Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695723 source statements · aliases may refer to the same vulnerability

CVE-2026-110077Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-110082Published

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-48398Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-55601Published

MultiTail: Shell injection in execute-on-match command handling

cve-program ·

Vendor product: multitail

CVSS 3.1 7.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108758Published

Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint

cve-program ·

Vendor product: easyappointments

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108572Published

Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

cve-program ·

Vendor product: Casdoor

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-9557Published

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont

cve-program ·

Vendor product: Zephyr

CVSS 3.1 7.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-9558Published

Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start

cve-program ·

Vendor product: Zephyr

CVSS 3.1 7.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-9408Published

Userspace privilege escalation vulnerability on Cortex M

cve-program ·

Vendor product: Zephyr

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

GHSA-5gjq-3f94-rcf7Published

Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

osv · CVE-2026-105016

NuGet: Microsoft.Native.Quic.MsQuic.Schannel

CRITICALSource modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108666Published

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-7403Published

Bluetooth: bt_conn_tx_processor unsafe handling

cve-program ·

Vendor product: Zephyr

CVSS 3.1 7.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-2962Published

Infinite loop in dns_copy_qname

cve-program ·

Vendor product: Zephyr

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108576Published

TOZED X300 IPPingDiagnostics process_ping os command injection

cve-program ·

Vendor product: X300

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-1675Published

Out of bounds read in dns_copy_qname

cve-program ·

Vendor product: Zephyr

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-1674Published

Out of bounds read when unpacking DNS answers

cve-program ·

Vendor product: Zephyr

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-1673Published

Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg

cve-program ·

Vendor product: Zephyr

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108568Published

InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

cve-program ·

Vendor product: icms2

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-104935Published

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.

cve-program ·

Vendor product: Connect Secure

CVSS 3.1 8.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108543Published

ag2ai ag2 UserProxyAgent os.path.join path traversal

cve-program ·

Vendor product: ag2

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108539Published

GPAC MP4Box filter_queue.c gf_fq_pop use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108521Published

Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

cve-program ·

Vendor product: Sencho

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-12899Published

net: icmp: Out of bound memory read

cve-program ·

Vendor product: Zephyr

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108701Published

1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort

cve-program ·

Vendor product: CordysCRM

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108688Published

Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload

cve-program ·

Vendor product: eladmin

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-12890Published

Bluetooth: peripheral: Invalid handling of malformed connection request

cve-program ·

Vendor product: Zephyr

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-12035Published

Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP

cve-program ·

Vendor product: Zephyr

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108676Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-10457Published

Bluetooth: Out-Of-Context le_conn_rsp Handling

cve-program ·

Vendor product: Zephyr

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-10458Published

Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values

cve-program ·

Vendor product: Zephyr

CVSS 3.1 7.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108671Published

JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108661Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108656Published

JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108631Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108693Published

ImageMagick through 7.1.2-33 and 6.9.13-58 Uncontrolled Search Path via Ghostscript Delegate

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 7.3 · CVSS 3.1 7.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108712Published

SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

cve-program ·

Vendor product: SuiteCRM

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108717Published

Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController

cve-program ·

Vendor product: iTop

CVSS 4.0 5.3 · CVSS 3.1 6.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108722Published

open-computer-use through commit 610bac8 Stored XSS via log.html Session Log

cve-program ·

Vendor product: open-computer-use

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-10456Published

Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests

cve-program ·

Vendor product: Zephyr

CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108732Published

Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

cve-program ·

Vendor product: hrms

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108737Published

Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

cve-program ·

Vendor product: Traccar

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108742Published

CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation

cve-program ·

Vendor product: CloudBeaver

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108748Published

Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

cve-program ·

Vendor product: quarkus-langchain4j

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108753Published

Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

cve-program ·

Vendor product: agnai

CVSS 4.0 9.3 · CVSS 3.1 9.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108681Published

zhayujie CowAgent Web Console web_channel.py denial of service

cve-program ·

Vendor product: CowAgent

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108727Published

EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes

cve-program ·

Vendor product: EdgeEver

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108853Published

UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app

cve-program ·

Vendor product: Wanwu

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108858Published

Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs

cve-program ·

Vendor product: LoRAX

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108863Published

Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

cve-program ·

Vendor product: Plano

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107391Published

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.