Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694708 source statements · aliases may refer to the same vulnerability

CVE-2025-55070Published

Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-55073Published

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-55074Published

Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.0 · CVSS 3.1 · [email protected] · Primary 3.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-59840Published

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62161Published

Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki utilizes bind mounting the container's /dev/null as a file mask.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 10.0Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62594Published

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62596Published

Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with path substitution during pathname resolution, can allow writ…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 10.0Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62705Published

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.7 · CVSS 3.1 · [email protected] · Primary 4.9Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-62726Published

n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote rep…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64101Published

Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mechanism. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming req…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64102Published

Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, an attacker can perform an online brute-force attack on OTP, TOTP, and passwords. While Zitadel allows preventing online brute force attacks in sce…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64103Published

Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64324Published

KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Primary 7.7Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64523Published

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference (IDOR) vulnerability in the…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64715Published

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.0 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64717Published

ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulnerability in ZITADEL's federation process allowed auto-linking users from external identity providers …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.4 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64746Published

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean up field-level permissions when a field is deleted. When a field is removed from a collection, its r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.6 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64747Published

Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 11.13.0 that allows users with `upload files` and `edit item` permissions to inje…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64748Published

Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual valu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64749Published

Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-64751Published

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 <= Helm chart <= openfga-0.2.48, v.1.4.0 <= docker <= v.1.11.0) are …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.8 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-65942Published

VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS atta…

nvd ·

CVSS 3.1 · [email protected] · Secondary 2.7Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2025-66035Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7Source modified 19 Oct 2026Recorded 25 Oct 2026

CVE-2026-111635Published

Helical Insight through 7.0.0 Path Traversal via /getExternalResource

cve-program ·

Vendor product: helicalinsight

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111630Published

abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations

cve-program ·

Vendor product: abp-next-admin

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111625Published

10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

cve-program ·

Vendor product: Distributor

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111620Published

O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

cve-program ·

Vendor product: O2OA

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111615Published

Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

cve-program ·

Vendor product: mall4cloud

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-105445Published

Docker Hub account conversion could reassign an active personal access token to another user

cve-program ·

Vendor product: Docker Hub

CVSS 4.0 9.4Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111610Published

B3log Solo through 4.4.0 Missing Authorization in ArticleConsole

cve-program ·

Vendor product: Solo

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111605Published

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

cve-program ·

Vendor product: Jpom

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-102552Published

Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver

cve-program ·

Vendor product: FreeRTOS-Plus-TCP

CVSS 3.1 5.9 · CVSS 4.0 8.2Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-102551Published

Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling

cve-program ·

Vendor product: FreeRTOS-Plus-TCP

CVSS 3.1 7.7 · CVSS 4.0 9.2Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-110379Published

WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: quiz-maker

CVSS 3.1 7.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-111407Published

WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: tutor

CVSS 3.1 6.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-59967Published

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

cve-program ·

Vendor product: recipes

CVSS 3.1 5.4Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112103Published

f3-factory fatfree-core HTTP Client web.php _curl certificate validation

cve-program ·

Vendor product: fatfree-core

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112107Published

ztxz16 fastllm Safetensors Weight Loading model.cpp CreateBuffer buffer overflow

cve-program ·

Vendor product: fastllm

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-112140Published

llSourcell Doctor-Dignity chat_module.py _get_lib_module code injection

cve-program ·

Vendor product: Doctor-Dignity

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-86047Published

MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

cve-program ·

Vendor product: server

CVSS 3.1 7.7Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-85745Published

MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.

cve-program ·

Vendor product: server

CVSS 3.1 4.3Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-77474Published

dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

cve-program ·

Vendor product: destructive_command_guard

CVSS 3.1 7.1Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-41582Published

countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

cve-program ·

Vendor product: countly-server

CVSS 3.1 7.5Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-68906Published

libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

cve-program ·

Vendor product: libiec61850

CVSS 4.0 8.7Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-109766Published

Mitigation bypass in the Enterprise Policies component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-109760Published

Mitigation bypass in the Networking: HTTP component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-109759Published

Site isolation issue in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-109754Published

Incorrect boundary conditions in the DOM: Editor component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-1289Published

PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products

cve-program ·

Vendor product: Revit · Vendor product: AutoCAD · Vendor product: AutoCAD LT

CVSS 3.1 7.8Source modified 19 Oct 2026Recorded 23 Oct 2026

CVE-2026-8325Published

PDF File Parsing Vulnerabilities in Certain Autodesk Desktop Products

cve-program ·

Vendor product: Revit · Vendor product: AutoCAD · Vendor product: AutoCAD LT

CVSS 3.1 7.8Source modified 19 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.