Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694615 source statements · aliases may refer to the same vulnerability

CVE-2026-91159Published

Discourse: Stored oEmbed HTML injection via allowed iframe

cve-program ·

Vendor product: discourse

CVSS 3.1 7.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101896Published

Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)

cve-program ·

Vendor product: angular · Vendor product: router

CVSS 4.0 8.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110719Published

Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header

cve-program ·

https://www.npmjs.com: gateway

CVSS 4.0 6.9 · CVSS 3.1 7.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110714Published

libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow

cve-program ·

https://github.com/sahlberg/libsmb2: libsmb2

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110659Published

ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry

cve-program ·

https://github.com/serge1/ELFIO: ELFIO

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110654Published

libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs

cve-program ·

https://github.com/zapping-vbi/zvbi: libzvbi

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110646Published

Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()

cve-program ·

https://packagist.org: snappdf

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110641Published

@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name

cve-program ·

https://registry.npmjs.org: @runnerty/executor-decompress

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110636Published

pypdftk through 0.5 OS Command Injection via PDF and Output Paths

cve-program ·

https://pypi.org: pypdftk

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110631Published

Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration

cve-program ·

Vendor product: komodo

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110626Published

ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

cve-program ·

https://github.com: clipbucket-v5

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110621Published

Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

cve-program ·

https://github.com/Swetrix/swetrix: swetrix

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110616Published

NullHub through 2026.5.29 Missing Authentication for /api Management API

cve-program ·

Vendor product: NullHub

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110611Published

REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid

cve-program ·

https://github.com: rebuild

CVSS 4.0 6.0 · CVSS 3.1 5.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110606Published

LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader

cve-program ·

https://github.com/LibreCAD/libdxfrw: libdxfrw · Vendor product: LibreCAD

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110601Published

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF

cve-program ·

https://github.com: libsixel

CVSS 4.0 5.8 · CVSS 3.1 6.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110596Published

quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search

cve-program ·

Vendor product: quirc

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110591Published

OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer

cve-program ·

https://repo1.maven.org/maven2/: ASM

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-110260Published

OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers

cve-program ·

https://repo1.maven.org/maven2/: ASM

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2024-58392Published

PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint

cve-program ·

https://github.com/icculus/physfs: PhysicsFS

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 20 Oct 2026Recorded 23 Oct 2026

GHSA-5wf9-h793-w73cPublished

Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks

osv · GO-2026-6651

Go: github.com/xtls/xray-core

HIGHSource modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-r3rm-qphw-hh76Published

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

osv · CVE-2026-41508 · GO-2026-6670

Go: github.com/corazawaf/coraza/v3

MODERATESource modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-f46q-3v67-fmm4Published

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

osv · CVE-2026-62251 · GO-2026-6672

Go: github.com/sipcapture/homer-app

HIGHSource modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-6r3q-mjv7-xr8mPublished

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

osv · CVE-2026-41510 · GO-2026-6668

Go: github.com/corazawaf/coraza/v3

HIGHSource modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-rqcc-94gv-wjm9Published

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

osv · CVE-2026-62253 · GO-2026-6673

Go: github.com/sipcapture/homer-app

CRITICALSource modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-q7hv-xx6h-q2x8Published

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

osv · CVE-2026-26287 · GO-2026-6667

Go: github.com/external-secrets/external-secrets

HIGHSource modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-6xp5-7rcx-xfgxPublished

