Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695813 source statements · aliases may refer to the same vulnerability

CVE-2026-105269Published

Satel Netco Design Cross-site Scripting

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 8.5 · CVSS 3.1 6.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-84032Published

IBM Guardium Data Protection is affected by multiple vulnerabilities

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 5.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2023-22894Published

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API…

nvd ·

CVSS 3.1 · [email protected] · Primary 4.9 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.2Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-103065Published

WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

cve-program ·

https://wordpress.org/plugins: kirki

CVSS 3.1 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107704Published

image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

cve-program ·

https://rubygems.org/gems/image_optimizer: image_optimizer

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107781Published

Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

cve-program ·

https://github.com/dromara/skyeye: skyeye

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107831Published

Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-46569Published

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is trig…

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106216Published

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium…

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2022-2946Published

Use After Free in vim/vim

cve-program ·

Vendor product: vim/vim

CVSS 3.0 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2022-2849Published

Heap-based Buffer Overflow in vim/vim

cve-program ·

Vendor product: vim/vim

CVSS 3.0 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2022-2845Published

Improper Validation of Specified Quantity in Input in vim/vim

cve-program ·

Vendor product: vim/vim

CVSS 3.1 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-100833Published

Contrast before 1.23.1 Image Substitution via Policy Generation

cve-program ·

Vendor product: contrast

CVSS 4.0 8.6 · CVSS 3.1 9.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107715Published

Mechanize sends credential headers to another host after an HTTP redirect

cve-program ·

Vendor product: mechanize

CVSS 3.1 6.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-104628Published

Satel Netco Design Inefficient Regular Expression Complexity

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105275Published

Satel Netco Design Relative Path Traversal

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-11318Published

Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

cve-program ·

Vendor product: DeskIn

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-101024Published

Satel Netco Design Relative path traversal

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105827Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105826Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105825Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105824Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105823Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105405Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105404Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105403Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105402Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105401Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105400Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105399Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105398Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

GHSA-q58r-hwc8-rm9jPublished

Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

osv · CVE-2025-1647

npm: bootstrap

MODERATESource modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-102783Published

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0

cve-program ·

Vendor product: com_gridbox

CVSS 4.0 6.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-73336Published

Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 5.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-102784Published

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

cve-program ·

Vendor product: com_gridbox

CVSS 4.0 8.7Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17713Published

Malicious code in sharpnes (crates.io)

osv ·

crates.io: sharpnes

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-107385Published

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the se…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-107303Published

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-cont…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.6Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-107298Published

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers tha…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-104076Published

TVU Networks Receiver/Transceiver Missing Authentication via REST API

cve-program ·

Vendor product: TVU Receiver / Transceiver

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-19498Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-102368Published

Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware

cve-program ·

Vendor product: Tapo S505 v1.6

CVSS 4.0 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107318Published

@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

cve-program ·

Vendor product: @fastify/reply-from

CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107778Published

MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

cve-program ·

https://github.com/krb5/krb5: krb5

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106435Published

Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

cve-program ·

Vendor product: Python Driver

CVSS 4.0 5.9 · CVSS 3.1 5.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107395Published

Indico: Missing access check in legacy session export API

cve-program ·

Vendor product: indico

CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107390Published

music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length

cve-program ·

Vendor product: music-metadata

CVSS 3.1 6.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107385Published

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

cve-program ·

Vendor product: mariadb-connector-nodejs

CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107700Published

dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument

cve-program ·

https://www.npmjs.com/package/dot-access: dot-access

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107379Published

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

cve-program ·

Vendor product: svg-sanitizer

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.