Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694926 source statements · aliases may refer to the same vulnerability

CVE-2026-55498Published

FileRise Shared Folder Symlink Escape

cve-program ·

Vendor product: FileRise

CVSS 3.1 4.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-3234Published

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, a…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-55683Published

WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php

cve-program ·

Vendor product: WeGIA

CVSS 3.1 9.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110679Published

OpenSIPS rtpproxy rtpproxy_answer out-of-bounds

cve-program ·

Vendor product: OpenSIPS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110696Published

itsmeravitejak Online-Examination-System dbtables.sql information disclosure

cve-program ·

Vendor product: Online-Examination-System

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108335Published

Password Reset Functionality Missing Brute-Force Protection

cve-program ·

Vendor product: Remote Ops Agent

CVSS 4.0 9.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-3233Published

Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110829Published

FreeRDP 3.0.0 before 3.32.0 Null Pointer Dereference via rdpsnd Fragment

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-94448Published

Reset context tracking on consecutive template expressions in html/template

cve-program ·

https://pkg.go.dev: html/template

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-76656Published

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

cve-program ·

Vendor product: HPE NonStop TCP/IP UTILITIES

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-76659Published

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

cve-program ·

Vendor product: HPE NonStop TCP/IP UTILITIES

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-76660Published

HPE NonStop CIPSAM - Memory corruption vulnerability

cve-program ·

Vendor product: HPE NonStop CIPSAM

CVSS 3.1 8.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-76661Published

HPE NonStop QIOMON - Memory corruption vulnerability

cve-program ·

Vendor product: HPE NonStop QIOMON

CVSS 3.1 7.6Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-105674Published

Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB

cve-program ·

Vendor product: Tapo C325WB v2

CVSS 4.0 8.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-1182Published

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a r…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-1181Published

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multip…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-10165Published

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0763Published

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are auth…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-105672Published

Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB

cve-program ·

Vendor product: Tapo C325WB v2

CVSS 4.0 8.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108538Published

GPAC MP4Box os_thread.c gf_mx_v use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0714Published

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManag…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108542Published

021is elvix-sdk MCP Request index.ts server-side request forgery

cve-program ·

Vendor product: elvix-sdk

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108567Published

InstantSoft icms2 Image image.php files_delete_file path traversal

cve-program ·

Vendor product: icms2

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108571Published

Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection

cve-program ·

Vendor product: Rainrock RockOA

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108575Published

BerriAI LiteLLM Secret Resolution main.py get_secret improper authorization

cve-program ·

Vendor product: LiteLLM

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108584Published

FunnyWolf Viper config hard-coded credentials

cve-program ·

Vendor product: Viper

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0706Published

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows …

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108684Published

erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection

cve-program ·

Vendor product: Jeewms

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108772Published

bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal

cve-program ·

Vendor product: abstruse

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-73799Published

HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability

cve-program ·

Vendor product: HPE NonStop SNMP Trap Multiplexer

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108777Published

erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108782Published

erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110746Published

CVE-2026-110746

cve-program ·

Vendor product: TotalAV

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108786Published

houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery

cve-program ·

Vendor product: seo-crawler-mcp

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-76662Published

HPE NonStop TELSERV - Memory corruption vulnerability

cve-program ·

Vendor product: HPE NonStop TELSERV

CVSS 3.1 5.9Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0494Published

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors re…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108790Published

westboy CicadasCMS Backend Template Editor save TemplateController.save path traversal

cve-program ·

Vendor product: CicadasCMS

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108800Published

yangzongzhuan RuoYi cross-site request forgery

cve-program ·

Vendor product: RuoYi

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109686Published

WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: link-whisper

CVSS 3.1 9.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108804Published

TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection

cve-program ·

Vendor product: TEW-751DR · Vendor product: TEW-752DRU · Vendor product: TEW733GR

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109082Published

Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-services

CVSS 3.1 6.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0483Published

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous inf…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108808Published

Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings

cve-program ·

Vendor product: Call Recording Software

CVSS 4.0 2.1 · CVSS 3.1 2.6 · CVSS 3.0 2.6 · CVSS 2.0 2.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108812Published

SEMCMS SEMCMS_User.php user improper authorization

cve-program ·

Vendor product: SEMCMS

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108816Published

agno-agi agno PythonTools python.py run_python_code code injection

cve-program ·

Vendor product: agno

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0475Published

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors relate…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108820Published

agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges

cve-program ·

Vendor product: agno

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108825Published

yangzongzhuan RuoYi authDataScope checkRoleAllowed privileges management

cve-program ·

Vendor product: RuoYi

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108829Published

Zen Cart Module Configuration modules.php sql injection

cve-program ·

Vendor product: Zen Cart

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108835Published

Yungengxin Yun Jia Security Guard kgameprotect.sys sub_14000885C privileges management

cve-program ·

Vendor product: Yun Jia Security Guard

CVSS 4.0 4.8 · CVSS 3.1 4.4 · CVSS 3.0 4.4 · CVSS 2.0 3.2Source modified 15 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.