Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694708 source statements · aliases may refer to the same vulnerability

CVE-2026-112290Published

MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item

cve-program ·

https://www.npmjs.com: Intelligence Community UI Kit canary web components

CVSS 4.0 2.3 · CVSS 3.1 4.7Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112147Published

ai-genius-automations octoally index.ts information disclosure

cve-program ·

Vendor product: octoally

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-109432Published

Camunda Expression Injection via orQueries RCE

cve-program ·

Vendor product: Camunda 7

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112152Published

vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection

cve-program ·

Vendor product: Criminal-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112306Published

NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

cve-program ·

https://github.com/nocobase/nocobase: nocobase

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112363Published

Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111046Published

FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions

cve-program ·

Vendor product: FOSSBilling

CVSS 4.0 2.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112039Published

diem-project diem Administrative Console actions.class.php append cross site scripting

cve-program ·

Vendor product: diem

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112035Published

aircheng-org iWebShop-5 simple.php send_message_mobile password recovery

cve-program ·

Vendor product: iWebShop-5

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-494h-xx7x-5frhPublished

Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

osv · CVE-2026-70183

NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm · NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64 · NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm

HIGHSource modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-w5qq-qrpp-rf4cPublished

Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability

osv · CVE-2026-70181

NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm · NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64 · NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm

HIGHSource modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-57xr-hfxx-jw5xPublished

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

osv · CVE-2026-70196

NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm · NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64 · NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm

MODERATESource modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-x3vp-85cm-q97rPublished

Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability

osv · CVE-2026-70175

NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm · NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm64 · NuGet: Microsoft.AspNetCore.App.Runtime.linux-musl-arm

HIGHSource modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-fqpq-cx42-9jmmPublished

Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability

osv · CVE-2026-70194

NuGet: Microsoft.NETCore.App.Runtime.linux-arm · NuGet: Microsoft.NETCore.App.Runtime.linux-arm64 · NuGet: Microsoft.NETCore.App.Runtime.linux-musl-arm

MODERATESource modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-7hqp-7c5m-4vq6Published

Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability

osv · BIT-dotnet-2026-96960 · BIT-dotnet-sdk-2026-96960 · CVE-2026-96960

NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml

HIGHSource modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112055Published

wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP

cve-program ·

https://github.com/AbiWord/wv: wv

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112031Published

Chamilo LMS Ticket TicketManager.php addProject cross site scripting

cve-program ·

Vendor product: LMS

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112111Published

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted…

cve-program ·

https://wordpress.org/plugins: bootstrap-shortcodes

CVSS 4.0 5.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112027Published

light0011 cms Uploadify check-exists.php file_exists file information disclosure

cve-program ·

Vendor product: cms

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111992Published

itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection

cve-program ·

Vendor product: Online-Examination-System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111987Published

AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting

cve-program ·

Vendor product: stable-diffusion-webui

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2025-10545Published

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{cha…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-10678Published

NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL.

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-10954Published

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input caus…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-11362Published

Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-11849Published

Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.4 · CVSS 3.1 · [email protected] · Secondary 9.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-3193Published

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-3930Published

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-41410Published

Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Sl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-41443Published

Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/te…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-54499Published

Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1 · CVSS 3.1 · [email protected] · Primary 3.7Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-58073Published

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-58075Published

Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-59043Published

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to m…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-59159Published

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for S…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-59433Published

Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests wi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-59530Published

quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-61685Published

Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vulnerable to a Directory Traversal attack that results in the disclosure of directory listings. The code contains a securit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-61928Published

Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the `api/auth/api-…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62162Published

cel-rust is a Common Expression Language interpreter written in Rust. Starting in version 0.10.0 and prior to version 0.11.4, parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate i…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62171Published

ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62506Published

MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policie…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62513Published

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62713Published

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, produ…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-9079Published

Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration which allows admin users to execute arbitrary code via malicious plugin upl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.0 · CVSS 3.1 · [email protected] · Primary 7.2Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-9081Published

Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file download endpoint using UUID enumeration

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2026-112050Published

Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

cve-program ·

Vendor product: gitify

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112021Published

snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()

cve-program ·

Vendor product: snac2

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112016Published

Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging Files

cve-program ·

Vendor product: NR256CN

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-334f-vvp4-7g6pPublished

Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

osv · CVE-2026-70159

NuGet: Microsoft.AspNetCore.SignalR.Common · NuGet: Microsoft.AspNetCore.SignalR.Common · NuGet: Microsoft.AspNetCore.SignalR.Common

HIGHSource modified 19 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.