Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695826 source statements · aliases may refer to the same vulnerability

CVE-2026-105400Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105399Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105398Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

GHSA-q58r-hwc8-rm9jPublished

Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components

osv · CVE-2025-1647

npm: bootstrap

MODERATESource modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-102783Published

Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0

cve-program ·

Vendor product: com_gridbox

CVSS 4.0 6.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-73336Published

Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 5.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-102784Published

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0

cve-program ·

Vendor product: com_gridbox

CVSS 4.0 8.7Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17713Published

Malicious code in sharpnes (crates.io)

osv ·

crates.io: sharpnes

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-107385Published

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the se…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-107303Published

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-cont…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.6Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-107298Published

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the array and map decoding paths have no nesting-depth limit, allowing an attacker who can provide MessagePack input to submit deeply nested containers tha…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-104076Published

TVU Networks Receiver/Transceiver Missing Authentication via REST API

cve-program ·

Vendor product: TVU Receiver / Transceiver

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-19498Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-102368Published

Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware

cve-program ·

Vendor product: Tapo S505 v1.6

CVSS 4.0 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107318Published

@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

cve-program ·

Vendor product: @fastify/reply-from

CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107778Published

MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()

cve-program ·

https://github.com/krb5/krb5: krb5

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106435Published

Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

cve-program ·

Vendor product: Python Driver

CVSS 4.0 5.9 · CVSS 3.1 5.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107395Published

Indico: Missing access check in legacy session export API

cve-program ·

Vendor product: indico

CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107390Published

music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length

cve-program ·

Vendor product: music-metadata

CVSS 3.1 6.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107385Published

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

cve-program ·

Vendor product: mariadb-connector-nodejs

CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107700Published

dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument

cve-program ·

https://www.npmjs.com/package/dot-access: dot-access

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107379Published

enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash

cve-program ·

Vendor product: svg-sanitizer

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-93860Published

In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, …

cve-program ·

Vendor product: Mistral

CVSS 4.0 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107696Published

FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107303Published

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

cve-program ·

Vendor product: generator-jhipster · Vendor product: react-jhipster

CVSS 3.1 7.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107298Published

msgpack5: Deeply nested input can exhaust the decoder stack

cve-program ·

Vendor product: msgpack5

CVSS 3.1 5.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-39717Published

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: learnpress

CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-39725Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-1829.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2025-60201Published

WordPress WP Customer Area plugin <= 8.3.5 - Local File Inclusion vulnerability

cve-program ·

https://wordpress.org/plugins: customer-area

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2025-1647Published

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.

nvd ·

CVSS 3.1 · 36c7be3b-2937-45df-85ea-ca7133ea542c · Secondary 5.6Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-11060Published

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subs…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.7Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-11285Published

A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command injection…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 8.8 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-11287Published

A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Secondary 7.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-11842Published

A security vulnerability has been detected in Shazwazza Smidge up to 4.5.1. The impacted element is an unknown function of the component Bundle Handler. The manipulation of the argument Version leads to path traversal. Remote exploitation o…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-29192Published

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-50538Published

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-54539Published

A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.8Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-59845Published

Apollo Studio Embeddable Explorer & Embeddable Sandbox are website embeddable software solutions from Apollo GraphQL. Prior to Apollo Sandbox version 2.7.2 and Apollo Explorer version 3.7.3, a cross-site request forgery (CSRF) vulnerability…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-59936Published

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved fro…

nvd ·

CVSS 3.0 · [email protected] · Secondary 9.4Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-61687Published

Flowise is a drag & drop user interface to build a customized large language model flow. A file upload vulnerability in version 3.0.7 of FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-61778Published

Akka.NET is a .NET port of the Akka project from the Scala / Java community. In all versions of Akka.Remote from v1.2.0 to v1.5.51, TLS could be enabled via our `akka.remote.dot-netty.tcp` transport and this would correctly enforce private …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-62427Published

The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery (SSRF) flaw within the URL resolution mechanism of Angular's Server-Side Rendering package (@angular/ssr) before 19…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-1647Published

XSS in Bootstrap title attribute for Tooltip and Popover

cve-program ·

Vendor product: Bootstrap

CVSS 3.1 5.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2025-59163Published

vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to r…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-59937Published

go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender- or recipient address is passed to the corresponding MAIL FROM or RCPT TO commands…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-59941Published

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2025-59942Published

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 9 Oct 2026Recorded 25 Oct 2026

RUSTSEC-2026-0334Published

BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses

osv · GHSA-5chw-87w3-j9cv

crates.io: bip322

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-106603Published

WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: holler-box

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-90461Published

OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication.

cve-program ·

Vendor product: Ironic

CVSS 3.1 6.3Source modified 9 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.