Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694779 source statements · aliases may refer to the same vulnerability

CVE-2026-110873Published

Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field

cve-program ·

Vendor product: heym

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-46694Published

EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes

cve-program ·

Vendor product: espocrm

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-55154Published

EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/control characters in export

cve-program ·

Vendor product: espocrm

CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-75505Published

EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

cve-program ·

Vendor product: espocrm

CVSS 4.0 6.0Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-53582Published

OPNsense: XPATH Injection can disclose any secret in config.xml

cve-program ·

Vendor product: core

CVSS 3.1 7.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-63442Published

OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

cve-program ·

Vendor product: core

CVSS 3.1 8.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-100349Published

kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content

cve-program ·

Vendor product: kin-openapi

CVSS 4.0 8.2Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-57568Published

Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

cve-program ·

Vendor product: Lychee

CVSS 4.0 5.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-62679Published

Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

cve-program ·

Vendor product: Lychee

CVSS 4.0 8.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102527Published

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

cve-program ·

Vendor product: og-image

CVSS 4.0 6.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-55453Published

CUPS ipp backend status-line injection can update queue PPD and lead to conditional RCE as lp via foomatic-rip

cve-program ·

Vendor product: cups

CVSS 3.1 3.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-103936Published

libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

cve-program ·

Vendor product: js-libp2p · Vendor product: webrtc

CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110888Published

WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ai-engine

CVSS 3.1 4.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110381Published

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: simply-schedule-appointments

CVSS 3.1 6.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-103523Published

CVE-2026-103523

cve-program ·

Vendor product: Thelia

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110375Published

WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: download-monitor

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-97370Published

Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction

cve-program ·

Vendor product: junrar

CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-109893Published

WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: presto-player

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-104827Published

react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS

cve-program ·

Vendor product: http

CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-94621Published

AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction

cve-program ·

Vendor product: aliasvault · Vendor product: ghcr.io/aliasvault/aliasvault · Vendor product: ghcr.io/aliasvault/api

CVSS 3.1 6.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-55842Published

Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain

cve-program ·

Vendor product: scoold

CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111214Published

Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php

cve-program ·

https://github.com: pfSense CE

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111219Published

Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username

cve-program ·

https://github.com: pfSense CE

CVSS 4.0 7.5 · CVSS 3.1 6.6Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111224Published

Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh

cve-program ·

https://github.com: pfSense CE

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111234Published

SimplePie through 1.9.0 Local File Read via file:// Redirect

cve-program ·

https://packagist.org: simplepie

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110878Published

Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information

cve-program ·

Vendor product: aureuserp

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111127Published

catdoc through 0.95 Out-of-Bounds Read via xls2csv copy_unicode_string

cve-program ·

https://github.com: catdoc

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111132Published

GNOME libgxps through 0.3.2 Heap Out-of-Bounds Read via path_geometry_start_element

cve-program ·

https://gitlab.gnome.org: libgxps

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111137Published

libsmi through 0.5.0 Out-of-Bounds Write via smiValueAsString OCTET STRING DEFVAL

cve-program ·

https://github.com/amartin755/libsmi: libsmi

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111142Published

Zziplib through 0.13.80 Out-of-Bounds Read via zzip_disk_findfirst

cve-program ·

https://github.com/gdraheim/zziplib: zziplib

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111152Published

Game Music Emu (libgme) through 0.6.5 Heap Out-of-Bounds Read via AY Loader

cve-program ·

https://github.com: game-music-emu

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111157Published

SoX through 14.4.2 Heap Out-of-Bounds Write via MS ADPCM WAV Decoding

cve-program ·

https://sourceforge.net/projects/sox/: sox

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-85499Published

Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy

cve-program ·

https://golang.org/pkg: github.com/apache/skywalking-banyandb

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111162Published

WildMIDI through 0.5.0 Heap Out-of-Bounds Read via _WM_ParseNewHmp

cve-program ·

https://github.com: WildMIDI

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111167Published

GNU LibreDWG through 0.14.8612 Out-of-Bounds Read in acds_private AcDs Decoder

cve-program ·

https://github.com: LibreDWG

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111172Published

@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath

cve-program ·

https://registry.npmjs.org: @casl/ability

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111272Published

LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikonMakernote ShotInfo

cve-program ·

Vendor product: LibRaw

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111278Published

NivoCart through 2.5.1 CAPTCHA Bypass via Answer Disclosed in Page HTML

cve-program ·

Vendor product: nivocart

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111321Published

TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions

cve-program ·

Vendor product: TaskingAI

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111330Published

JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

cve-program ·

Vendor product: JuggleIM

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111345Published

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id

cve-program ·

Vendor product: trudesk

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111350Published

Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API

cve-program ·

Vendor product: Papermark

CVSS 4.0 2.3 · CVSS 3.1 5.0Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111355Published

zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

cve-program ·

Vendor product: Admin.Core

CVSS 4.0 5.3 · CVSS 3.1 6.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111364Published

MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

cve-program ·

Vendor product: MinDoc

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21119Published

Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 4.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111369Published

ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

cve-program ·

Vendor product: ClassroomIO

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111210Published

bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery

cve-program ·

Vendor product: bitcoinj

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111377Published

FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111382Published

FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111387Published

Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint

cve-program ·

Vendor product: nezha

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.