Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695741 source statements · aliases may refer to the same vulnerability

CVE-2026-103965Published

Fixed values in MongoDB Server $bucket stage may be misread as field references

cve-program ·

Vendor product: MongoDB Server

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-49265Published

OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

cve-program ·

Vendor product: oauthlib

CVSS 3.1 6.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109353Published

LibreNMS before 26.9.0 SQL Injection via notification_id in notifications.inc.php

cve-program ·

Vendor product: librenms

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84321Published

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-84315Published

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.3Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-77375Published

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affect…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107717Published

Banks: User-controlled prompt input can be parsed as privileged chat messages

cve-program ·

Vendor product: banks

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109348Published

Gitoxide gix-mailmap before 0.35.0 CPU Denial of Service via .mailmap Parsing

cve-program ·

Vendor product: gix-mailmap

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107397Published

Indico: Cross-Site-Scripting in minutes editor

cve-program ·

Vendor product: indico

CVSS 3.1 4.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107780Published

Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter

cve-program ·

https://github.com/dromara/skyeye: skyeye

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109343Published

SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement

cve-program ·

Vendor product: surrealdb

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107792Published

Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107799Published

Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-55695Published

FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater

cve-program ·

Vendor product: FearlessCMS

CVSS 3.1 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109338Published

SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values

cve-program ·

Vendor product: surrealdb

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107830Published

Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS Endpoint

cve-program ·

Vendor product: jivejdon

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-83535Published

Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: rhoso-operators/openstack-network-exporter-rhel9

CVSS 3.1 7.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-90460Published

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or dele…

cve-program ·

Vendor product: Keystone

CVSS 4.0 7.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-102832Published

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

cve-program ·

Vendor product: jupyterlab · Vendor product: jupyterlite-core · Vendor product: notebook

CVSS 3.1 4.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109333Published

SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH

cve-program ·

Vendor product: surrealdb

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-103928Published

Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

cve-program ·

Vendor product: metabase

CVSS 4.0 9.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-54697Published

ConnectBot SSH: Excessive allocation and integer overflow in DER private-key parsing

cve-program ·

Vendor product: cbssh

CVSS 4.0 6.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109328Published

Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name

cve-program ·

Vendor product: admidio

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108909Published

Netcore NR268 CGI Endpoint cross-site request forgery

cve-program ·

Vendor product: NR268

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108917Published

Edimax BR-6208AC formAutoFWupgrade command injection

cve-program ·

Vendor product: BR-6208AC

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-77363Published

obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

cve-program ·

Vendor product: obsidian-tc

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108921Published

KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication

cve-program ·

Vendor product: Learning-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-102663Published

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

cve-program ·

Vendor product: OpenList

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107854Published

Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

cve-program ·

Vendor product: Jexactyl

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-65954Published

PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

cve-program ·

Vendor product: PHPCSUtils

CVSS 3.1 8.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109303Published

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109575Published

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS…

cve-program ·

Vendor product: dataplaneapi · Vendor product: dataplaneapi-ee

CVSS 3.1 9.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108926Published

itsourcecode Baptism Information Management System ebaptism.php sql injection

cve-program ·

Vendor product: Baptism Information Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-104774Published

OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

cve-program ·

Vendor product: coraza

CVSS 3.1 5.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84315Published

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 8.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109248Published

FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109426Published

Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string

cve-program ·

Vendor product: Telegram-Stremio

CVSS 4.0 8.2 · CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108930Published

Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure

cve-program ·

Vendor product: NR268

CVSS 4.0 5.1 · CVSS 3.1 2.7 · CVSS 3.0 2.7 · CVSS 2.0 3.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108267Published

Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

cve-program ·

Vendor product: go

CVSS 4.0 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109323Published

Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

cve-program ·

Vendor product: grav-plugin-star-ratings

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84321Published

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-57143Published

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

cve-program ·

Vendor product: praisonaiagents

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-105458Published

Reliance on Untrusted Inputs in a Security Decision in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-104661Published

Incorrect Privilege Assignment in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-58771Published

UEFI OOB Write and Buffer Overflow Vulnerabilities

cve-program ·

Vendor product: AptioV

CVSS 4.0 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-58772Published

UEFI OOB Write and Buffer Overflow Vulnerabilities

cve-program ·

Vendor product: AptioV

CVSS 4.0 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2025-58773Published

UEFI OOB Write and Buffer Overflow Vulnerabilities

cve-program ·

Vendor product: AptioV

CVSS 4.0 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-0893Published

Uncleared Password Keystrokes Vulnerability

cve-program ·

Vendor product: AptioV

CVSS 4.0 5.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-4869Published

Potential Privilege Escalation in InstallShield

cve-program ·

Vendor product: InstallShield

CVSS 4.0 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-12656Published

1732E ArmorBlock® - Multiple Vulnerabilities

cve-program ·

Vendor product: 1732E ArmorBlock® I/O

CVSS 4.0 8.7Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.