Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695613 source statements · aliases may refer to the same vulnerability

CVE-2026-104909Published

Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter

cve-program ·

Vendor product: Mang Board

CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-101895Published

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

cve-program ·

Vendor product: angular · Vendor product: platform-server

CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108951Published

LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

cve-program ·

Vendor product: cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-94348Published

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with local access could potentially exploit t…

cve-program ·

Vendor product: PowerScale InsightIQ

CVSS 3.1 6.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110649Published

Stills before 25.24.2 OS Command Injection via Media File Names

cve-program ·

https://www.npmjs.com/package/stills: stills

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108831Published

meetecho janus-gateway Admin API admin.js hard-coded credentials

cve-program ·

Vendor product: janus-gateway

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107426Published

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ppv-live-webcams

CVSS 3.1 7.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110644Published

nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

cve-program ·

https://registry.npmjs.org: nodejs-whisper

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108827Published

Zen Cart Administrative Module Management general.php zen_call_function code injection

cve-program ·

Vendor product: Zen Cart

CVSS 4.0 2.1 · CVSS 3.1 4.1 · CVSS 3.0 4.1 · CVSS 2.0 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110639Published

@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

cve-program ·

https://registry.npmjs.org: @mborne/extract

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110634Published

git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

cve-program ·

https://www.npmjs.com/package/git-diff: git-diff

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108822Published

Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow

cve-program ·

Vendor product: Kamailio

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110629Published

VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

cve-program ·

https://packagist.org: laravel-crm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-106599Published

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: surecart

CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108818Published

agno-agi agno auth.py get_authentication_dependency missing authentication

cve-program ·

Vendor product: agno

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108814Published

SEMCMS SEMCMS_Banner.php sql injection

cve-program ·

Vendor product: SEMCMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108810Published

tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure

cve-program ·

Vendor product: tsi-dpdp-cms

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-38096Published

There is a NULL pointer vulnerability in vmwgfx driver

cve-program ·

Vendor product: kernel

CVSS 3.1 6.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-37454Published

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge fu…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107203Published

Foreman: domain and subnet interface api skips host search filters

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: foreman

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107433Published

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: miniorange-oauth-20-server

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110452Published

The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.

cve-program ·

Vendor product: Nix

CVSS 3.1 4.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-37434Published

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affec…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108806Published

krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection

cve-program ·

Vendor product: EmployeeRecruitmentSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108802Published

y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting

cve-program ·

Vendor product: RuoYi

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110385Published

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Docum…

cve-program ·

Vendor product: Document Server

CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-50217Published

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv…

cve-program ·

Vendor product: Guardicore Platform Agent

CVSS 3.1 4.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-36946Published

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-84994Published

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.reso…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-108981Published

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the…

cve-program ·

Vendor product: ngx_cache_purge

CVSS 3.1 3.6Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108788Published

deepseek-ai deepseek-harness Sandbox spawn sandbox

cve-program ·

Vendor product: deepseek-harness

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-73190Published

WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wpdm-premium-packages

CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108784Published

macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error

cve-program ·

Vendor product: mall

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108779Published

erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-36879Published

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100119Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2025-62718Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a traili…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 9.9 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-67818Published

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restor…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.2Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-67819Published

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileRepl…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 4.9Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-100114Published

CAI Content Credentials | Improper Access Control (CWE-284)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-36123Published

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-35737Published

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-35260Published

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a z…

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-35252Published

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to de…

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

GHSA-m4ch-rfv5-x5g3Published

git2-rs fails to verify SSH keys by default

osv · CVE-2023-22742 · GHSA-8643-3wh5-rmjq · RUSTSEC-2023-0003

crates.io: libgit2-sys · crates.io: libgit2-sys · crates.io: git2

MODERATESource modified 14 Oct 2026Recorded 24 Oct 2026

CVE-2026-103296Published

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108774Published

erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-34918Published

An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (T…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100124Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108769Published

zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service

cve-program ·

Vendor product: CowAgent

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 14 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.