Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695741 source statements · aliases may refer to the same vulnerability

CVE-2026-109179Published

jshERP through 3.6 Missing Authorization via /log/list and /log/info

cve-program ·

Vendor product: jshERP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109184Published

jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList

cve-program ·

Vendor product: jshERP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109169Published

LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

cve-program ·

Vendor product: LogicalDOC Community Edition

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109202Published

LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet

cve-program ·

Vendor product: LogicalDOC Community Edition

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109225Published

SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload

cve-program ·

https://pypi.org/project/sglang: sglang

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109397Published

Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload RCE via Filename Trailing Space

cve-program ·

Vendor product: Thelia

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109239Published

Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109244Published

FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.8 · CVSS 3.1 6.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109249Published

FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109254Published

FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.0 · CVSS 3.1 5.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107810Published

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109259Published

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109264Published

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109269Published

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109274Published

ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 2.0 · CVSS 3.1 2.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109279Published

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 2.0 · CVSS 3.1 2.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109304Published

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109309Published

SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

cve-program ·

Vendor product: siyuan

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109314Published

Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page

cve-program ·

Vendor product: grav-plugin-login

CVSS 4.0 8.5 · CVSS 3.1 7.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109319Published

Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

cve-program ·

Vendor product: grav-plugin-guestbook

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109324Published

Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109329Published

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php

cve-program ·

Vendor product: admidio

CVSS 4.0 8.5 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109334Published

SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use

cve-program ·

Vendor product: surrealdb

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109339Published

SurrealDB 3.1.0 before 3.3.0 Memory Exhaustion via Surrealism Module Output Buffering

cve-program ·

Vendor product: surrealdb · Vendor product: surrealism-runtime

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109344Published

DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108113Published

ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import

cve-program ·

https://github.com/ILIAS-eLearning/ILIAS: ILIAS

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109349Published

gix-pack before 0.75.0 Reachable Assertion DoS via Pack Version 3 Header

cve-program ·

Vendor product: gix-pack

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109354Published

LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter

cve-program ·

Vendor product: librenms

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109359Published

Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

cve-program ·

Vendor product: contrast

CVSS 4.0 8.7 · CVSS 3.1 7.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109364Published

Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying

cve-program ·

Vendor product: zebra

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109373Published

ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

cve-program ·

Vendor product: zitadel

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2020-37280Published

cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths

cve-program ·

Vendor product: cbor-sync

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-71429Published

GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py

cve-program ·

Vendor product: GPT-SoVITS

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109379Published

Cockpit CMS 2.14.1 Account Enumeration via Timing Discrepancy in /auth/check

cve-program ·

Vendor product: cockpit

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109559Published

EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

cve-program ·

Vendor product: EdgeEver

CVSS 4.0 8.4 · CVSS 3.1 8.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107805Published

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108106Published

Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

cve-program ·

Vendor product: snappy-java

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108101Published

HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

cve-program ·

Vendor product: hortusfox-web

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-78025Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerabili…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-78015Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to In…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 3.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109569Published

sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace

cve-program ·

Vendor product: sandboxed.sh

CVSS 4.0 9.3 · CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2023-54408Published

Frappe before 14.31.0 HTML Injection via Weak Escaping

cve-program ·

Vendor product: frappe

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2024-58390Published

Frappe before 15.41.0 Privilege Escalation via Document Action

cve-program ·

Vendor product: frappe

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109597Published

Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs

cve-program ·

Vendor product: hugo

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109602Published

Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters

cve-program ·

Vendor product: frappe

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109610Published

Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109615Published

Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109623Published

Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization

cve-program ·

Vendor product: erpnext

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109628Published

Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109633Published

Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page

cve-program ·

Vendor product: erpnext

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.