Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694793 source statements · aliases may refer to the same vulnerability

CVE-2026-102029Published

Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when an MSDP or PIM policy uses AS-path expansion

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102030Published

Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102037Published

Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used

cve-program ·

Vendor product: Junos OS

CVSS 3.1 8.1 · CVSS 4.0 9.2Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102050Published

Junos OS and Junos OS Evolved: An adjacent attacker causes Layer 2 control-plane denial of service when LLDP is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102053Published

Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102056Published

Junos OS and Junos OS Evolved: An attacker causes denial of service and information disclosure when Ethernet CFM is enabled

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 7.1 · CVSS 4.0 7.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102176Published

Junos OS: Specific packets cause SDK service crash or Routing Engine compromise when the SDK service and JDAF is enabled

cve-program ·

Vendor product: Junos OS

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102178Published

Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-102027Published

Junos OS and Junos OS Evolved: A configured BGP neighbor causes rpd crash when multipath next-hops are processed

cve-program ·

Vendor product: Junos OS · Vendor product: Junos OS Evolved

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111365Published

cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints

cve-program ·

Vendor product: cool-admin-midway

CVSS 4.0 7.0 · CVSS 3.1 6.0Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-92777Published

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.

cve-program ·

Vendor product: Idea Tab Pro (TB373FU) · Vendor product: Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU) · Vendor product: Idea Tab/ Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU)

CVSS 4.0 5.4 · CVSS 3.1 6.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-106705Published

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. The endpoint PUT /api/roles/menu (RoleController.updateRoleMenu) authorizes the request only by comparing the target role's leve…

cve-program ·

Vendor product: n/a

CVSS 3.1 8.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111212Published

ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection

cve-program ·

Vendor product: Medical-SAM-Adapter

CVSS 4.0 2.4 · CVSS 3.1 4.8 · CVSS 3.0 4.8 · CVSS 2.0 4.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111373Published

FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111378Published

FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111383Published

Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

cve-program ·

Vendor product: nezha

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111388Published

Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

cve-program ·

Vendor product: frappe · Vendor product: frappe

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-105227Published

ISPSoft Out-of-Bounds Read Vulnerability

cve-program ·

Vendor product: ISPSoft

CVSS 4.0 7.0Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-105228Published

ISPSoft Out-of-Bounds Read Vulnerability

cve-program ·

Vendor product: ISPSoft

CVSS 4.0 7.0Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-109812Published

Missing Authorization on Secret Endpoints

cve-program ·

Vendor product: AIG-302 Series

CVSS 4.0 6.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111446Published

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 th…

cve-program ·

Vendor product: Wheels

CVSS 3.1 8.6Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-77829Published

Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

cve-program ·

Vendor product: Cooked – Recipe Management

CVSS 3.1 6.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-97339Published

Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

cve-program ·

Vendor product: Complianz GDPR/CCPA Cookie Consent Banner

CVSS 3.1 7.2Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21134Published

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.

cve-program ·

Vendor product: Samsung Flow

CVSS 4.0 6.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-104769Published

Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

cve-program ·

Vendor product: Debloat – Remove Unused CSS, Optimize JS

CVSS 3.1 5.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21133Published

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.

cve-program ·

Vendor product: Samsung Flow

CVSS 4.0 5.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21127Published

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

cve-program ·

Vendor product: Samsung Account

CVSS 4.0 6.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21126Published

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 6.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21123Published

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 6.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21121Published

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 6.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21118Published

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 6.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111451Published

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during bu…

cve-program ·

Vendor product: Wheels CLI

CVSS 3.1 7.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111114Published

Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter

cve-program ·

Vendor product: Nexter Extension – Security, Performance, Code Snippets & Site Toolkit

CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21117Published

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 5.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21116Published

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 5.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110019Published

Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow

cve-program ·

Vendor product: Bulk Page Generator – LPagery

CVSS 3.1 4.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-21115Published

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 5.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-55836Published

Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

cve-program ·

Vendor product: open-zaak

CVSS 3.1 6.8Source modified 16 Oct 2026Recorded 23 Oct 2026

GHSA-cv23-7vc5-jfh7Published

gomarkdown/markdown IsSafeURL panics on short URLs

osv · CVE-2026-102941

Go: github.com/gomarkdown/markdown

HIGHSource modified 16 Oct 2026Recorded 24 Oct 2026

CVE-2026-107437Published

Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A

cve-program ·

Vendor product: GV-E-map Server

CVSS 3.1 6.2Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-101895Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infini…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-101899Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an add…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-102603Published

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-102989Published

TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.3Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-103975Published

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-104150Published

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character clas…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-106495Published

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-41510Published

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlenc…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.2Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-63430Published

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding at…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-77362Published

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 16 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.