Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694926 source statements · aliases may refer to the same vulnerability

CVE-2016-0466Published

Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAX…

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108892Published

Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow

cve-program ·

Vendor product: E1700

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108896Published

Linksys E1700 setLinksysIpv6 os command injection

cve-program ·

Vendor product: E1700

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108900Published

Exponent CMS XML-RPC xmlrpc.php userLogin sql injection

cve-program ·

Vendor product: CMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108908Published

Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting

cve-program ·

Vendor product: NR268

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108916Published

Edimax BR-6208AC formAccept command injection

cve-program ·

Vendor product: BR-6208AC

CVSS 4.0 6.9 · CVSS 3.1 8.3 · CVSS 3.0 8.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-55681Published

WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter

cve-program ·

Vendor product: WeGIA

CVSS 3.1 8.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108920Published

SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting

cve-program ·

Vendor product: Drug Recommendation System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108937Published

code-projects Online Ticket Reservation System medallion.sql file information disclosure

cve-program ·

Vendor product: Online Ticket Reservation System

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108941Published

Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection

cve-program ·

Vendor product: CityGaussian

CVSS 4.0 2.4 · CVSS 3.1 4.8 · CVSS 3.0 4.8 · CVSS 2.0 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108945Published

iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection

cve-program ·

Vendor product: yolov13

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-46691Published

EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

cve-program ·

Vendor product: espocrm

CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108955Published

Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-bounds

cve-program ·

Vendor product: PowerInfer

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108959Published

itsourcecode Online Cake Ordering System addtransacdetail.php sql injection

cve-program ·

Vendor product: Online Cake Ordering System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108964Published

SourceCodester Performance Indicator System addproduct.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108968Published

SourceCodester Performance Indicator System sales_history.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-108972Published

SourceCodester Human Resource Management System Employee Endpoint employee.php session_start improper authentication

cve-program ·

Vendor product: Human Resource Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-53575Published

EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

cve-program ·

Vendor product: espocrm

CVSS 3.1 2.7Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-76663Published

HPE NonStop TELSERV - Memory corruption vulnerability

cve-program ·

Vendor product: HPE NonStop TELSERV

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109106Published

Polaris Office App Document Intake com.infraware.service.m.n.a path traversal

cve-program ·

Vendor product: Office App

CVSS 4.0 4.8 · CVSS 3.1 4.4 · CVSS 3.0 4.4 · CVSS 2.0 3.2Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109110Published

Wavlink WL-WN592AX6 wmapd system os command injection

cve-program ·

Vendor product: WL-WN592AX6

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109403Published

conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery

cve-program ·

Vendor product: conductor

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109407Published

macrozheng mall Coupon Redemption generateOrder race condition

cve-program ·

Vendor product: mall

CVSS 4.0 2.3 · CVSS 3.1 3.1 · CVSS 3.0 3.1 · CVSS 2.0 2.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0448Published

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-77460Published

EspoCRM: Mass email template renderer leaks restricted record fields

cve-program ·

Vendor product: espocrm

CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109520Published

Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions

cve-program ·

Vendor product: iGameCenter

CVSS 4.0 9.3 · CVSS 3.1 8.8 · CVSS 3.0 8.8 · CVSS 2.0 6.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109524Published

girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization

cve-program ·

Vendor product: Online-Appointment-Booking-System

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0402Published

Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110025Published

slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload

cve-program ·

Vendor product: phpwcms

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109827Published

GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-92922Published

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source

CVSS 3.1 8.1Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-104252Published

Vitess vttablet /twopcz reflected XSS

cve-program ·

Vendor product: vitess

CVSS 3.1 9.8Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-106632Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-109415Published

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110076Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-110081Published

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-83960Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103852Published

Substance3D - Stager | NULL Pointer Dereference (CWE-476)

cve-program ·

Vendor product: Adobe Substance 3D Stager

CVSS 3.1 5.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100135Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100121Published

CAI Content Credentials | Improper Certificate Validation (CWE-295)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-48378Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-100116Published

CAI Content Credentials | Improper Certificate Validation (CWE-295)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 5.9Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-102501Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 5.3Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0141Published

The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka …

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-103425Published

Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

cve-program ·

Vendor product: Booking Package

CVSS 3.1 6.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-95807Published

FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

cve-program ·

Vendor product: FV Player 8

CVSS 3.1 6.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-97020Published

PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter

cve-program ·

Vendor product: PO/MO Editor

CVSS 3.1 6.4Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-101926Published

Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter

cve-program ·

Vendor product: Hyyan WooCommerce Polylang Integration

CVSS 3.1 6.5Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2016-0055Published

Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cve-program ·

Vendor product: n/a

Source modified 15 Oct 2026Recorded 23 Oct 2026

CVE-2026-107756Published

Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name

cve-program ·

Vendor product: Meow Lightbox

CVSS 3.1 6.4Source modified 15 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.