Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695929 source statements · aliases may refer to the same vulnerability

GHSA-x937-hj6v-793pPublished

fast-jwt: Verifier cache accepts expired JWTs without iat.

osv · CVE-2026-107719

npm: fast-jwt

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-2m6q-8v3h-jqwwPublished

AdonisJS: Unencoded route parameters can produce open redirects

osv · CVE-2026-107718

npm: @adonisjs/http-server · npm: @adonisjs/http-server

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-100197Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-0289Published

Prisma Browser: Inappropriate Implementation in Account Protection

cve-program ·

Vendor product: Prisma Browser

CVSS 4.0 0.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-0290Published

Prisma Browser: Sensitive Information Disclosure Vulnerability

cve-program ·

Vendor product: Prisma Browser

CVSS 4.0 0.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-30589Published

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2022-32189Published

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2022-21986Published

.NET Denial of Service Vulnerability

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 2.0 · [email protected] · Primary 4.3Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2022-0144Published

shelljs is vulnerable to Improper Privilege Management

nvd ·

CVSS 3.1 · [email protected] · Primary 7.1 · CVSS 3.0 · [email protected] · Secondary 7.1 · CVSS 2.0 · [email protected] · Primary 3.6Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-3807Published

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.0 · [email protected] · Secondary 7.5 · CVSS 2.0 · [email protected] · Primary 7.8Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-3449Published

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello)…

nvd ·

CVSS 3.1 · [email protected] · Primary 5.9 · CVSS 2.0 · [email protected] · Primary 4.3Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23450Published

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23383Published

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23369Published

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23337Published

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 7.2 · CVSS 2.0 · [email protected] · Primary 6.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2020-7788Published

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the conte…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2020-5258Published

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 2.0 · [email protected] · Primary 5.0Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2020-28500Published

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 5.3 · CVSS 2.0 · [email protected] · Primary 5.0Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2019-20920Published

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to ru…

nvd ·

CVSS 3.1 · [email protected] · Primary 8.1 · CVSS 2.0 · [email protected] · Primary 6.8Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2018-7160Published

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …

nvd ·

CVSS 3.1 · [email protected] · Primary 8.8 · CVSS 2.0 · [email protected] · Primary 6.8Source modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-8wpc-h4q6-8fxvPublished

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

osv · CVE-2026-107720

npm: fast-jwt

HIGHSource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-5hjw-83fp-phq9Published

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

osv · CVE-2026-107723

npm: fast-jwt

HIGHSource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-ww5h-9m49-7xx4Published

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

osv · CVE-2026-107722

npm: fast-jwt

CRITICALSource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-687g-22h4-j4w4Published

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

osv · CVE-2026-107721

npm: fast-jwt

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-6wjp-v33h-5cvqPublished

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

osv · CVE-2026-61426

npm: praisonai

HIGHSource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-g3pq-3vvx-36w6Withdrawn

Duplicate Advisory: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

osv ·

npm: praisonai

HIGHSource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-g3jj-5cmm-3hxxPublished

fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

osv · CVE-2026-107724

npm: fast-jwt

HIGHSource modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2025-59829Published

Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-62505Published

LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array to…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.0Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-62522Published

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, fi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0Source modified 8 Oct 2026Recorded 25 Oct 2026

MAL-2026-17707Published

Malicious code in wie888r (npm)

osv ·

npm: wie888r

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17708Published

Malicious code in xblaxw (npm)

osv ·

npm: xblaxw

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17706Published

Malicious code in testrrrd (npm)

osv ·

npm: testrrrd

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17704Published

Malicious code in @wxwxtest/testrrrdd (npm)

osv ·

npm: @wxwxtest/testrrrdd

Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-56851Published

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-61801Published

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-106557Published

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can re…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2021-44533Published

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpre…

cve-program ·

Vendor product: Node

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-40690Published

Bypass of the secureValidation property

cve-program ·

Vendor product: Apache Santuario

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-0144Published

Improper Privilege Management in shelljs/shelljs

cve-program ·

Vendor product: shelljs/shelljs

CVSS 3.0 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2015-6748Published

Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-29577Published

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incom…

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2018-15756Published

DoS Attack via Range Requests

cve-program ·

Vendor product: Spring framework

CVSS 3.0 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-29428Published

Local privilege escalation through system temporary directory

cve-program ·

Vendor product: gradle

CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-32189Published

Panic when decoding Float and Rat types in math/big

cve-program ·

https://pkg.go.dev: math/big

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-29263Published

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions …

cve-program ·

Vendor product: BIG-IP APM · Vendor product: BIG-IP APM Clients

CVSS 3.1 7.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-29429Published

Information disclosure through temporary directory permissions

cve-program ·

Vendor product: gradle

CVSS 3.1 4.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2019-3739Published

RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover…

cve-program ·

Vendor product: RSA BSAFE Crypto-J

CVSS 3.0 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-32751Published

Arbitrary code execution via specially crafted environment variables

cve-program ·

Vendor product: gradle

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-32511Published

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.