Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694615 source statements · aliases may refer to the same vulnerability

CVE-2026-58391Published

OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout

cve-program ·

Vendor product: core

CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-59994Published

EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received

cve-program ·

Vendor product: espocrm

CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110957Published

Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection

cve-program ·

Vendor product: WL-WN530BE2-A

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-47168Published

EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params

cve-program ·

Vendor product: espocrm

CVSS 3.1 9.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110909Published

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code subm…

cve-program ·

Vendor product: Wheels CLI

CVSS 3.1 5.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-109430Published

Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection

cve-program ·

Vendor product: WebAdvisor

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-106701Published

ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.

cve-program ·

Vendor product: n/a

CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-104586Published

AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

cve-program ·

Vendor product: n/a

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-88753Published

A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

cve-program ·

Vendor product: n/a

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110871Published

Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

cve-program ·

Vendor product: nodemailer

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110866Published

Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request

cve-program ·

Vendor product: renovate · Vendor product: renovate-ce · Vendor product: renovate-ee-server

CVSS 4.0 5.3 · CVSS 3.1 4.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110861Published

Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition

cve-program ·

Vendor product: drizzle-adapter · Vendor product: kysely-adapter · Vendor product: better-auth

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110856Published

GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

cve-program ·

Vendor product: GitPython

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110851Published

n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint

cve-program ·

Vendor product: n8n

CVSS 4.0 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110846Published

n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

cve-program ·

Vendor product: n8n

CVSS 4.0 7.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110841Published

n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval

cve-program ·

Vendor product: n8n

CVSS 4.0 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110836Published

FreeRDP 3.0.0 before 3.32.0 Infinite Loop DoS via Gateway Content-Type

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-77524Published

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled en…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-101896Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-110831Published

FreeRDP 3.13.0 before 3.32.0 Resource Leak via Drive Redirection IRP_MJ_CREATE

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110698Published

Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write

cve-program ·

Vendor product: Praat

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110689Published

OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetPath protection mechanism

cve-program ·

Vendor product: ClawScan

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-104108Published

FileRise OIDC login can bind an attacker identity to an existing local account

cve-program ·

Vendor product: FileRise

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-103977Published

FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

cve-program ·

Vendor product: FileRise

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-77427Published

FileRise: Insecure default cryptographic key fallback in manual installs

cve-program ·

Vendor product: FileRise

CVSS 3.1 5.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-57493Published

FileRise: Remember-me auto-login uses stale admin role from token instead of current role

cve-program ·

Vendor product: FileRise

CVSS 3.1 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-57489Published

FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

cve-program ·

Vendor product: FileRise

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-55679Published

WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

cve-program ·

Vendor product: WeGIA

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-102985Published

Plane: Any project member can modify (deactivate) other members' records

cve-program ·

Vendor product: plane

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110668Published

cemtan sar2html sar2html.py index sql injection

cve-program ·

Vendor product: sar2html

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-55385Published

InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration

cve-program ·

Vendor product: InvoiceShelf

CVSS 3.1 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-54701Published

Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

cve-program ·

Vendor product: vscode-markdown-preview-enhanced

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-82402Published

Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`

cve-program ·

Vendor product: gogs

CVSS 4.0 5.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110773Published

GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint

cve-program ·

https://github.com/growchief/growchief: growchief

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110768Published

holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist

cve-program ·

https://github.com/holaboss-ai/holaOS: holaOS

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110763Published

lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

cve-program ·

https://github.com/zuihou/lamp-boot: lamp-boot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-102756Published

DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting

cve-program ·

Vendor product: dataease

CVSS 4.0 5.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-100406Published

dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

cve-program ·

Vendor product: dbt-core

CVSS 4.0 8.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-73260Published

Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

cve-program ·

Vendor product: mongoose

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-103043Published

anchorme through 3.0.8 Regular Expression Denial of Service

cve-program ·

Vendor product: anchorme

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-55167Published

LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session

cve-program ·

Vendor product: lam

CVSS 3.1 4.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-54554Published

FOG adInfo endpoint is reported to disclose the Active Directory join password

cve-program ·

Vendor product: fogproject

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-109527Published

Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

cve-program ·

Vendor product: python-sdk

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92150Published

F´: GenericHub Malformed Buffer Assertion DoS

cve-program ·

Vendor product: fprime

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92157Published

F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion

cve-program ·

Vendor product: fprime

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2016-15060Published

PCMan FTP Server PORT buffer overflow

cve-program ·

Vendor product: FTP Server

CVSS 4.0 6.9 · CVSS 3.1 8.3 · CVSS 3.0 8.3 · CVSS 2.0 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-77524Published

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

cve-program ·

Vendor product: keda

CVSS 3.1 9.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-102695Published

OmniFaces: Forged combined-resource IDs and related output/push boundaries

cve-program ·

Vendor product: omnifaces

CVSS 3.1 8.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110735Published

Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit inte…

cve-program ·

Vendor product: Godot Engine

CVSS 3.1 2.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-91157Published

Discourse: Media uploads remain publicly accessible after category permissions are restricted

cve-program ·

Vendor product: discourse

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.