Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694708 source statements · aliases may refer to the same vulnerability

CVE-2026-112011Published

libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek Table

cve-program ·

https://sourceforge.net/projects/tta/: libtta

CVSS 4.0 5.8 · CVSS 3.1 5.3Source modified 19 Oct 2026Recorded 23 Oct 2026

GHSA-2mxg-prvg-9jfgPublished

Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability

osv · CVE-2026-85790

NuGet: Microsoft.Native.Quic.MsQuic.Schannel · NuGet: Microsoft.Native.Quic.MsQuic.Schannel

MODERATESource modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112006Published

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation

cve-program ·

https://pypi.org: opentelemetry-exporter-otlp-proto-http

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112001Published

ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

cve-program ·

Vendor product: ProjectSend

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-110886Published

WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: conversational-forms

CVSS 3.1 9.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-109894Published

WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: booktics

CVSS 3.1 9.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-110897Published

WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: powerpack-addon-for-beaver-builder

CVSS 3.1 7.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-110382Published

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: simply-schedule-appointments

CVSS 3.1 7.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-108485Published

WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: estore

CVSS 3.1 7.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111942Published

hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting

cve-program ·

Vendor product: Blood_Bank_Management_System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111874Published

OpenCATS Career Portal CareersUI.php processLogin excessive authentication

cve-program ·

Vendor product: OpenCATS

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-46471Published

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory c…

cve-program ·

Vendor product: n/a

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111793Published

Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing th…

cve-program ·

Vendor product: Webtop Media Transcoder

CVSS 3.1 4.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111870Published

itsmeravitejak Online-Examination-System admin.php isAdmin missing authentication

cve-program ·

Vendor product: Online-Examination-System

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-77228Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-77227Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-77225Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-96627Published

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of de…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2026-111933Published

Coder before 2.34.2 User Enumeration via Login Placeholder Hash

cve-program ·

Vendor product: coder · Vendor product: coder · Vendor product: coder

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111865Published

THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection

cve-program ·

Vendor product: yoloe

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111928Published

Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy

cve-program ·

Vendor product: coder

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111922Published

Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

cve-program ·

Vendor product: vikunja

CVSS 4.0 7.2 · CVSS 3.1 6.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111917Published

Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

cve-program ·

Vendor product: vikunja

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112222Published

WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: surferseo

CVSS 3.1 5.4Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-107674Published

IBM i is Affected by a Denial of Service in Digital Certificate Manager

cve-program ·

Vendor product: i

CVSS 3.1 5.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111911Published

phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-17488Published

IBM i is Affected By An Improper Authentication Vulnerability in SST / DST

cve-program ·

Vendor product: i

CVSS 3.1 4.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111906Published

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations

cve-program ·

Vendor product: phpMyFAQ · Vendor product: phpMyFAQ

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111901Published

phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111895Published

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

cve-program ·

Vendor product: phpMyFAQ · Vendor product: phpMyFAQ

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111890Published

phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 7.0 · CVSS 3.1 5.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2025-71435Published

Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

cve-program ·

Vendor product: coder

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85315Published

Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-grpc

CVSS 3.1 5.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111823Published

Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

cve-program ·

Vendor product: mage-ai

CVSS 3.1 9.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85301Published

Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-keycloak

CVSS 3.1 4.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85300Published

Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-pqc

CVSS 3.1 5.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85312Published

Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-core

CVSS 3.1 4.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-96627Published

Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

cve-program ·

Vendor product: arcane

CVSS 3.1 8.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85313Published

Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-jetty

CVSS 3.1 4.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85314Published

Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-mail

CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85316Published

Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-platform-http

CVSS 3.1 4.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85317Published

Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-http

CVSS 3.1 4.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-96542Published

EA Javelin Anticheat Installer Local Privilege Escalation

cve-program ·

Vendor product: EA Javelin Anticheat (EA Javelin Anticheat Installer)

CVSS 3.1 5.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-88901Published

Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-smooks

CVSS 3.1 8.2Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-91858Published

Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-fop

CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-108374Published

ERPNext: Unauthorised status modification due to missing validation

cve-program ·

Vendor product: erpnext

CVSS 3.1 7.7Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111410Published

WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: e2pdf

CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111831Published

WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: fluentform

CVSS 3.1 5.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-8168Published

Denial-of-service vulnerability in the SVG parser and renderer impacts Qt

cve-program ·

Vendor product: qt

CVSS 4.0 7.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-110008Published

@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

cve-program ·

Vendor product: @fastify/oauth2

CVSS 3.1 4.2Source modified 19 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.