Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694735 source statements · aliases may refer to the same vulnerability

CVE-2026-81343Published

Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission

cve-program ·

Vendor product: ACF Frontend Admin by DynamiApps

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-81344Published

Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object Injection

cve-program ·

Vendor product: ACF Frontend Admin by DynamiApps

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-97314Published

ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection

cve-program ·

Vendor product: ThirstyAffiliates

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-87844Published

Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection

cve-program ·

Vendor product: PickPlugins Product Designer for WooCommerce

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-109937Published

Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block

cve-program ·

Vendor product: Otter Blocks

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110026Published

Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion

cve-program ·

Vendor product: Tasty Recipes Lite

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110031Published

Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key

cve-program ·

Vendor product: Salon Booking System

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110032Published

Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor

cve-program ·

Vendor product: Salon Booking System

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110033Published

Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'

cve-program ·

Vendor product: Salon Booking System

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110035Published

Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route

cve-program ·

Vendor product: Salon Booking System

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110069Published

Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions

cve-program ·

Vendor product: Modern Events Calendar Lite

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110070Published

Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR

cve-program ·

Vendor product: Modern Events Calendar Lite

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110976Published

AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media

cve-program ·

Vendor product: AI Engine

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-110981Published

WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter

cve-program ·

Vendor product: WP Photo Album Plus

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-111041Published

AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media

cve-program ·

Vendor product: AI Engine

Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2026-96534Published

Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

cve-program ·

Vendor product: Modern Events Calendar Lite · Vendor product: Modern Event Calendar Pro

Source modified 18 Oct 2026Recorded 23 Oct 2026

GHSA-3rw9-wmc8-8948Published

Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token

osv · CVE-2025-71435 · GO-2025-3921

Go: github.com/coder/coder/v2

LOWSource modified 18 Oct 2026Recorded 24 Oct 2026

GO-2025-3921Published

Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

osv · CVE-2025-71435 · GHSA-3rw9-wmc8-8948

Go: github.com/coder/coder · Go: github.com/coder/coder/v2

Source modified 18 Oct 2026Recorded 24 Oct 2026

GHSA-wcx9-ccpj-hx3cPublished

Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')

osv · CVE-2024-58398 · GO-2024-3228

Go: github.com/coder/coder/v2 · Go: github.com/coder/coder/v2 · Go: github.com/coder/coder/v2

MODERATESource modified 18 Oct 2026Recorded 24 Oct 2026

GO-2024-3228Published

Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder

osv · CVE-2024-58398 · GHSA-wcx9-ccpj-hx3c

Go: github.com/coder/coder · Go: github.com/coder/coder/v2

Source modified 18 Oct 2026Recorded 24 Oct 2026

GHSA-h58c-xccx-75m3Published

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

osv · CVE-2026-111932 · GO-2026-6267

Go: github.com/coder/coder/v2 · Go: github.com/coder/coder/v2 · Go: github.com/coder/coder/v2

LOWSource modified 18 Oct 2026Recorded 24 Oct 2026

GO-2026-6267Published

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

osv · CVE-2026-111932 · GHSA-h58c-xccx-75m3

Go: github.com/coder/coder · Go: github.com/coder/coder/v2

Source modified 18 Oct 2026Recorded 24 Oct 2026

GHSA-8fxq-53rx-ph5fPublished

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

osv · CVE-2026-111933 · GO-2026-6265

Go: github.com/coder/coder/v2 · Go: github.com/coder/coder/v2 · Go: github.com/coder/coder/v2

LOWSource modified 18 Oct 2026Recorded 24 Oct 2026

GO-2026-6265Published

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

osv · CVE-2026-111933 · GHSA-8fxq-53rx-ph5f

Go: github.com/coder/coder · Go: github.com/coder/coder/v2

Source modified 18 Oct 2026Recorded 24 Oct 2026

CVE-2026-16337Published

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self…

cve-program ·

Vendor product: dotCMS

CVSS 4.0 9.4Source modified 18 Oct 2026Recorded 23 Oct 2026

CVE-2025-54469Published

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 18 Oct 2026Recorded 25 Oct 2026

CVE-2026-107274Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-107772Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-108117Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-107345Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-105391Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 17 Oct 2026Recorded 23 Oct 2026

RUSTSEC-2026-0371Published

`zbus_names` is unmaintained

osv ·

crates.io: zbus_names

Source modified 17 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0372Published

`zvariant_derive` is unmaintained

osv ·

crates.io: zvariant_derive

Source modified 17 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0370Published

`zvariant` is unmaintained

osv ·

crates.io: zvariant

Source modified 17 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0373Published

Missing case-insensitive matching for CSS url function

osv · GHSA-x43w-36pp-96g3

crates.io: ammonia

Source modified 17 Oct 2026Recorded 24 Oct 2026

GHSA-6fj4-rcr3-r7rrPublished

lopdf has a stack overflow via deeply nested PDF objects

osv · RUSTSEC-2026-0187

crates.io: lopdf

HIGHSource modified 17 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0187Published

Stack overflow in lopdf via deeply nested PDF objects

osv · GHSA-6fj4-rcr3-r7rr

crates.io: lopdf

Source modified 17 Oct 2026Recorded 24 Oct 2026

CVE-2026-94033Published

SourceCodester Drug Recommendation System User Management add_user cross site scripting

cve-program ·

Vendor product: Drug Recommendation System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-94177Published

WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: gamipress

CVSS 3.1 8.5Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-93485Published

WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wordpress

CVSS 3.1 7.1Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-10813Published

LMCache KV Cache utils.py hex_hash_to_int16 weak hash

cve-program ·

Vendor product: LMCache

CVSS 4.0 2.0 · CVSS 3.1 3.6 · CVSS 3.0 3.6 · CVSS 2.0 2.4Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-101950Published

Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled

cve-program ·

Vendor product: Junos OS

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-103946Published

SQL Injection

cve-program ·

Vendor product: Nessus

CVSS 3.1 8.3 · CVSS 4.0 8.7Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2026-102764Published

Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

cve-program ·

Vendor product: Remote Support

CVSS 4.0 9.3Source modified 17 Oct 2026Recorded 23 Oct 2026

CVE-2025-61624Published

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 a…

cve-program ·

Vendor product: FortiOS · Vendor product: FortiProxy · Vendor product: FortiSwitchManager

CVSS 3.1 5.4Source modified 17 Oct 2026Recorded 23 Oct 2026

GHSA-r5fr-rjxr-66jcPublished

lodash vulnerable to Code Injection via `_.template` imports key names

osv · CVE-2026-4800

npm: lodash · npm: lodash-es · npm: lodash-amd

HIGHSource modified 17 Oct 2026Recorded 24 Oct 2026

GHSA-35jh-r3h4-6jhmPublished

Command Injection in lodash

osv · CVE-2021-23337

npm: lodash · npm: lodash-es · npm: lodash.template

HIGHSource modified 17 Oct 2026Recorded 24 Oct 2026

CVE-2026-102599Published

Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can independently derive an Engine.IO protocol revision from the upgrade request instead of enforcing t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 17 Oct 2026Recorded 25 Oct 2026

MAL-2026-17910Published

Malicious code in itsa-react-focuscontainer (npm)

osv · GHSA-8c34-p746-v5rq

npm: itsa-react-focuscontainer

Source modified 17 Oct 2026Recorded 24 Oct 2026

MAL-2026-17911Published

Malicious code in itsa-react-maskedinput (npm)

osv · GHSA-hhr5-rjw6-9hr5

npm: itsa-react-maskedinput

Source modified 17 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.