Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695782 source statements · aliases may refer to the same vulnerability

CVE-2026-62128Published

WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: creatorlms

CVSS 3.1 5.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-14521Published

IBM DataPower Gateway affected by server-side request forgery

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 4.9Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-105079Published

WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: masterstudy-lms-learning-management-system

CVSS 3.1 6.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-105891Published

WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: event-tickets

CVSS 3.1 4.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-17609Published

Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter

cve-program ·

Vendor product: Super Forms – Drag & Drop Form Builder

CVSS 3.1 9.1Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107448Published

Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.Op…

cve-program ·

Vendor product: Magic: The Gathering Arena

CVSS 3.1 3.4Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-95116Published

An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.

cve-program ·

Vendor product: n/a

Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-17538Published

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

cve-program ·

Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVSS 3.1 5.4Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107282Published

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

cve-program ·

Vendor product: async-http-client

CVSS 4.0 9.4Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107231Published

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

cve-program ·

Vendor product: async-http-client

CVSS 4.0 8.7Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-76279Published

Improper Input Validation of Index Names through the collect Command in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 4.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-76274Published

Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 6.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-76269Published

Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 6.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-76264Published

Improper Authorization through the REST API in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 4.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107225Published

Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml

cve-program ·

Vendor product: excelize

CVSS 3.1 6.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107220Published

Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref

cve-program ·

Vendor product: excelize

CVSS 3.1 6.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107215Published

Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS

cve-program ·

Vendor product: excelize

CVSS 3.1 7.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-101886Published

Cisco Jabber for Android Path Traversal via Shared Content URI

cve-program ·

Vendor product: Jabber for Android

CVSS 4.0 5.1 · CVSS 3.1 4.0Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-62253Published

Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

cve-program ·

Vendor product: homer

CVSS 3.1 9.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107210Published

ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-106578Published

ImageMagick: Invalid Memory Free in MVG decoder

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.9Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107269Published

Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

cve-program ·

Vendor product: gophish

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-106573Published

ImageMagick: Denial of service in MVG decoder

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-106568Published

ImageMagick: Infinite Loop when reading a crafted XMP profile

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-106563Published

Backstage: Improper entity validation in deprecated Kubernetes services endpoint

cve-program ·

Vendor product: backstage · Vendor product: plugin-kubernetes-backend

CVSS 3.1 5.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-106558Published

Backstage: Improper validation of TechDocs MkDocs configuration

cve-program ·

Vendor product: backstage · Vendor product: plugin-techdocs-node

CVSS 3.1 8.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-46437Published

wger: API credentials remain valid after logout/password change

cve-program ·

Vendor product: wger

CVSS 3.1 4.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107162Published

Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation Bypass

cve-program ·

Vendor product: express-gateway

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107151Published

Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: rubygem-smart_proxy_dynflow

CVSS 3.1 5.9Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-106059Published

GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript

cve-program ·

Vendor product: gitahead

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-107570Published

Use of Out-of-range Pointer Offset in mutt

cve-program ·

Vendor product: mutt

CVSS 3.1 2.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-103755Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-18524Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-16681Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106286Published

Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106365Published

Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106267Published

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106381Published

Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106266Published

Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security se…

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106287Published

Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106297Published

Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106362Published

Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106237Published

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106331Published

Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security se…

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106418Published

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106195Published

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106385Published

Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106294Published

Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

GHSA-x34j-47hf-4xg7Published

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

osv · CVE-2026-108261

npm: tinacms · npm: @tinacms/app

CRITICALSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-pwhx-cvv3-qj5cPublished

Tina: Code injection via unescaped Git branch name in generated client source

osv · CVE-2026-108259

npm: @tinacms/cli

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.