Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695680 source statements · aliases may refer to the same vulnerability

CVE-2026-108779Published

erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-36879Published

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100119Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2025-62718Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a traili…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 9.9 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-67818Published

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restor…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.2Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-67819Published

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileRepl…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 4.9Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-100114Published

CAI Content Credentials | Improper Access Control (CWE-284)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-36123Published

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-35737Published

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-35260Published

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a z…

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-35252Published

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to de…

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

GHSA-m4ch-rfv5-x5g3Published

git2-rs fails to verify SSH keys by default

osv · CVE-2023-22742 · GHSA-8643-3wh5-rmjq · RUSTSEC-2023-0003

crates.io: libgit2-sys · crates.io: libgit2-sys · crates.io: git2

MODERATESource modified 14 Oct 2026Recorded 24 Oct 2026

CVE-2026-103296Published

CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108774Published

erzhongxmu JEEWMS MdBinController.java getbinallagv sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-34918Published

An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (T…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100124Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108769Published

zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service

cve-program ·

Vendor product: CowAgent

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108902Published

pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link

cve-program ·

Vendor product: ph7builder

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108885Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108880Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-95695Published

IBM WebSphere Application Server Liberty Incorrect Authorization

cve-program ·

Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 7.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-32296Published

The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-105442Published

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108875Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-42789Published

Non-CA certificate accepted as intermediate issuer in public_key path validation

cve-program ·

Vendor product: otp · Vendor product: public_key · https://github.com: erlang/otp

CVSS 4.0 7.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-77816Published

IBM WebSphere Application Server Liberty Improper Certificate Validation

cve-program ·

Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108870Published

JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-32250Published

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-32221Published

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` …

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-32208Published

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108682Published

zhayujie CowAgent Web Console upload read denial of service

cve-program ·

Vendor product: CowAgent

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102514Published

Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive

cve-program ·

https://github.com/peazip/PeaZip/releases: PeaZip

CVSS 4.0 8.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108865Published

AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize

cve-program ·

Vendor product: Unla

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-32207Published

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidenta…

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108860Published

BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key

cve-program ·

Vendor product: BotSharp

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108855Published

UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish

cve-program ·

Vendor product: Wanwu

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-103850Published

Substance3D - Stager | Out-of-bounds Read (CWE-125)

cve-program ·

Vendor product: Adobe Substance 3D Stager

CVSS 3.1 5.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-68964Published

Gitea restricted-user SSH and GPG key metadata disclosure

cve-program ·

Vendor product: Gitea

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-71301Published

Gitea private pull request title disclosure through markup

cve-program ·

Vendor product: code.gitea.io/gitea

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108850Published

Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup

cve-program ·

Vendor product: company-research-agent

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108577Published

Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption

cve-program ·

Vendor product: libmodplug

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108760Published

LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

cve-program ·

Vendor product: llamafarm

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-83662Published

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 9.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108755Published

Hatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion Endpoint

cve-program ·

Vendor product: hatchet

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110084Published

Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110079Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110074Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-32206Published

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbou…

cve-program ·

Vendor product: https://github.com/curl/curl

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107305Published

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-84994Published

Qwik: Crashing any Qwik Server via Resource thenable

cve-program ·

Vendor product: qwik · Vendor product: qwik

CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.