Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695782 source statements · aliases may refer to the same vulnerability

GHSA-c42q-qvc3-j6vgPublished

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

osv · CVE-2026-108260

npm: @tinacms/web-components

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-102916Published

Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host

cve-program ·

https://illumos.org: system/bhyve · Vendor product: OmniOS

CVSS 4.0 6.8Source modified 9 Oct 2026Recorded 23 Oct 2026

GHSA-vcgv-7rvm-m3vpWithdrawn

Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API

osv ·

Go: code.vikunja.io/api

MODERATESource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-p4h8-xg7f-xqrcWithdrawn

Duplicate Advisory: Vikunja: Denial of service via decompression bomb in the data import

osv ·

Go: github.com/go-vikunja/vikunja

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-phph-c358-5mwmWithdrawn

Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

osv ·

Go: code.vikunja.io/api

MODERATESource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-p2vv-wrh8-x466Withdrawn

Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-jmr8-r558-3jhxWithdrawn

Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth

osv ·

Go: code.vikunja.io/api

MODERATESource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-m4vj-wr5q-cmvrWithdrawn

Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

osv ·

Go: github.com/go-vikunja/vikunja

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-jfw3-2gcf-23r5Withdrawn

Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-ccgq-fx7h-2v4cWithdrawn

Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

osv ·

Go: code.vikunja.io/api

MODERATESource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-c2g7-39fr-cp8qWithdrawn

Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-69rj-q3v9-vffpWithdrawn

Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-37rx-7pj5-p885Withdrawn

Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-2922-qgfj-pr7vWithdrawn

Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

osv ·

Go: code.vikunja.io/api

MODERATESource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-55p4-8j34-jv53Withdrawn

Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-p4r4-8cxw-pjx7Withdrawn

Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

osv ·

Go: code.vikunja.io/api

CRITICALSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-9xwc-vwww-qqmwWithdrawn

Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

GHSA-9jrx-vmh8-c6xwWithdrawn

Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

osv ·

Go: code.vikunja.io/api

HIGHSource modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-79363Published

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored va…

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-75346Published

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-75351Published

OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17751Published

Malicious code in cloud-baileys (npm)

osv · GHSA-745p-g872-6x8c

npm: cloud-baileys

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17387Published

Malicious code in arsya-baileys (npm)

osv · GHSA-pv3g-8jvf-qc7x

npm: arsya-baileys

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17750Published

Malicious code in @fer2809fl/baileys (npm)

osv · GHSA-wv7g-r3r9-ww8v

npm: @fer2809fl/baileys

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-107885Published

OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-…

cve-program ·

Vendor product: CUPS

CVSS 3.1 3.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-62049Published

WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-blocks

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-96461Published

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ameliabooking

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-96327Published

WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wplms_plugin

CVSS 3.1 9.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94568Published

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woo-vipps

CVSS 3.1 7.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-95599Published

WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: taskbuilder

CVSS 3.1 8.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-96671Published

WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: featured-image-from-url

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94166Published

WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: us-core

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-95589Published

WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: advanced-partial-payment-or-deposit-for-woocommerce

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-96332Published

WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: simple-payment

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94664Published

WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

cve-program ·

https://wordpress.org/plugins: pdf-for-contact-form-7

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-104392Published

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: quiz-master-next

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94067Published

WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability

cve-program ·

https://themeforest.net: thevoux-wp

CVSS 3.1 8.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105883Published

WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: th-shop-mania

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-62042Published

WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: scripts-n-styles

CVSS 3.1 5.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94058Published

WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

cve-program ·

https://themeforest.net: treck

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-62026Published

WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: dashboard-notes

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105697Published

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

cve-program ·

Vendor product: langflow · Vendor product: langflow-base · Vendor product: lfx

CVSS 3.1 9.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107845Published

Contao: Cross-site scripting in the comments bundle

cve-program ·

Vendor product: contao

CVSS 3.1 9.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2025-8457Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2016-20098Published

Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration

cve-program ·

Vendor product: reddit-moderator-toolbox

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-108160Published

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

cve-program ·

Vendor product: astron-rpa

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-104758Rejected

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-73364. Reason: This candidate is a reservation duplicate of CVE-2026-73364. Notes: All CVE users should reference CVE-2026-73364 instead of this candidate. All references a…

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107840Published

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

cve-program ·

Vendor product: yopass

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107384Published

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2013-4590Published

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or *…

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.