Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695723 source statements · aliases may refer to the same vulnerability

CVE-2026-84319Published

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allow…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.3Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-21413Published

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A specially crafted malicious file can lead to a heap buffer overflow. An attacker can provide a mali…

cve-program ·

Vendor product: LibRaw

CVSS 3.1 9.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-0604Published

Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

cve-program ·

https://github.com/keycloak/keycloak: keycloak-ldap-federation · https://access.redhat.com/downloads/content/package-browser/: Red Hat Build of Keycloak · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106504Published

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2024-10492Published

Keycloak-quarkus-server: keycloak path trasversal

cve-program ·

https://github.com/keycloak/keycloak: keycloak · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9

CVSS 3.0 2.7Source modified 13 Oct 2026Recorded 23 Oct 2026

GHSA-f63g-mx39-3r38Published

Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability

osv · CVE-2026-85363

NuGet: Microsoft.WindowsDesktop.App.Runtime.win-arm64 · NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x64 · NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x86

HIGHSource modified 13 Oct 2026Recorded 23 Oct 2026

GHSA-f8qh-mqg4-9939Published

Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability

osv · CVE-2026-96232

NuGet: Microsoft.WindowsDesktop.App.Runtime.win-arm64 · NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x64 · NuGet: Microsoft.WindowsDesktop.App.Runtime.win-x86

HIGHSource modified 13 Oct 2026Recorded 23 Oct 2026

GHSA-2j93-m82w-73j2Published

Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability

osv · CVE-2026-96231

NuGet: Microsoft.NETCore.App.Runtime.linux-arm · NuGet: Microsoft.NETCore.App.Runtime.linux-arm64 · NuGet: Microsoft.NETCore.App.Runtime.linux-musl-arm

HIGHSource modified 13 Oct 2026Recorded 23 Oct 2026

GHSA-w6wh-p4g7-mpj2Published

Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability

osv · CVE-2026-96225

NuGet: Microsoft.NETCore.App.Runtime.linux-arm · NuGet: Microsoft.NETCore.App.Runtime.linux-arm64 · NuGet: Microsoft.NETCore.App.Runtime.linux-musl-arm

HIGHSource modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2024-10451Published

Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process

cve-program ·

https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator

CVSS 3.1 5.9Source modified 13 Oct 2026Recorded 23 Oct 2026

GHSA-86xp-94pg-8r6rPublished

Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability

osv ·

NuGet: Microsoft.AspNetCore.SignalR.Protocols.MessagePack · NuGet: Microsoft.AspNetCore.SignalR.Protocols.MessagePack · NuGet: Microsoft.AspNetCore.SignalR.Protocols.MessagePack

MODERATESource modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107816Published

MariaDB: `qc_info` plugin can do OOB reads if query contains \0

cve-program ·

Vendor product: server

CVSS 3.1 6.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107822Published

MariaDB: database privilege escalation via user / role name collision in the acl cache

cve-program ·

Vendor product: server

CVSS 3.1 6.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107834Published

OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

cve-program ·

Vendor product: coraza

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-103853Published

Dimension | Out-of-bounds Read (CWE-125)

cve-program ·

Vendor product: Adobe Dimension

CVSS 3.1 5.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107837Published

RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling

cve-program ·

Vendor product: RIOT

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-103855Published

Dimension | NULL Pointer Dereference (CWE-476)

cve-program ·

Vendor product: Adobe Dimension

CVSS 3.1 5.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107842Published

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

cve-program ·

Vendor product: contao

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107850Published

Contao: Improper access control in the preview links module

cve-program ·

Vendor product: contao

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107857Published

Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile

cve-program ·

Vendor product: Mindwtr

CVSS 3.1 4.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108263Published

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

cve-program ·

Vendor product: astron-agent

CVSS 3.1 9.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-62367Published

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

cve-program ·

Vendor product: vikunja

CVSS 4.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108269Published

ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session

cve-program ·

Vendor product: ra-tls-clients

CVSS 4.0 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107226Published

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

cve-program ·

Vendor product: async-http-client

CVSS 3.1 6.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-59977Published

ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

cve-program ·

Vendor product: ConvertX

CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-95838Published

containerd: Unpack DoS via repeated opaque whiteouts

cve-program ·

Vendor product: containerd

CVSS 4.0 4.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-41508Published

OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

cve-program ·

Vendor product: coraza

CVSS 3.1 5.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84320Published

Nginx UI: Auto backup name allows path traversal outside validated storage path

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 6.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84319Published

Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 8.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-49483Published

Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

cve-program ·

Vendor product: vscode-ibmi

CVSS 4.0 8.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-44828Published

Qexo initialization endpoint can reset setup state and expose stored credentials

cve-program ·

Vendor product: Qexo

CVSS 4.0 9.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-102342Published

ammonia allows stored XSS through unsanitized SVG animate and set attributes

cve-program ·

Vendor product: ammonia

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106108Published

Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

cve-program ·

Vendor product: quasar · Vendor product: app-vite

CVSS 4.0 5.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-69150Published

KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map

cve-program ·

Vendor product: keepassxc

CVSS 4.0 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-102734Published

asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter

cve-program ·

Vendor product: asteval

CVSS 3.1 5.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-102672Published

Electron: Local race condition in Squirrel.Mac update installation on macOS

cve-program ·

Vendor product: electron

CVSS 3.1 6.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-54640Published

OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

cve-program ·

Vendor product: openremote · Vendor product: openremote-manager

CVSS 3.1 7.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-82416Published

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

cve-program ·

Vendor product: frankenphp

CVSS 3.1 7.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-54454Published

OpenCATS: Authenticated RCE in the Import module

cve-program ·

Vendor product: OpenCATS

CVSS 3.1 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-94603Published

Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

cve-program ·

Vendor product: podman

CVSS 3.1 10.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108379Published

dataclasses-avroschema fixed namespaces allow code injection in generated annotations

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108384Published

dataclasses-avroschema allows code injection through fixed-type aliases supplied as a bare string

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-104816Published

Misskey: Cross-site scripting in RSS feed item links

cve-program ·

Vendor product: misskey

CVSS 4.0 8.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-86063Published

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

cve-program ·

Vendor product: claude-code

CVSS 4.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-96236Published

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-92702Published

Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path

cve-program ·

Vendor product: cocos

CVSS 3.1 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-92701Published

Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path

cve-program ·

Vendor product: cocos

CVSS 3.1 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106628Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106633Published

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-110037Published

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.