Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695826 source statements · aliases may refer to the same vulnerability

CVE-2026-106450Published

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

cve-program ·

Vendor product: lz4-java

CVSS 3.1 5.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-76061Published

Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass

cve-program ·

https://github.com/cri-o/cri-o: cri-o · https://access.redhat.com/downloads/content/package-browser/: cri-o · https://access.redhat.com/downloads/content/package-browser/: openshift/ose-rhel-coreos-8

CVSS 3.1 5.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-103778Published

Dell Command | Configure (DCC), versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information discl…

cve-program ·

Vendor product: Command | Configure (DCC)

CVSS 3.1 6.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106440Published

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

cve-program ·

Vendor product: hydra

CVSS 3.1 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106221Published

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106422Published

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106199Published

Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chromium security sever…

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106353Published

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106359Published

Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106384Published

Missing authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106289Published

Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106261Published

Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-63697Published

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

cve-program ·

Vendor product: System Update

CVSS 3.1 7.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106120Published

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

cve-program ·

Vendor product: liquidjs

CVSS 4.0 6.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106115Published

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

cve-program ·

Vendor product: ImageSharp

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106110Published

ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

cve-program ·

Vendor product: ImageSharp

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106104Published

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

cve-program ·

Vendor product: quasar

CVSS 4.0 8.7Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105868Published

Payload: Uploaded XML files could execute same-origin JavaScript

cve-program ·

Vendor product: payload

CVSS 4.0 8.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105863Published

Payload authentication token field handling issue

cve-program ·

Vendor product: payload

CVSS 4.0 9.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105858Published

Payload: Remote Code Execution through first-register

cve-program ·

Vendor product: payload

CVSS 3.1 8.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105853Published

Payload: Token refresh and password reset responses may expose restricted user fields

cve-program ·

Vendor product: payload

CVSS 4.0 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-104070Published

SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

cve-program ·

Vendor product: SPIP Crayons Plugin

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105848Published

Payload: Insufficient Access Control in Stripe REST Proxy

cve-program ·

Vendor product: payload · Vendor product: plugin-stripe

CVSS 4.0 6.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105957Published

SourceCodester Performance Indicator System view_product.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105844Published

Payload: Prototype pollution in Payload Import Export plugin

cve-program ·

Vendor product: payload · Vendor product: plugin-import-export

CVSS 4.0 9.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-63691Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially ex…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 6.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-67270Published

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerabilit…

cve-program ·

Vendor product: Container Storage Modules (CSM)

CVSS 3.1 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105801Published

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

cve-program ·

Vendor product: openapi-python-client

CVSS 4.0 8.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-63692Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Eleva…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 10.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105796Published

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

cve-program ·

Vendor product: kiota · Vendor product: Microsoft.OpenApi.Kiota · Vendor product: Microsoft.OpenApi.Kiota.Builder

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105791Published

Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

cve-program ·

Vendor product: UFO

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106038Published

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

cve-program ·

Vendor product: Mooncake

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17711Published

Malicious code in wix-reg-poc-bypass (npm)

osv ·

npm: wix-reg-poc-bypass

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-105840Published

lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

cve-program ·

Vendor product: lrzsz

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105920Published

Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection

cve-program ·

Vendor product: Learning-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105835Published

PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

cve-program ·

Vendor product: planka

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105808Published

SourceCodester Simple Student Information System searchresults.php clean cross site scripting

cve-program ·

Vendor product: Simple Student Information System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105775Published

vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds

cve-program ·

Vendor product: vLLM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-75962Published

Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

cve-program ·

Vendor product: Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

CVSS 3.1 7.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-15688Published

Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting

cve-program ·

Vendor product: GX Works3 · Vendor product: Motion Control Setting

CVSS 4.0 9.2Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17644Published

Malicious code in random-certs (npm)

osv · GHSA-2cfv-92gp-9f6m

npm: random-certs

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17655Published

Malicious code in css-flow-render-shim (npm)

osv ·

npm: css-flow-render-shim

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17638Published

Malicious code in css-jptvix-polyfill (npm)

osv ·

npm: css-jptvix-polyfill

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17662Published

Malicious code in hardhat-promised (npm)

osv ·

npm: hardhat-promised

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17709Published

Malicious code in revine (npm)

osv · GHSA-gr77-3hqf-674h

npm: revine

Source modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-x937-hj6v-793pPublished

fast-jwt: Verifier cache accepts expired JWTs without iat.

osv · CVE-2026-107719

npm: fast-jwt

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-2m6q-8v3h-jqwwPublished

AdonisJS: Unencoded route parameters can produce open redirects

osv · CVE-2026-107718

npm: @adonisjs/http-server · npm: @adonisjs/http-server

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-100197Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-0289Published

Prisma Browser: Inappropriate Implementation in Account Protection

cve-program ·

Vendor product: Prisma Browser

CVSS 4.0 0.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-0290Published

Prisma Browser: Sensitive Information Disclosure Vulnerability

cve-program ·

Vendor product: Prisma Browser

CVSS 4.0 0.5Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.