Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695723 source statements · aliases may refer to the same vulnerability

CVE-2026-107806Published

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

cve-program ·

Vendor product: nginx-ui

CVSS 4.0 9.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108108Published

PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()

cve-program ·

Vendor product: phpnuxbill

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108103Published

Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE

cve-program ·

Vendor product: open5gs

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-78021Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit …

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 3.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-78016Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerabil…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 3.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107914Published

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested b…

cve-program ·

Vendor product: Backdrop

CVSS 3.1 7.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-78797Published

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-75350Published

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service

cve-program ·

Vendor product: n/a

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-75349Published

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.

cve-program ·

Vendor product: n/a

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-82918Published

XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the se…

cve-program ·

Vendor product: XG-X VisionTerminal · Vendor product: XG VisionTerminal · Vendor product: LJ Series Terminal-Software

CVSS 3.1 5.5 · CVSS 4.0 6.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107738Published

SumatraPDF: Untrusted binary record offset used without lower-bound validation

cve-program ·

Vendor product: sumatrapdf

CVSS 4.0 6.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107733Published

SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open

cve-program ·

Vendor product: sumatrapdf

CVSS 4.0 6.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107728Published

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

cve-program ·

Vendor product: strawberry

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107801Published

Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107796Published

Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107723Published

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

cve-program ·

Vendor product: fast-jwt

CVSS 3.1 8.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107718Published

AdonisJS: Unencoded route parameters can produce open redirects

cve-program ·

Vendor product: http-server

CVSS 3.1 6.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107399Published

Mechanize sends credential headers to another origin after a meta refresh

cve-program ·

Vendor product: mechanize

CVSS 3.1 6.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107782Published

System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port

cve-program ·

https://github.com/winsiderss/systeminformer: System Informer

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107708Published

MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC

cve-program ·

https://github.com/krb5/krb5: krb5

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107301Published

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options object disables the default protoAction: 'error' protection. A decoded map containing a proto ke…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-107296Published

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-107393Published

FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

cve-program ·

Vendor product: freescout

CVSS 3.1 6.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-104075Published

TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login

cve-program ·

Vendor product: TVU Receiver / Transceiver

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107699Published

ppt2png through 0.0.6 OS Command Injection via input and output paths

cve-program ·

https://www.npmjs.com/package/ppt2png: ppt2png

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107383Published

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

cve-program ·

Vendor product: mariadb-connector-nodejs

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107377Published

datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

cve-program ·

Vendor product: datamodel-code-generator

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-97147Published

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publi…

cve-program ·

Vendor product: Mistral

CVSS 4.0 7.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107695Published

FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107301Published

msgpack5: Partial options disable prototype protection

cve-program ·

Vendor product: msgpack5

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107296Published

msgpack5: Decoding negative int64 values mutates the input buffer

cve-program ·

Vendor product: msgpack5

CVSS 3.1 3.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107292Published

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 3.1 6.4Source modified 14 Oct 2026Recorded 23 Oct 2026

MAL-2026-17868Published

Malicious code in @kre64/hello-npm-test (npm)

osv · GHSA-c43r-xf4h-m548

npm: @kre64/hello-npm-test

Source modified 14 Oct 2026Recorded 24 Oct 2026

CVE-2026-107676Published

FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Serializer

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107287Published

Pydantic AI: Excessive resource use when local web fetching converts nested HTML

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 3.1 6.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-18503Published

Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

cve-program ·

Vendor product: CPython

CVSS 4.0 2.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2024-5042Published

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise o…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.6Source modified 14 Oct 2026Recorded 25 Oct 2026

MAL-2026-17765Published

Malicious code in @s4yhiitestpoc/r3-https (npm)

osv · GHSA-798w-mj69-gc2x

npm: @s4yhiitestpoc/r3-https

Source modified 13 Oct 2026Recorded 24 Oct 2026

CVE-2024-5042Published

Submariner-operator: rbac permissions can allow for the spread of node compromises

cve-program ·

https://github.com/submariner-io/submariner-operator: submariner-operator · https://catalog.redhat.com/software/containers/: odf4/odf-multicluster-rhel9-operator · https://catalog.redhat.com/software/containers/: odf4/cephcsi-rhel9

CVSS 3.1 6.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-70196Published

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-70186Published

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-70181Published

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

MAL-2026-17749Published

Malicious code in @myorder-frontend-commons/analytics (npm)

osv · GHSA-4xrc-8qvp-c7r5

npm: @myorder-frontend-commons/analytics

Source modified 13 Oct 2026Recorded 24 Oct 2026

CVE-2026-84256Published

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject

cve-program ·

Vendor product: OpenVPN

CVSS 4.0 7.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-104922Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-105151Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-105142Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-88763Published

Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: skupper-router · https://access.redhat.com/downloads/content/package-browser/: skupper-router · https://catalog.redhat.com/software/containers/: service-interconnect/skupper-router-rhel9

CVSS 3.1 5.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-86063Published

Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-84320Published

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory co…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3Source modified 13 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.