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

osv · CVE-2026-62252 · GO-2026-6671

Go: github.com/sipcapture/homer-app

CRITICALSource modified 20 Oct 2026Recorded 24 Oct 2026

GO-2026-6668Published

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza

osv · CVE-2026-41510 · GHSA-6r3q-mjv7-xr8m

Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3

Source modified 20 Oct 2026Recorded 24 Oct 2026

GO-2026-6672Published

Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app

osv · CVE-2026-62251 · GHSA-f46q-3v67-fmm4

Go: github.com/sipcapture/homer-app

Source modified 20 Oct 2026Recorded 24 Oct 2026

GO-2026-6673Published

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app

osv · CVE-2026-62253 · GHSA-rqcc-94gv-wjm9

Go: github.com/sipcapture/homer-app

Source modified 20 Oct 2026Recorded 24 Oct 2026

GO-2026-6671Published

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app

osv · CVE-2026-62252 · GHSA-6xp5-7rcx-xfgx

Go: github.com/sipcapture/homer-app

Source modified 20 Oct 2026Recorded 24 Oct 2026

GO-2026-6670Published

Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza

osv · CVE-2026-41508 · GHSA-r3rm-qphw-hh76

Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3

Source modified 20 Oct 2026Recorded 24 Oct 2026

GO-2026-6667Published

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration in github.com/external-secrets/external-secrets

osv · CVE-2026-26287 · GHSA-q7hv-xx6h-q2x8

Go: github.com/external-secrets/external-secrets

Source modified 20 Oct 2026Recorded 24 Oct 2026

GHSA-prpw-wwv7-xjjrPublished

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields

osv · CVE-2026-41504 · GO-2026-6669

Go: github.com/corazawaf/coraza/v3

MODERATESource modified 20 Oct 2026Recorded 24 Oct 2026

GO-2026-6669Published

Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields in github.com/corazawaf/coraza

osv · CVE-2026-41504 · GHSA-prpw-wwv7-xjjr

Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3

Source modified 20 Oct 2026Recorded 24 Oct 2026

MAL-2026-18057Published

Malicious code in chatgpt-pro-activator (npm)

osv · GHSA-qp43-mgx6-56x2

npm: chatgpt-pro-activator

Source modified 19 Oct 2026Recorded 24 Oct 2026

MAL-2026-18052Published

Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm)

osv · GHSA-42h4-pvwr-r87v

npm: @an1mshnpmb9c84920/stage-repo-m19g7

Source modified 19 Oct 2026Recorded 24 Oct 2026

MAL-2026-18051Published

Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm)

osv · GHSA-6grm-8w52-497r

npm: @an1mshnpmb9c84920/stage-outer-m19s5

Source modified 19 Oct 2026Recorded 24 Oct 2026

MAL-2026-18050Published

Malicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm)

osv · GHSA-h79g-mv9q-7p44

npm: @an1mshnpmb9c84920/stage-fn-m19p2

Source modified 19 Oct 2026Recorded 24 Oct 2026

MAL-2026-18048Published

Malicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm)

osv · GHSA-hxmq-p768-mjhf

npm: @an1mshnpmb9c84920/pipe-compat-m19r8

Source modified 19 Oct 2026Recorded 24 Oct 2026

MAL-2026-18058Published

Malicious code in chatgpt-pro-setup-tool (npm)

osv · GHSA-xwx3-5h3q-2v8r

npm: chatgpt-pro-setup-tool

Source modified 19 Oct 2026Recorded 24 Oct 2026

CVE-2026-111919Published

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created. Former collaborators keep receiving task titles and description…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-13767Published

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fails to validate user channel membership when attaching Mattermost posts as comments to Jira issues, which allows an authenticated attacker with…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-15613Published

Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-23390Published

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execut…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64641Published

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 fail to verify that post actions invoking /share-issue-publicly were created by the Jira plugin which allowed a malicious Mattermost user to exfi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.1 · CVSS 3.1 · [email protected] · Primary 4.1Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-68665Published

LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 19 Oct 2026Recorded 25 Oct 2026

GHSA-g38j-7v97-x298Published

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

osv · GO-2026-6732

Go: code.vikunja.io/api

MODERATESource modified 19 Oct 2026Recorded 24 Oct 2026

GHSA-3hc7-r24j-rpwcPublished

Vikunja: Cross-project task disclosure through subtask expansion

osv · GO-2026-6714

Go: code.vikunja.io/api

MODERATESource modified 19 Oct 2026Recorded 24 Oct 2026

GHSA-8wvg-r2j4-3737Published

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

osv · GO-2026-6723

Go: code.vikunja.io/api

MODERATESource modified 19 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.