Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694901 source statements · aliases may refer to the same vulnerability

CVE-2026-0318Published

PAN-OS: Denial of Service (DoS) on Panorama

cve-program ·

Vendor product: Cloud NGFW · Vendor product: PAN-OS · Vendor product: Prisma Access

CVSS 4.0 4.6Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-0317Published

PAN-OS: Denial of Service Vulnerability

cve-program ·

Vendor product: Cloud NGFW · Vendor product: PAN-OS · Vendor product: Prisma Access

CVSS 4.0 1.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-78851Published

Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

GHSA-qhrr-8q5h-9q3hPublished

MessagePack: Nested arrays can blow past buffer length limits

osv · CVE-2026-92707

NuGet: MessagePack · NuGet: MessagePack

MODERATESource modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-0316Published

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

cve-program ·

Vendor product: Cloud NGFW · Vendor product: PAN-OS · Vendor product: Prisma Access

CVSS 4.0 1.1 · CVSS 4.0 0.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-0314Published

GlobalProtect App: Local Denial of Service (DoS) on Windows

cve-program ·

Vendor product: GlobalProtect App · Vendor product: GlobalProtect App

CVSS 4.0 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-58395Published

OPNsense: XPath injection in MVC safe-delete

cve-program ·

Vendor product: core

CVSS 3.1 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-0312Published

Checkov by Prisma Cloud: Path Traversal Vulnerabilities

cve-program ·

Vendor product: Checkov by Prisma Cloud

CVSS 4.0 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106707Published

XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the execut…

cve-program ·

Vendor product: n/a

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2025-29897Published

Stack-based Buffer Overflow in qsyncsrv.cgi

cve-program ·

Vendor product: Qsync Central

CVSS 4.0 2.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2025-66272Published

Arbitrary file deletion and remote code execution

cve-program ·

Vendor product: Video Station

CVSS 4.0 7.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-58394Published

OPNsense: Stored XSS in Administration Settings via Certificate Description

cve-program ·

Vendor product: core

CVSS 3.1 5.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110958Published

Wavlink WN530HG4B api.cgi heap-based overflow

cve-program ·

Vendor product: WN530HG4B

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2025-66275Published

Remote code execution via command injection

cve-program ·

Vendor product: Video Station

CVSS 4.0 7.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109689Published

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: sunshine-photo-cart

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2025-68403Published

Inadequate Steps to Confirm Vulnerability in QuRouter

cve-program ·

Vendor product: QuRouter

CVSS 4.0 4.6Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100350Published

kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression

cve-program ·

Vendor product: kin-openapi

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2025-68404Published

vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface

cve-program ·

Vendor product: QuRouter

CVSS 4.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110374Published

WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: login-with-phone-number

CVSS 3.1 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100354Published

kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

cve-program ·

Vendor product: kin-openapi

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-61838Published

Lychee: Album password bypass in ZIP downloads

cve-program ·

Vendor product: Lychee

CVSS 4.0 8.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106163Published

Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106162Published

Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 4.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-77470Published

Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

cve-program ·

Vendor product: Lychee

CVSS 4.0 8.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106157Published

Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 4.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106158Published

Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 4.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-105271Published

"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application.

cve-program ·

Vendor product: "ゲオアプリ" for Android · Vendor product: "ゲオアプリ" for iOS

CVSS 3.0 4.3 · CVSS 4.0 5.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-55246Published

bincookie: Heap buffer overflow via unvalidated `num_pages` when parsing a `.binarycookies` file

cve-program ·

Vendor product: bincookie

CVSS 3.1 7.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-24715Published

Lack of Reproducible Vulnerability Evidence in QNAP Report

cve-program ·

Vendor product: QuRouter

CVSS 4.0 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-102740Published

AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink

cve-program ·

Vendor product: async-http-client

CVSS 3.1 5.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106159Published

Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 4.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106160Published

Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-55414Published

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

cve-program ·

Vendor product: nl-portal-backend-libraries

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106161Published

Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-22896Published

Stored XSS via Interface Name in Network & Virtual Switch App

cve-program ·

Vendor product: Network & Virtual Switch

CVSS 4.0 6.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110367Published

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woosquare

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106153Published

Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103350Published

WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability

cve-program ·

https://wordpress.org/plugins: booking-and-rental-manager-for-woocommerce

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110890Published

WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-smart-filters

CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106139Published

Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue

cve-program ·

Vendor product: @progress/kendo-vue-charts

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110840Published

n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

cve-program ·

Vendor product: n8n

CVSS 4.0 7.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106138Published

Cross-Site Scripting via Chart Tooltip in KendoReact

cve-program ·

Vendor product: @progress/kendo-react-charts

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-101947Published

ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

cve-program ·

Vendor product: ExifTool for photo and video

CVSS 4.0 8.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110767Published

Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion

cve-program ·

https://pypi.org: gitingest

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106148Published

Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110855Published

GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name

cve-program ·

Vendor product: GitPython

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-95702Published

Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile

cve-program ·

Vendor product: gVisor

CVSS 4.0 8.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103508Published

Path traversal via logging configuration in P4Search

cve-program ·

Vendor product: P4Search

CVSS 4.0 7.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110850Published

n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters

cve-program ·

Vendor product: n8n

CVSS 4.0 7.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106149Published

Cross-site Scripting (XSS) in Kendo UI for jQuery Menu

cve-program ·

Vendor product: Kendo UI for jQuery

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.