Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695741 source statements · aliases may refer to the same vulnerability

CVE-2026-110104Published

novel through 3.5.0 Unsalted MD5 Password Storage

cve-program ·

Vendor product: novel

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-95837Published

containerd CRI plugin: Checkpoint restore bypasses destination security context

cve-program ·

Vendor product: containerd

CVSS 3.1 7.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-110109Published

JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

cve-program ·

Vendor product: JetLinks Community

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109424Published

NetEase Cloud Music Weak Encryption via eapi/xeapi

cve-program ·

Vendor product: NetEase Cloud Music for Windows

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-110116Published

Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile

cve-program ·

Vendor product: Digital-Infrastructure

CVSS 4.0 8.8 · CVSS 3.1 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-110121Published

PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint

cve-program ·

Vendor product: lilishop

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-110126Published

waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints

cve-program ·

Vendor product: waynboot-mall

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107722Published

fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-102663Published

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally ind…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-88834Published

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: busybox

CVSS 3.1 3.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109828Published

libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable

cve-program ·

Vendor product: libsndfile

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-85733Published

FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables

cve-program ·

Vendor product: frankenphp

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108923Published

1024-lab smart-admin Support Config Query queryByKey access control

cve-program ·

Vendor product: smart-admin

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-55183Published

RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

cve-program ·

Vendor product: rclone-manager

CVSS 3.1 9.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-54641Published

OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl

cve-program ·

Vendor product: openremote

CVSS 3.1 7.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109606Published

SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection

cve-program ·

Vendor product: Art Gallery Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-57847Published

Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions

cve-program ·

https://catalog.redhat.com/software/containers/: ansible-automation-platform/ee-minimal-rhel8 · https://catalog.redhat.com/software/containers/: ansible-automation-platform/ee-minimal-rhel9 · https://catalog.redhat.com/software/containers/: ansible-automation-platform/ee-minimal-rhel8

CVSS 3.1 6.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107843Published

Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check

cve-program ·

Vendor product: contao

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107838Published

RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

cve-program ·

Vendor product: RIOT

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107820Published

x64dbg-MCP Server vulnerable to pre-authentication denial of service through Content-Length integer overflow

cve-program ·

Vendor product: x64dbg-mcp-server

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107823Published

MariaDB: privilege escalation via incorrect view frm parsing

cve-program ·

Vendor product: server

CVSS 3.1 7.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107817Published

MariaDB: mysql_json plugin OOB reads

cve-program ·

Vendor product: server

CVSS 3.1 4.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-104011Rejected

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-94257. Reason: This candidate is a reservation duplicate of CVE-2026-94257. Notes: All CVE users should reference CVE-2026-94257 instead of this candidate. All references a…

cve-program ·

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107851Published

Contao: Improper access control in the table access voter

cve-program ·

Vendor product: contao

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107815Published

MariaDB: one byte OOB write in DOS tables of the CONNECT engine

cve-program ·

Vendor product: server

CVSS 3.1 8.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-5759Published

Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB

cve-program ·

https://github.com/FalkorDB/FalkorDB: FalkorDB

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-87110Published

Ops Manager Uncontrolled Resource Consumption in Monitoring Endpoints

cve-program ·

Vendor product: Ops Manager

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108711Published

Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces

cve-program ·

Vendor product: honcho

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108716Published

mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

cve-program ·

Vendor product: mcp-remote

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108721Published

Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID

cve-program ·

Vendor product: open-computer-use

CVSS 4.0 5.8 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108726Published

GLPI through 12.0.0 Missing Authorization via ajax/map.php

cve-program ·

Vendor product: GLPI

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108731Published

Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass

cve-program ·

Vendor product: raven

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108736Published

Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

cve-program ·

Vendor product: speedtest-tracker

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108741Published

Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker

cve-program ·

https://pypi.org: Shepherd

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108747Published

Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion

cve-program ·

Vendor product: lightdash

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108752Published

JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen

cve-program ·

Vendor product: jupyterhub

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108757Published

Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send

cve-program ·

Vendor product: pinclaw

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108698Published

hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition

cve-program ·

Vendor product: hyper-mcp

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108852Published

Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass

cve-program ·

Vendor product: Deep Chat

CVSS 4.0 2.1 · CVSS 3.1 4.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108857Published

Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging

cve-program ·

Vendor product: Text Embeddings Inference

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108862Published

APIPark through 1.9.7-beta IDOR via application authorization endpoints

cve-program ·

Vendor product: APIPark

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108867Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108872Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108877Published

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108882Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108887Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108904Published

pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

cve-program ·

Vendor product: ph7builder

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108953Published

mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments

cve-program ·

Vendor product: mac-shell-mcp

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109174Published

MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig

cve-program ·

Vendor product: MoguBlog

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108159Published

AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge

cve-program ·

Vendor product: astron-rpa

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.