Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695690 source statements · aliases may refer to the same vulnerability

CVE-2026-109778Published

Privilege escalation in the WebExtensions component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-53420Published

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.

cve-program ·

Vendor product: Zoom Workplace

CVSS 3.1 8.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-53418Published

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user to conduct an escalation of privilege via network access.

cve-program ·

Vendor product: Zoom Workplace

CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-93907Published

IBM WebSphere Application Server is affected by a bypass authentication vulnerability

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-96119Published

IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI

cve-program ·

Vendor product: i

CVSS 3.1 9.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-19620Published

IBM Planning Analytics Local is affected by security vulnerabilities

cve-program ·

Vendor product: Planning Analytics

CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-19622Published

IBM Planning Analytics Local is affected by security vulnerabilities

cve-program ·

Vendor product: Planning Analytics

CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-18529Published

IBM Maximo Application Suite - Location Service for Esri Component Code Execution

cve-program ·

Vendor product: Maximo Application Suite - Location Service for Esri Component

CVSS 3.1 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-89107Published

Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

cve-program ·

Vendor product: SAP S/4HANA (Manage Substitution/Validation Rules)

CVSS 3.1 9.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-89110Published

Broken Access Control in SAP NetWeaver Visual Composer

cve-program ·

Vendor product: SAP NetWeaver Visual Composer

CVSS 3.1 9.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-89113Published

SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)

cve-program ·

Vendor product: SAP Commerce Cloud (OOTB Code)

CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-103418Published

Universal XSS via the HTML language attribute in Translation Services

cve-program ·

Vendor product: Firefox for iOS

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107388Published

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the ID3v2 parser trusts the syncsafe tag-size field and allocates the complete tag body before checking whether the input contains the declared bytes. A …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 14 Oct 2026Recorded 25 Oct 2026

GHSA-pj7x-6wpf-pgvpPublished

Payload: SQL injection in SQLite/Postgres

osv · CVE-2026-105856 · CVE-2026-63316

npm: @payloadcms/db-sqlite · npm: @payloadcms/db-d1-sqlite · npm: @payloadcms/db-postgres

HIGHSource modified 14 Oct 2026Recorded 24 Oct 2026

CVE-2026-108573Published

Open Asset Import Library Assimp PLY File getNextBlock out-of-bounds

cve-program ·

Vendor product: Assimp

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108569Published

Furion .NET Framework StringRenderExtensions.cs String.Replace sql injection

cve-program ·

Vendor product: .NET Framework

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108544Published

Lippu Docx Reader Office Viewer App path traversal

cve-program ·

Vendor product: Docx Reader Office Viewer App

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108540Published

OpenSpug File Transfer transfer os command injection

cve-program ·

Vendor product: Spug

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108522Published

Studio-Saelix Sencho Login Endpoint login improper authentication

cve-program ·

Vendor product: Sencho

CVSS 4.0 6.9 · CVSS 3.1 8.3 · CVSS 3.0 8.3 · CVSS 2.0 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107388Published

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

cve-program ·

Vendor product: music-metadata

CVSS 3.1 6.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108695Published

MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

cve-program ·

Vendor product: MultiVendorX

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-54100Published

Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft

cve-program ·

https://catalog.redhat.com/software/containers/: openshift4-wincw/windows-machine-config-rhel9-operator · https://catalog.redhat.com/software/containers/: openshift4-wincw/windows-machine-config-rhel9-operator · https://catalog.redhat.com/software/containers/: openshift4-wincw/windows-machine-config-rhel9-operator

CVSS 3.1 8.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108708Published

Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil

cve-program ·

Vendor product: Wukong_HRM

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108703Published

CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push

cve-program ·

Vendor product: CordysCRM

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108690Published

mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList

cve-program ·

Vendor product: mall4j

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108678Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108673Published

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108668Published

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108663Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108658Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108653Published

JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108648Published

JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108643Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108638Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108633Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108628Published

JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108623Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108618Published

JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108613Published

JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108608Published

JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108603Published

slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

cve-program ·

Vendor product: slide-maker

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108597Published

Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

cve-program ·

https://pypi.org: cohere-python

CVSS 4.0 5.9 · CVSS 3.1 4.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108592Published

mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

cve-program ·

https://pypi.org: mini-swe-agent

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108582Published

GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store

cve-program ·

Vendor product: GenOffice

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108554Published

PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input

cve-program ·

Vendor product: PDFMathTranslate

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108548Published

AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token

cve-program ·

Vendor product: astron-rpa

CVSS 4.0 6.9 · CVSS 3.1 7.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108114Published

Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

cve-program ·

Vendor product: strapi

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108161Published

FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

cve-program ·

Vendor product: fusionpbx

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107723Published

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-107718Published

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 14 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.