Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694914 source statements · aliases may refer to the same vulnerability

CVE-2026-18548Published

Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

cve-program ·

Vendor product: Groundhogg — CRM, Newsletters, and Marketing Automation

CVSS 3.1 7.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-18557Published

Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter

cve-program ·

Vendor product: Photo Gallery by 10Web – Mobile-Friendly Image Gallery

CVSS 3.1 6.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-88043Published

Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter

cve-program ·

Vendor product: Mang Board

CVSS 3.1 7.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-15180Published

Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'

cve-program ·

Vendor product: Tracking Code Manager

CVSS 3.1 6.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-15090Published

Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter

cve-program ·

Vendor product: Link Library

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-78087Published

VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature

cve-program ·

Vendor product: VK Blocks

CVSS 3.1 6.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-11905Published

Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters

cve-program ·

Vendor product: Elementor Website Builder – more than just a page builder

CVSS 3.1 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-81534Published

Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter

cve-program ·

Vendor product: Email Customizer for WooCommerce (Pro)

CVSS 3.1 8.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108092Published

Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

cve-program ·

Vendor product: Blog2Social: Social Media Auto Post & Scheduler

CVSS 3.1 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-102389Published

WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

cve-program ·

https://wordpress.org/plugins: broken-link-checker

CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-21130Published

Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.

cve-program ·

Vendor product: Samsung Checkout

CVSS 4.0 5.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-21131Published

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

cve-program ·

Vendor product: Samsung Flow

CVSS 4.0 2.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-19593Published

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace. If the workspace contains a repository with preserved attacker-controlled .git/config, the attr.tree set…

cve-program ·

Vendor product: Codex Desktop · Vendor product: Codex Desktop · Vendor product: Codex Desktop (Microsoft Store package)

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-21129Published

Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges.

cve-program ·

Vendor product: Samsung Checkout

CVSS 4.0 5.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-21128Published

Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges.

cve-program ·

Vendor product: Samsung Checkout

CVSS 4.0 5.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-107325Published

Application denial of service via missing BSON array length validation in MongoDB Go Driver

cve-program ·

Vendor product: Go Driver

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-39781Published

WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: document-gallery

CVSS 3.1 7.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-102986Published

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

cve-program ·

Vendor product: plane

CVSS 3.1 8.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-104141Published

DataEase: SQL Injection in datasource metadata identifiers

cve-program ·

Vendor product: dataease

CVSS 4.0 8.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-97468Published

Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.cxf:cxf-rt-ws-security

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-86463Published

Apache CXF: FIQL Query Parser Denial of Service

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.cxf:cxf-rt-rs-extension-search

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-54702Published

Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler

cve-program ·

Vendor product: vscode-markdown-preview-enhanced

CVSS 4.0 7.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100347Published

kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path

cve-program ·

Vendor product: kin-openapi

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-96540Published

An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow th…

cve-program ·

Vendor product: Network Security Manager (NSM)

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-79650Published

Apache CXF: OIDC RP Open Redirect

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.cxf:cxf-rt-rs-security-sso-oidc

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-102354Published

BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker

cve-program ·

Vendor product: bentopdf

CVSS 3.1 6.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100232Published

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could pote…

cve-program ·

Vendor product: Network Security Manager (NSM)

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-97032Published

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEA…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-97030Published

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 6.1Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-94448Published

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables …

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 6.1Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-94447Published

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.8Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-94444Published

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted z…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.8Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-102748Published

Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attacke…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2026-100348Published

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference such as a schema that points to its own a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 15 Oct 2026Recorded 25 Oct 2026

CVE-2017-20162Published

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 5.3 · CVSS 2.0 · [email protected] · Secondary 3.5Source modified 15 Oct 2026Recorded 24 Oct 2026

CVE-2017-16137Published

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

nvd ·

CVSS 3.0 · [email protected] · Primary 5.3 · CVSS 2.0 · [email protected] · Primary 5.0Source modified 15 Oct 2026Recorded 24 Oct 2026

CVE-2026-78384Published

Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.cxf:cxf-core

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103226Published

Artifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow

cve-program ·

Vendor product: Ghostscript

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-97665Published

Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload

cve-program ·

Vendor product: Nexus Repository 3

CVSS 4.0 7.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-97666Published

Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint

cve-program ·

Vendor product: Nexus Repository 3

CVSS 4.0 6.9Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-97667Published

Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

cve-program ·

Vendor product: Nexus Repository 3

CVSS 4.0 5.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-73179Published

Apache CXF: JPA authorization-code consume is non-atomic

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.cxf:cxf-rt-rs-security-oauth2

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100351Published

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

cve-program ·

Vendor product: kin-openapi

CVSS 3.1 7.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-111096Published

In JetBrains TeamCity before 2026.2,

cve-program ·

Vendor product: TeamCity

CVSS 3.1 6.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110736Published

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are use…

cve-program ·

Vendor product: Godot Engine

CVSS 3.1 3.6Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-111095Published

In JetBrains TeamCity before 2026.2,

cve-program ·

Vendor product: TeamCity

CVSS 3.1 8.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-58393Published

OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files

cve-program ·

Vendor product: core

CVSS 3.1 5.9Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-71575Published

Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.cxf:cxf-rt-rs-security-sso-oidc

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-111093Published

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

cve-program ·

Vendor product: Datalore

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-107910Published

Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling

cve-program ·

https://github.com/FalkorDB/FalkorDB: FalkorDB

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 15 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.