Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695275 source statements · aliases may refer to the same vulnerability

CVE-2026-45245Published

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.6 · CVSS 3.1 · [email protected] · Secondary 7.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47673Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.8 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47674Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) compares incoming IP addresses against configured deny and allow rules using string …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47675Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize() function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax (;, \…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47676Published

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47759Published

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious val…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47760Published

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute san…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47761Published

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when conten…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-47762Published

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is re…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-5163Published

Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not ha…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6333Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.5 · CVSS 3.1 · [email protected] · Primary 5.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6334Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce client identity binding during the OAuth authorization code redemption flow which allows an authenticated OAuth client to redeem authorization codes issued to a diffe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1 · CVSS 3.1 · [email protected] · Primary 3.8Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6339Published

Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recip…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6340Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploadi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6343Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check public/private permissions which allows members without these permissions to access public playbooks via /get.. Mattermost Advisory ID: MMSA-2026-0059…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6345Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisor…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6346Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields before including them in support packet generation, which allows a Mattermost System Admin or any party with access …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-6347Published

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuration fields in the Mattermost Calls plugin which allows an attacker with access to a support packet to obtain TURN server creden…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.6Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-8766Published

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILO_CO…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 6.5 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-8769Published

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-ut…

nvd ·

CVE-2026-72923Published

Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion

cve-program ·

Vendor product: OpenAPI.NET

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2023-0466Published

Certificate policy check not enabled

cve-program ·

Vendor product: OpenSSL

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2023-0465Published

Invalid certificate policies in leaf certificates are silently ignored

cve-program ·

Vendor product: OpenSSL

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102471Published

CRLF header injection in vertx-mail-client allows manipulation of outgoing SMTP messages

cve-program ·

Vendor product: Eclipse Vert.x

CVSS 4.0 6.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110713Published

libsmb2 through 6.2 Heap Out-of-Bounds Read via File System Info Decoders

cve-program ·

https://github.com/sahlberg/libsmb2: libsmb2

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110310Published

RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

cve-program ·

Vendor product: Amazon.Extensions.S3.Encryption

CVSS 3.1 5.3 · CVSS 4.0 6.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-54566Published

Markdown Preview Enhanced: Remote Code Execution via VM Sandbox Escape in `.crossnote/config.js` and `.crossnote/parser.js`

cve-program ·

Vendor product: vscode-markdown-preview-enhanced

CVSS 4.0 8.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-55386Published

InvoiceShelf ORDER BY SQL injection through orderByField

cve-program ·

Vendor product: InvoiceShelf

CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-55383Published

InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

cve-program ·

Vendor product: InvoiceShelf

CVSS 3.1 8.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-82153Published

Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclos…

cve-program ·

Vendor product: OS Recovery Tool

CVSS 3.1 2.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-53999Published

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

cve-program ·

Vendor product: radius

CVSS 3.1 7.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-73252Published

Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

cve-program ·

Vendor product: mongoose

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107361Published

Authentication Bypass Using an Alternate Path or Channel in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 3.1 4.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2023-0464Published

Excessive Resource Usage Verifying X.509 Policy Constraints

cve-program ·

Vendor product: OpenSSL

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-103974Published

lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies

cve-program ·

Vendor product: lila

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102755Published

DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting

cve-program ·

Vendor product: dataease

CVSS 4.0 5.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107337Published

Cross-Site Request Forgery in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110761Published

ILIAS before 9.24, 10.12, and 11.5 PHP Object Injection via Test Results Import

cve-program ·

https://github.com/ILIAS-eLearning/ILIAS: ILIAS

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107336Published

Authentication Bypass by Spoofing in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110766Published

Colanode Server through 0.4.7 Path Traversal via Avatar Download Route

cve-program ·

https://github.com/colanode/colanode: colanode

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110771Published

Shopizer through 3.2.5 Authorization Bypass via Product Review customerId

cve-program ·

https://github.com/shopizer-ecommerce/shopizer: Shopizer

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110667Published

cemtan sar2html sar2html.py hard-coded credentials

cve-program ·

Vendor product: sar2html

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107335Published

Improper Handling of Highly Compressed Data in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-105066Published

WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: simply-rets

CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-77371Published

Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

cve-program ·

Vendor product: redash

CVSS 4.0 9.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107334Published

Incorrect Authorization in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-42093Published

Redash: SQL Injection via Query Results parameterized query substitution

cve-program ·

Vendor product: redash

CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107333Published

Incorrect Authorization in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-44415Published

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to f…

cve-program ·

Vendor product: Industrial Edge Device Kit - arm64 V1.10 · Vendor product: Industrial Edge Device Kit - arm64 V1.11 · Vendor product: Industrial Edge Device Kit - arm64 V1.12

CVSS 3.1 9.1 · CVSS 4.0 8.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-63353Published

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.

cve-program ·

Vendor product: SIMATIC Drive Controller CPU 1504D TF · Vendor product: SIMATIC Drive Controller CPU 1507D TF · Vendor product: SIMATIC ET 200SP CPU 1510SP F-1 PN

CVSS 3.1 9.6 · CVSS 4.0 9.4Source modified 14 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.