Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695766 source statements · aliases may refer to the same vulnerability

CVE-2026-107865Published

WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-menu

CVSS 3.1 6.5Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-107864Published

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ad-inserter

CVSS 3.1 6.5Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2025-15703Published

WP Job Openings < 4.0.0 - Admin+ Stored XSS

cve-program ·

Vendor product: HireZoot

Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-84166Published

Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF

cve-program ·

Vendor product: Hotel Booking

Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-84167Published

Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR

cve-program ·

Vendor product: Hotel Booking

Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-107791Published

WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment

cve-program ·

Vendor product: WP Comment Cleaner

Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2025-3456Published

On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c

cve-program ·

Vendor product: EOS

CVSS 3.1 3.8Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-108979Rejected

REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

cve-program ·

Source modified 12 Oct 2026Recorded 23 Oct 2026

RUSTSEC-2026-0336Published

MIKEY message MAC is never verified on receive, so forged messages are accepted

osv · GHSA-xq78-wvcv-hqvj

crates.io: mykey

Source modified 12 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0335Published

Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key

osv · GHSA-fwjg-cm92-j3hj

crates.io: mykey

Source modified 12 Oct 2026Recorded 24 Oct 2026

CVE-2025-10162Published

OrderConvo <= 15.1 - Unauthenticated Arbitrary File Read

cve-program ·

https://wordpress.org/plugins: Admin and Customer Messages After Order for WooCommerce: OrderConvo

CVSS 3.1 8.6Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-104710Rejected

Duplicate of CVE-2026-71364, which was publicly disclosed and fixed in Red Hat Ansible Automation Platform on 2026-08-24. No separate identifier is required.

cve-program ·

Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-15581Published

Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

cve-program ·

https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel9

CVSS 3.1 8.0Source modified 12 Oct 2026Recorded 23 Oct 2026

CVE-2026-94503Published

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

cve-program ·

https://wordpress.org/plugins: zombify

CVSS 3.1 10.0Source modified 12 Oct 2026Recorded 23 Oct 2026

MAL-2026-17690Published

Malicious code in @galicia-toolkit/spa-build-config (npm)

osv · GHSA-7hx2-c7qp-ggjp

npm: @galicia-toolkit/spa-build-config

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17689Published

Malicious code in @galicia-toolkit/error-master (npm)

osv · GHSA-42vv-c8c8-q765

npm: @galicia-toolkit/error-master

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17744Published

Malicious code in kmf-vendor-pack (npm)

osv ·

npm: kmf-vendor-pack

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17691Published

Malicious code in @galicia-toolkit/tag-manager (npm)

osv · GHSA-q3gj-mpgg-cqpv

npm: @galicia-toolkit/tag-manager

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17723Published

Malicious code in @galicia-toolkit-nestjs/paas (npm)

osv ·

npm: @galicia-toolkit-nestjs/paas

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17714Published

Malicious code in @brick-v2/brand (npm)

osv ·

npm: @brick-v2/brand

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17724Published

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

osv ·

npm: @galicia-toolkit-nestjs/swagger

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17715Published

Malicious code in @brick-v2/core (npm)

osv ·

npm: @brick-v2/core

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17726Published

Malicious code in @galicia-toolkit-nestjs-20/commons (npm)

osv ·

npm: @galicia-toolkit-nestjs-20/commons

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17717Published

Malicious code in @brick-v2/icons (npm)

osv ·

npm: @brick-v2/icons

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17720Published

Malicious code in @galicia-toolkit-cheques-nc/front (npm)

osv ·

npm: @galicia-toolkit-cheques-nc/front

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17728Published

Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

osv ·

npm: @galicia-toolkit-nestjs-20-lite/archetype

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17719Published

Malicious code in @brick-v2/tour (npm)

osv ·

npm: @brick-v2/tour

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17727Published

Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

osv ·

npm: @galicia-toolkit-nestjs-20/paas

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17725Published

Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)

osv ·

npm: @galicia-toolkit-nestjs-20/archetype

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17716Published

Malicious code in @brick-v2/form (npm)

osv ·

npm: @brick-v2/form

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17722Published

Malicious code in @galicia-toolkit-nestjs/commons (npm)

osv ·

npm: @galicia-toolkit-nestjs/commons

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17721Published

Malicious code in @galicia-toolkit-nestjs/archetype (npm)

osv ·

npm: @galicia-toolkit-nestjs/archetype

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17730Published

Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

osv ·

npm: @galicia-toolkit-nestjs-20-lite/paas

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17718Published

Malicious code in @brick-v2/table (npm)

osv ·

npm: @brick-v2/table

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17729Published

Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm)

osv ·

npm: @galicia-toolkit-nestjs-20-lite/commons

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17660Published

Malicious code in hardhat-option (npm)

osv ·

npm: hardhat-option

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17668Published

Malicious code in @dransay/address-validation (npm)

osv ·

npm: @dransay/address-validation

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17698Published

Malicious code in @dransay/phone-fix-test (npm)

osv ·

npm: @dransay/phone-fix-test

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17697Published

Malicious code in @dransay/logger (npm)

osv ·

npm: @dransay/logger

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17699Published

Malicious code in @dransay/secrets (npm)

osv ·

npm: @dransay/secrets

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17695Published

Malicious code in @dransay/db (npm)

osv ·

npm: @dransay/db

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17700Published

Malicious code in dransay (npm)

osv ·

npm: dransay

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17804Published

Malicious code in css-nesting-transform (npm)

osv ·

npm: css-nesting-transform

Source modified 12 Oct 2026Recorded 24 Oct 2026

MAL-2026-17696Published

Malicious code in @dransay/feature-flags (npm)

osv ·

npm: @dransay/feature-flags

Source modified 12 Oct 2026Recorded 24 Oct 2026

CVE-2026-104703Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2025-59430Published

Mesh Connect JS SDK contains JS libraries for integrating with Mesh Connect. Prior to version 3.3.2, the lack of sanitization of URLs protocols in the createLink.openLink function enables the execution of arbitrary JavaScript code within th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 11 Oct 2026Recorded 25 Oct 2026

CVE-2026-107352Published

Missing authorization checks in Amazon Athena engine version 3 request handling

cve-program ·

Vendor product: Amazon Athena

CVSS 3.1 7.7 · CVSS 4.0 6.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2025-47910Published

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a di…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 5.4Source modified 11 Oct 2026Recorded 25 Oct 2026

CVE-2025-58186Published

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 5.3Source modified 11 Oct 2026Recorded 25 Oct 2026

CVE-2025-59426Published

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host header…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 11 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.