Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695813 source statements · aliases may refer to the same vulnerability

CVE-2026-107719Published

fast-jwt: Verifier cache accepts expired JWTs without iat.

cve-program ·

Vendor product: fast-jwt

CVSS 3.1 4.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2024-26507Published

An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to escalate privileges via the DeviceIoControl call associated with MmMapIoSpace, IoAllocateMdl, MmBuildMd…

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107729Published

SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI parsing causes out-of-bounds read

cve-program ·

Vendor product: sumatrapdf

CVSS 3.1 5.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107734Published

SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

cve-program ·

Vendor product: sumatrapdf

CVSS 4.0 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-6857Published

Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization

cve-program ·

https://github.com/apache/camel: camel-infinispan · https://access.redhat.com/downloads/content/package-browser/: camel-infinispan · https://access.redhat.com/downloads/content/package-browser/: camel-infinispan

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-87742Published

Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

cve-program ·

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: quarkus-websockets-next · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: quarkus-websockets-next · https://access.redhat.com/downloads/content/package-browser/: exploit-intelligence/agent-client-rhel9

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-57967Published

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-server · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-server

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-56857Published

Root.Mkdir(All) can follow junctions out of the root on Windows in os

cve-program ·

https://pkg.go.dev: os · https://pkg.go.dev: internal/syscall/windows

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2024-3656Published

Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

cve-program ·

https://github.com/keycloak/keycloak: keycloak · https://access.redhat.com/downloads/content/package-browser/: Red Hat Build of Keycloak · https://access.redhat.com/downloads/content/package-browser/: Red Hat Single Sign-On 7

CVSS 3.1 8.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-78659Published

HTTP/2 server memory exhaustion due to Trailer headers in net/http

cve-program ·

https://pkg.go.dev: net/http · https://pkg.go.dev: net/http/internal/http2 · https://pkg.go.dev: golang.org/x/net/http2

Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17731Published

Malicious code in @aseppxyzz12/baileys (npm)

osv · GHSA-4pw9-3c22-g559

npm: @aseppxyzz12/baileys

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17667Published

Malicious code in tailwind-animatecss-uniform (npm)

osv · GHSA-hxvr-77vv-6r85

npm: tailwind-animatecss-uniform

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-16415Published

Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

osv · GHSA-gj3c-r86r-hr43

npm: @tvg-mar/tvg-promos-atomic-ui

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-16414Published

Malicious code in @tvg-mar/storyblok-bridge (npm)

osv · GHSA-3wxx-x983-53mg

npm: @tvg-mar/storyblok-bridge

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-16484Published

Malicious code in pino-testkit (npm)

osv · GHSA-9q39-547h-rfpc

npm: pino-testkit

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17743Published

Malicious code in tailwind-animatecss-form (npm)

osv · GHSA-pp69-57rc-3v49

npm: tailwind-animatecss-form

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-16412Published

Malicious code in @tvg-mar/promos-context (npm)

osv · GHSA-f42w-v662-25cr

npm: @tvg-mar/promos-context

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-16413Published

Malicious code in @tvg-mar/promos-gtm (npm)

osv · GHSA-8g69-976g-h44g

npm: @tvg-mar/promos-gtm

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17734Published

Malicious code in asepxyz-eslint-config (npm)

osv · GHSA-rhjp-rpj7-8x4q

npm: asepxyz-eslint-config

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17735Published

Malicious code in asepxyz-signal (npm)

osv · GHSA-38rx-c4rh-xc4p

npm: asepxyz-signal

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-16416Published

Malicious code in @tvg-mar/utils (npm)

osv · GHSA-p6w4-mmhj-wc4v

npm: @tvg-mar/utils

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17732Published

Malicious code in asepxyz (npm)

osv · GHSA-qvwh-x99q-h49x

npm: asepxyz

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17733Published

Malicious code in asepxyz-baileys (npm)

osv · GHSA-xv7g-p6pq-vg9q

npm: asepxyz-baileys

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17742Published

Malicious code in razamodsxasepxyz (npm)

osv · GHSA-f3vq-wx4x-jv6w

npm: razamodsxasepxyz

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17741Published

Malicious code in pahinuy (npm)

osv · GHSA-hcwg-cqc9-469q

npm: pahinuy

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17740Published

Malicious code in hanncap (npm)

osv · GHSA-jw9f-6xx8-mj3f

npm: hanncap

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17737Published

Malicious code in asepxyznew (npm)

osv · GHSA-m23r-8cxr-4gw3

npm: asepxyznew

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17738Published

Malicious code in asepxyzxrazamodsnew-baileys (npm)

osv · GHSA-v95p-rhxh-mm8g

npm: asepxyzxrazamodsnew-baileys

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17736Published

Malicious code in asepxyz12 (npm)

osv · GHSA-3rxj-r3x6-3992

npm: asepxyz12

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17739Published

Malicious code in asepxyzz (npm)

osv · GHSA-hmqh-m5mj-f7mm

npm: asepxyzz

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-97332Published

User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)

cve-program ·

Vendor product: User Private Files

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107735Published

SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)

cve-program ·

Vendor product: sumatrapdf

CVSS 4.0 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105673Published

Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB

cve-program ·

Vendor product: Tapo C325WB v2

CVSS 4.0 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107720Published

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-107290Published

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107294Published

Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105436Published

WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability

cve-program ·

https://wordpress.org/plugins: mainwp-child

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107299Published

msgpack5: Reserved byte can cause unbounded stream buffering

cve-program ·

Vendor product: msgpack5

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107375Published

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

cve-program ·

Vendor product: generator-jhipster

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107380Published

enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision

cve-program ·

Vendor product: svg-sanitizer

CVSS 3.1 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107386Published

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

cve-program ·

Vendor product: amqp091-go

CVSS 4.0 6.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-84271Published

IBM Guardium Data Protection Signature Verification Bypass

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107391Published

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

cve-program ·

Vendor product: music-metadata

CVSS 3.1 6.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107396Published

Indico: Cross-Site-Scripting in link fields

cve-program ·

Vendor product: indico

CVSS 3.1 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-19878Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107716Published

Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

cve-program ·

Vendor product: banks

CVSS 4.0 7.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107721Published

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

cve-program ·

Vendor product: fast-jwt

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107726Published

Hazelcast: Arbitrary member memory access by low-privileged client

cve-program ·

Vendor product: hazelcast

CVSS 4.0 9.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107731Published

SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

cve-program ·

Vendor product: sumatrapdf

CVSS 3.1 5.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107736Published

SumatraPDF: stack buffer overflow while processing EXIF Orientation metadata

cve-program ·

Vendor product: sumatrapdf

CVSS 4.0 6.8Source modified 9 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.