Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695749 source statements · aliases may refer to the same vulnerability

CVE-2026-108903Published

pH7Builder before 19.3.0 CAPTCHA Bypass via Client-Chosen Form ID

cve-program ·

Vendor product: ph7builder

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108881Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109573Published

phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109955Published

Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding

cve-program ·

Vendor product: hono

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108876Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109960Published

Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value

cve-program ·

Vendor product: froxlor

CVSS 4.0 8.7 · CVSS 3.1 7.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-17189Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-105052Published

IBM Maximo Application Suite Information Disclosure

cve-program ·

Vendor product: Maximo Application Suite

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-75881Published

IBM Maximo Application Suite - IoT Component Denial of Service

cve-program ·

Vendor product: Maximo Application Suite - IoT Component

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-19627Published

IBM Planning Analytics Local is affected by security vulnerabilities

cve-program ·

Vendor product: Planning Analytics

CVSS 3.1 8.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-75063Published

IBM Planning Analytics Local is affected by security vulnerabilities

cve-program ·

Vendor product: Planning Analytics

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-18541Published

IBM Planning Analytics Local is affected by security vulnerabilities

cve-program ·

Vendor product: Planning Analytics

CVSS 3.1 6.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-75621Published

IBM Aspera Enterprise Webapps Execution with Unnecessary Privileges

cve-program ·

Vendor product: Aspera Enterprise WebApps

CVSS 3.1 6.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-81858Published

IBM i is Affected By A Denial of Service Vulnerability in Host Servers

cve-program ·

Vendor product: i

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-18343Published

IBM i is Affected By An Improper Privilege Management Vulnerability

cve-program ·

Vendor product: i

CVSS 3.1 4.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-18318Published

IBM i Information Disclosure

cve-program ·

Vendor product: i

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-17487Published

IBM i is Information Disclosure

cve-program ·

Vendor product: i

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-17484Published

IBM i is Information Disclosure

cve-program ·

Vendor product: i

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108871Published

JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109950Published

FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108866Published

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths

cve-program ·

Vendor product: JeecgBoot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-90912Published

Maximo AI Service Denial of Service

cve-program ·

Vendor product: Maximo AI Service

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108683Published

zhayujie CowAgent Media Download memory allocation

cve-program ·

Vendor product: CowAgent

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-54459Published

FileRise: Missing CSRF enforcement for file creation and share-link creation

cve-program ·

Vendor product: FileRise

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108934Published

Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting

cve-program ·

Vendor product: BR-6208AC

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108861Published

Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

cve-program ·

Vendor product: Odoo MCP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109664Published

Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification

cve-program ·

Vendor product: erpnext

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109669Published

Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification

cve-program ·

Vendor product: erpnext

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109674Published

Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109659Published

Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109654Published

Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints

cve-program ·

Vendor product: erpnext

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108856Published

UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting

cve-program ·

Vendor product: Wanwu

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109649Published

Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109644Published

Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109639Published

Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108851Published

phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109634Published

Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints

cve-program ·

Vendor product: erpnext

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109629Published

Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint

cve-program ·

Vendor product: erpnext

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108697Published

CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction

cve-program ·

Vendor product: CoreShop

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109624Published

Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109616Published

Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification

cve-program ·

Vendor product: erpnext

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108578Published

Neterbit NW-431F Embedded Web Server sms.json information disclosure

cve-program ·

Vendor product: NW-431F

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109611Published

Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints

cve-program ·

Vendor product: erpnext

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109603Published

Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit

cve-program ·

Vendor product: frappe

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109598Published

Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

cve-program ·

Vendor product: frappe

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2024-58391Published

Frappe before 15.4.0 XSS via Printview Parameters

cve-program ·

Vendor product: frappe

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108751Published

MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer

cve-program ·

Vendor product: moai-adk

CVSS 4.0 4.8 · CVSS 3.1 4.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2023-54409Published

Frappe before 13.46.1 XSS via html2text Weak Sanitization

cve-program ·

Vendor product: frappe

CVSS 4.0 5.9 · CVSS 3.1 4.8Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-75061Published

IBM Planning Analytics Local is affected by security vulnerabilities

cve-program ·

Vendor product: Planning Analytics

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108746Published

Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources

cve-program ·

Vendor product: vearch

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.