Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695749 source statements · aliases may refer to the same vulnerability

CVE-2026-108807Published

krupalshah EmployeeRecruitmentSystem Registration adminregister.php mysql_query sql injection

cve-program ·

Vendor product: EmployeeRecruitmentSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106500Published

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated us…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-106501Published

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-106502Published

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure condit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-106503Published

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107193Published

Foreman: api filter lookup ignores a search-limited filter permission

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: foreman

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107387Published

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-item size and allocates a Uint8Array for a binary item before proving that the declared item fits in th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-49243Published

Webmin: Reflected XSS in the Configuration module

cve-program ·

Vendor product: webmin

CVSS 3.1 9.6Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84360Published

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-108799Published

jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

cve-program ·

Vendor product: XCMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-65110Published

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability might lead to code execution, escala…

cve-program ·

Vendor product: Megatron-LM

CVSS 3.1 7.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-65104Published

NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker could cause hash collisions in the cache used for inference requests. A successful exploit of this vulnerability might lead to data tampering and …

cve-program ·

Vendor product: Megatron-LM

CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-65180Published

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation …

cve-program ·

Vendor product: Megatron-LM

CVSS 3.1 7.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-103499Published

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service

cve-program ·

Vendor product: WebSphere Application Server - Liberty · Vendor product: WebSphere Application Server

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-106510Published

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user w…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-106558Published

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker w…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107211Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivot…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-108985Published

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

cve-program ·

Vendor product: libnfs

CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107212Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107213Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exist…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107214Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, inde…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107215Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chai…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107216Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassin…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107217Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107218Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107219Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifie…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107220Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached rectangle empty for an empty mergeCell ref and then passes that empty slice to cellInRange with…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-108789Published

deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow

cve-program ·

Vendor product: deepseek-harness

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107221Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit colu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-108785Published

macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expiration

cve-program ·

Vendor product: mall

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107222Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes required child slices or dereferences an optional colorScale child without validating malfor…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107223Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column ranges without validating Min and Max against the worksheet column limit. SetColWidth reaches …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-108781Published

erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109955Published

Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip prefix middleware by exploiting double path decoding. Attackers can send malformed percent-encoded paths…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-107224Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high bit set is converted from uint64 to a negative int64 before signed size-limit checks and a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-109570Published

Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection

cve-program ·

Vendor product: BSW013

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108775Published

erzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection

cve-program ·

Vendor product: JEEWMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-84360Published

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

RUSTSEC-2026-0345Published

Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences

osv · GHSA-3c48-9r95-hqhr

crates.io: kuva

Source modified 13 Oct 2026Recorded 24 Oct 2026

CVE-2026-53922Published

odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)

cve-program ·

Vendor product: odhcpd · Vendor product: openwrt

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108886Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109409Published

HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection

cve-program ·

Vendor product: Toonflow-app

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108756Published

Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes

cve-program ·

Vendor product: trinity

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109678Published

FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-22314Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority based on the reported functionality projecting intended administrative

cve-program ·

Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108770Published

Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery

cve-program ·

Vendor product: Appwrite

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109940Published

FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 5.1 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108963Published

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to…

cve-program ·

Vendor product: databasement

CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109945Published

FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108903Published

pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID

cve-program ·

Vendor product: ph7builder

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.