Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694914 source statements · aliases may refer to the same vulnerability

CVE-2018-19360Published

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-19139Published

An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-18700Published

An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-d…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-18091Published

Use after free in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.63…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-18090Published

Out of bounds read in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 …

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-18089Published

Multiple out of bounds read in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-17828Published

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-14721Published

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-14720Published

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-1305Published

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in t…

cve-program ·

Vendor product: Apache Tomcat

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-97791Published

Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.cxf:cxf-rt-ws-security

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-1304Published

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constrain…

cve-program ·

Vendor product: Apache Tomcat

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12224Published

Buffer leakage in igdkm64.sys in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.6373 may …

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12223Published

Insufficient access control in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 2…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12222Published

Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) a…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12221Published

Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) a…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12214Published

Potential memory corruption in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12216Published

Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) a…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12220Published

Logic bug in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 2…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12219Published

Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) a…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12218Published

Unhandled exception in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12217Published

Insufficient access control in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12215Published

Insufficient input validation in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) a…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12213Published

Potential memory corruption in Kernel Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12212Published

Buffer overflow in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and 24.20.100.637…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12211Published

Insufficient input validation in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12210Published

Multiple pointer dereferences in User Mode Driver in Intel(R) Graphics Driver for Windows* before versions 10.18.x.5059 (aka 15.33.x.5059), 10.18.x.5057 (aka 15.36.x.5057), 20.19.x.5063 (aka 15.40.x.5063) 21.20.x.5064 (aka 15.45.x.5064) and…

cve-program ·

Vendor product: Intel(R) Graphics Driver for Windows

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12115Published

In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bo…

cve-program ·

Vendor product: Node.js

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-12023Published

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker …

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-11784Published

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be use…

cve-program ·

Vendor product: Apache Tomcat

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-11212Published

An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-1061Published

python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.

cve-program ·

Vendor product: python

CVSS 3.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-0851Published

Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due t…

cve-program ·

Vendor product: Microsoft Office

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2018-0737Published

Cache timing vulnerability in RSA Key Generation

cve-program ·

Vendor product: OpenSSL

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100351Published

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-100347Published

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.Path…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-0609Published

Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode

cve-program ·

Vendor product: Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase

CVSS 3.1 6.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-107248Published

CVE-2026-107248

cve-program ·

Vendor product: Thelia

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103537Published

CVE-2026-103537

cve-program ·

Vendor product: Thelia

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103535Published

CVE-2026-103535

cve-program ·

Vendor product: Thelia

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103529Published

CVE-2026-103529

cve-program ·

Vendor product: Thelia

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103528Published

CVE-2026-103528

cve-program ·

Vendor product: Thelia

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-101307Published

Remotely triggerable buffer overflow in tcp_rack

cve-program ·

Vendor product: FreeBSD

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109758Published

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installatio…

cve-program ·

Vendor product: Helix Authentication Service

CVSS 4.0 9.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-89097Published

Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters

cve-program ·

Vendor product: Ad Inserter – Ad Manager & AdSense Ads

CVSS 3.1 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-102562Published

AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter

cve-program ·

Vendor product: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

CVSS 3.1 7.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109896Published

WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: download-monitor-integration-for-woocommerce

CVSS 3.1 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109898Published

WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-event-solution

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-84419Published

Out-of-Bounds Write

cve-program ·

Vendor product: Workspace app for Windows

CVSS 4.0 6.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-107652Published

Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field

cve-program ·

Vendor product: Database Addon for Contact Form 7 – CFDB7

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.