server

osv · CVE-2026-102603 · GHSA-3hcj-9m7p-wwm9

Go: github.com/gotify/server · Go: github.com/gotify/server/v2 · Go: github.com/gotify/server/v3

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6757Published

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API in code.vikunja.io/api

osv · CVE-2026-91970 · GHSA-wq92-8x3r-fm38

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6756Published

Vikunja: Denial of service via decompression bomb in the data import in code.vikunja.io/api

osv · CVE-2026-91979 · GHSA-w7jp-mf2v-8342

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6766Published

GitHub CLI partially discloses authentication tokens in `gh auth status` output in github.com/cli/cli

osv · CVE-2026-64652 · GHSA-cg6r-mpgc-h9mm

Go: github.com/cli/cli · Go: github.com/cli/cli/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6716Published

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service in github.com/luskaner/ageLANServer/server

osv · CVE-2026-107839 · GHSA-4jfq-pmq9-257h

Go: github.com/luskaner/ageLANServer/server

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6773Published

Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI

osv · CVE-2026-84312 · GHSA-44xr-mrhh-qm78

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6771Published

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI

osv · CVE-2026-84314 · GHSA-2gc7-j998-5xx6

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6723Published

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/api

osv · GHSA-8wvg-r2j4-3737

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6713Published

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project in code.vikunja.io/api

osv · CVE-2026-91980 · GHSA-39p5-2wrr-xh29

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6711Published

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure in code.vikunja.io/api

osv · CVE-2026-76216 · GHSA-32r8-5843-4qw2

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6702Published

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser in github.com/0xJacky/Nginx-UI

osv · CVE-2026-107811 · GHSA-32gc-wf3m-78w9

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6737Published

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/api

osv · CVE-2026-91973 · GHSA-m469-88xx-8rx2

Go: code.vikunja.io/api

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6724Published

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI

osv · CVE-2026-107804 · GHSA-9h23-53f4-q947

Go: github.com/0xJacky/Nginx-UI

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6684Published

Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks in github.com/xuri/excelize

osv · CVE-2026-107214 · GHSA-2j4c-ffch-9f23

Go: github.com/360EntSecGroup-Skylar/excelize/v2 · Go: github.com/xuri/excelize/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6686Published

Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user

osv · CVE-2026-61801 · GHSA-mjcv-p78q-w5fw

Go: github.com/moby/sys/user

Source modified 19 Oct 2026Recorded 24 Oct 2026

GO-2026-6685Published

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize

osv · CVE-2026-107212 · GHSA-jw42-f3rr-4cc3

Go: github.com/360EntSecGroup-Skylar/excelize/v2 · Go: github.com/xuri/excelize/v2

Source modified 19 Oct 2026Recorded 24 Oct 2026

CVE-2026-111872Published

itsmeravitejak Online-Examination-System database.php getreport sql injection

cve-program ·

Vendor product: Online-Examination-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111903Published

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 19 Oct 2026Recorded 23 Oct 2026

MAL-2026-17907Published

Malicious code in @beloved-lenora/opencode-shell-guard (npm)

osv · GHSA-pm76-w63j-7j29

npm: @beloved-lenora/opencode-shell-guard

Source modified 19 Oct 2026Recorded 24 Oct 2026

CVE-2026-111897Published

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111881Published

FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111854Published

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient va…

cve-program ·

Vendor product: 3 Series MDO

CVSS 3.1 8.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-49410Published

OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation

cve-program ·

Vendor product: openhuman

CVSS 3.1 8.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-108373Published

ERPNext: Unauthorised access to financial data due to missing validation

cve-program ·

Vendor product: erpnext

CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112768Published

Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 6.9Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112773Published

Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

cve-program ·

Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112254Published

agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

cve-program ·

Vendor product: clientst0r

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2024-54657Rejected

This candidate was in a CNA pool that was not assigned to any issues.

cve-program ·

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2024-54656Rejected

This candidate was in a CNA pool that was not assigned to any issues.

cve-program ·

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2024-54655Rejected

This candidate was in a CNA pool that was not assigned to any issues.

cve-program ·

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2024-54654Rejected

This candidate was in a CNA pool that was not assigned to any issues.

cve-program ·

Source modified 19 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.