Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694793 source statements · aliases may refer to the same vulnerability

CVE-2026-109515Published

MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter

cve-program ·

Vendor product: MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.

CVSS 3.1 9.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-109191Published

Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML

cve-program ·

Vendor product: Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy

CVSS 3.1 4.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-103911Published

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

cve-program ·

Vendor product: Forminator Forms – Contact Form, Payment Form & Custom Form Builder

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110590Published

Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint

cve-program ·

Vendor product: Klarna for WooCommerce

CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-104001Published

Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta

cve-program ·

Vendor product: Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated

CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-103896Published

10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

cve-program ·

Vendor product: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer

CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-109447Published

User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

cve-program ·

Vendor product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

CVSS 3.1 8.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-103768Published

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

cve-program ·

Vendor product: ELEX WordPress HelpDesk & Customer Ticketing System

CVSS 3.1 9.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-109414Published

Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator

cve-program ·

Vendor product: Vitepos – Point of Sale (POS) for WooCommerce

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111178Published

WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

cve-program ·

Vendor product: WP Booking System – Booking Calendar

CVSS 3.1 4.9Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-92553Published

YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension

cve-program ·

Vendor product: YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports

CVSS 3.1 8.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-104755Published

WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint

cve-program ·

Vendor product: WP Compress – Instant Performance & Speed Optimization

CVSS 3.1 4.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-109382Published

WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool

cve-program ·

Vendor product: WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-15222Published

User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name

cve-program ·

Vendor product: User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder

CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-92115Published

WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

cve-program ·

Vendor product: WP Photo Album Plus

CVSS 3.1 8.8Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110366Published

WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: site-reviews

CVSS 3.1 5.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-97296Published

WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: gravityforms

CVSS 3.1 8.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-94388Published

WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

cve-program ·

https://codecanyon.net: halfdata-green-popups

CVSS 3.1 9.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-75903Published

Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials

cve-program ·

Vendor product: Vulnity Security

CVSS 3.1 8.1Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110806Published

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.

cve-program ·

Vendor product: Server

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110804Published

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated p…

cve-program ·

Vendor product: Server

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110805Published

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configura…

cve-program ·

Vendor product: Server

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-106560Published

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-111400Published

WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: powerpack-lite-for-elementor

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111443Published

Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or incl…

cve-program ·

Vendor product: Wheels

CVSS 3.1 6.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111448Published

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept …

cve-program ·

Vendor product: Wheels

CVSS 3.1 3.7Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-92766Published

Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

cve-program ·

Vendor product: Vitepos – Point of Sale (POS) for WooCommerce

CVSS 3.1 7.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-104003Published

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab

cve-program ·

Vendor product: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-111399Published

WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: mapsvg-lite-interactive-vector-maps

CVSS 3.1 8.5Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110380Published

WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-event-solution

CVSS 3.1 5.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110901Published

WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: smartcrawl-seo

CVSS 3.1 5.4Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110900Published

WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: bookit

CVSS 3.1 5.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-92228Published

Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

cve-program ·

https://pypi.python.org: apache-airflow-providers-keycloak

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-106561Published

Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.0Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-94134Published

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

cve-program ·

https://pypi.python.org: apache-airflow-providers-ssh · https://pypi.python.org: apache-airflow-providers-sftp

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-106562Published

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-104932Published

Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

cve-program ·

Vendor product: Search Regex

CVSS 3.1 8.0Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-107646Published

HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script

cve-program ·

Vendor product: HUSKY – Products Filter for WooCommerce Professional

CVSS 3.1 5.3Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-96806Published

Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

cve-program ·

https://pypi.python.org: apache-airflow-providers-keycloak

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-106563Published

Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user wit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 16 Oct 2026Recorded 25 Oct 2026

CVE-2026-91833Published

WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter

cve-program ·

Vendor product: WX Subscribe 微信支付付费订阅

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-91830Published

Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie

cve-program ·

Vendor product: Subscribe to Comments

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-92427Published

Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure

cve-program ·

Vendor product: Coinsnap Bitcoin Crowdfunding

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-74923Published

Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons

cve-program ·

Vendor product: Document Gallery

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-103696Published

Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter

cve-program ·

Vendor product: Mobile builder

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-105973Published

Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

cve-program ·

Vendor product: Visual Form Builder

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-105974Published

Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

cve-program ·

Vendor product: Visual Form Builder

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-109982Published

MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration

cve-program ·

Vendor product: MB Custom Post Types & Custom Taxonomies

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110012Published

Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming

cve-program ·

Vendor product: Salon Booking System

Source modified 16 Oct 2026Recorded 23 Oct 2026

CVE-2026-110013Published

Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token

cve-program ·

Vendor product: Salon Booking System

Source modified 16 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.