Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695723 source statements · aliases may refer to the same vulnerability

CVE-2026-109752Published

Use-after-free in the DOM: Workers component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109751Published

Information disclosure in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109742Published

Information disclosure in the PDF Viewer component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108380Published

dataclasses-avroschema field documentation allows code injection in generated Pydantic descriptions

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109741Published

Use-after-free in the Storage: Bucket File System component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109738Published

Use-after-free in the Audio/Video: Playback component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109724Published

Use-after-free in the DOM: Core & HTML component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109717Published

Use-after-free in the DOM: Bindings (WebIDL) component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109713Published

Use-after-free in the Crash Reporting component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109711Published

Use-after-free in the Graphics: Canvas2D component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109732Published

Use-after-free in the DOM: Streams component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109729Published

Use-after-free in the JavaScript Engine: JIT component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109728Published

Use-after-free in the DOM: Animation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109727Published

Use-after-free in the Audio/Video component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109726Published

Use-after-free in the SVG component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109725Published

Use-after-free in the DOM: Core & HTML component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109719Published

Race condition, use-after-free in the Graphics: CanvasWebGL component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109718Published

Use-after-free in the XML component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109710Published

Use-after-free in the Graphics: Text component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109706Published

Use-after-free in the Storage: IndexedDB component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108385Published

dataclasses-avroschema enum symbols can inject statements through generated member names

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109335Published

SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields

cve-program ·

Vendor product: surrealdb

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109330Published

Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer

cve-program ·

Vendor product: Network-AI

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-95122Published

mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service

cve-program ·

Vendor product: n/a

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109325Published

Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109320Published

Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

cve-program ·

Vendor product: grav-plugin-api

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109315Published

Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109310Published

SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

cve-program ·

Vendor product: siyuan

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-52394Published

DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.

cve-program ·

Vendor product: n/a

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109300Published

Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.1 · CVSS 3.1 4.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106016Published

Mitigation bypass in the File Handling component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109779Published

Race condition in the Networking: DNS component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109773Published

Denial-of-service in the Sync component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109771Published

Information disclosure in the WebRTC: Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109769Published

Information disclosure in the Networking: Cache component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109768Published

Denial-of-service in the Site Reports component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109761Published

Use-after-free in the JavaScript: WebAssembly component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109749Published

Use-after-free in the JavaScript: WebAssembly component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109748Published

Use-after-free in the JavaScript: WebAssembly component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109735Published

Use-after-free in the DOM: Animation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109280Published

ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 2.0 · CVSS 3.1 2.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109305Published

Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every

cve-program ·

Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109275Published

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109270Published

ImageMagick before 7.1.2-32 Memory Leak via -process Option

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109265Published

ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109255Published

FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.1 · CVSS 3.1 6.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109250Published

FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys()

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.0 · CVSS 3.1 6.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109245Published

FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.4 · CVSS 3.1 6.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108382Published

dataclasses-avroschema allows code injection through generated enum-symbol string literals

cve-program ·

Vendor product: dataclasses-avroschema

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109240Published

FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.