Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695680 source statements · aliases may refer to the same vulnerability

CVE-2026-86002Published

Dokku: Host Command Execution via eval of Unsanitized Docker Options in DOCKER_ARGS

cve-program ·

Vendor product: dokku

CVSS 3.1 9.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-109187Published

jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey

cve-program ·

Vendor product: jshERP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-109182Published

jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

cve-program ·

Vendor product: jshERP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2016-20099Published

L-SMASH through 2.14.5 Infinite Loop in VC-1 Importer Probe

cve-program ·

https://github.com: l-smash

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-39190Published

An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-109177Published

MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

cve-program ·

Vendor product: MoguBlog

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-109172Published

yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint

cve-program ·

Vendor product: yshop-crm

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-91156Published

Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

cve-program ·

Vendor product: discourse

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100163Published

Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback

cve-program ·

Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVSS 3.1 7.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-109165Published

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create

cve-program ·

https://github.com/TDuckCloud/tduck-survey-form: tduck-survey-form

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110717Published

Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

cve-program ·

https://github.com/meetecho/janus-gateway: janus-gateway

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108889Published

Yungengxin Cloud Billing IOCTL Process Termination LWBilling64.sys sub_14000443C exposed ioctl with insufficient access control

cve-program ·

Vendor product: Cloud Billing

CVSS 4.0 4.8 · CVSS 3.1 4.4 · CVSS 3.0 4.4 · CVSS 2.0 3.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110712Published

libsmb2 through 6.2 Heap Out-of-Bounds Read via smb2_decode_file_all_info

cve-program ·

https://github.com/sahlberg/libsmb2: libsmb2

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-103907Published

Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action

cve-program ·

Vendor product: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-39188Published

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-52903Published

YAML safe_load production fallback to unsafe_load enables RCE via deserialization

cve-program ·

https://github.com/ManageIQ/manageiq: manageiq · Vendor product: manageiq

CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110657Published

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label

cve-program ·

https://pypi.org: nnef · https://pypi.org: nnef-tools

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-104909Published

Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter

cve-program ·

Vendor product: Mang Board

CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-101895Published

Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE

cve-program ·

Vendor product: angular · Vendor product: platform-server

CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108951Published

LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

cve-program ·

Vendor product: cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-94348Published

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with local access could potentially exploit t…

cve-program ·

Vendor product: PowerScale InsightIQ

CVSS 3.1 6.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110649Published

Stills before 25.24.2 OS Command Injection via Media File Names

cve-program ·

https://www.npmjs.com/package/stills: stills

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108831Published

meetecho janus-gateway Admin API admin.js hard-coded credentials

cve-program ·

Vendor product: janus-gateway

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107426Published

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ppv-live-webcams

CVSS 3.1 7.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110644Published

nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

cve-program ·

https://registry.npmjs.org: nodejs-whisper

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108827Published

Zen Cart Administrative Module Management general.php zen_call_function code injection

cve-program ·

Vendor product: Zen Cart

CVSS 4.0 2.1 · CVSS 3.1 4.1 · CVSS 3.0 4.1 · CVSS 2.0 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110639Published

@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

cve-program ·

https://registry.npmjs.org: @mborne/extract

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110634Published

git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings

cve-program ·

https://www.npmjs.com/package/git-diff: git-diff

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108822Published

Kamailio sipt ss7_parser.c isup_get_calling_party buffer overflow

cve-program ·

Vendor product: Kamailio

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110629Published

VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

cve-program ·

https://packagist.org: laravel-crm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-106599Published

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: surecart

CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108818Published

agno-agi agno auth.py get_authentication_dependency missing authentication

cve-program ·

Vendor product: agno

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108814Published

SEMCMS SEMCMS_Banner.php sql injection

cve-program ·

Vendor product: SEMCMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108810Published

tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure

cve-program ·

Vendor product: tsi-dpdp-cms

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-38096Published

There is a NULL pointer vulnerability in vmwgfx driver

cve-program ·

Vendor product: kernel

CVSS 3.1 6.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-37454Published

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge fu…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107203Published

Foreman: domain and subnet interface api skips host search filters

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: foreman

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107433Published

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: miniorange-oauth-20-server

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110452Published

The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.

cve-program ·

Vendor product: Nix

CVSS 3.1 4.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-37434Published

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affec…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108806Published

krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection

cve-program ·

Vendor product: EmployeeRecruitmentSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108802Published

y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting

cve-program ·

Vendor product: RuoYi

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110385Published

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Docum…

cve-program ·

Vendor product: Document Server

CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-50217Published

A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of service (system crash / BSOD) via an outbound ICMPv6 packet containing an IPv…

cve-program ·

Vendor product: Guardicore Platform Agent

CVSS 3.1 4.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-36946Published

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-84994Published

Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.reso…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-108981Published

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the…

cve-program ·

Vendor product: ngx_cache_purge

CVSS 3.1 3.6Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108788Published

deepseek-ai deepseek-harness Sandbox spawn sandbox

cve-program ·

Vendor product: deepseek-harness

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-73190Published

WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wpdm-premium-packages

CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108784Published

macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error

cve-program ·

Vendor product: mall

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 14 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.