Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

696049 source statements · aliases may refer to the same vulnerability

GHSA-f94x-6692-553qPublished

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

osv · CVE-2026-107391

npm: music-metadata

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-8j4c-6x6g-rq3jPublished

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)

osv · CVE-2026-107392

npm: music-metadata

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2025-22366Published

Mennekes smart/premium charges systems, Command injection in firmware upgrade

cve-program ·

Vendor product: Smart / Premium charging stations

CVSS 4.0 8.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-102490Published

Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

cve-program ·

Vendor product: Zammad

CVSS 4.0 8.5 · CVSS 4.0 9.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107608Published

Improper link resolution in asset bundling output handling in aws-cdk-lib

cve-program ·

Vendor product: aws-cdk-lib

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107392Published

music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)

cve-program ·

Vendor product: music-metadata

CVSS 3.1 6.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-84244Published

IBM Guardium Data Protection Cross-Site Scripting

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 9.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-84274Published

IBM Guardium Data Protection Information Disclosure

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106436Published

Application denial of service and data truncation via unchecked BSON append failures in MongoDB PHP Driver

cve-program ·

Vendor product: PHP Driver

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106432Published

Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver

cve-program ·

Vendor product: PHP Driver

CVSS 4.0 2.0 · CVSS 3.1 3.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2017-16119Published

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked …

cve-program ·

Vendor product: fresh node module

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-25649Published

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

cve-program ·

Vendor product: jackson-databind

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107387Published

music-metadata: Uncontrolled memory allocation in APEv2 parser

cve-program ·

Vendor product: music-metadata

CVSS 3.1 6.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107324Published

Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

cve-program ·

Vendor product: Go Driver

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106434Published

Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt

cve-program ·

Vendor product: libmongocrypt

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106433Published

Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt

cve-program ·

Vendor product: libmongocrypt

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106429Published

Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt

cve-program ·

Vendor product: libmongocrypt

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105452Published

Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts

cve-program ·

Vendor product: Docker Sandboxes

CVSS 4.0 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-40804Published

WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ablocks

CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105570Published

Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host

cve-program ·

Vendor product: Docker Sandboxes

CVSS 4.0 6.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-101998Published

Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials

cve-program ·

Vendor product: Docker Sandboxes

CVSS 4.0 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106430Published

Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver

cve-program ·

Vendor product: C++ Driver

CVSS 4.0 6.0 · CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106438Published

Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver

cve-program ·

Vendor product: C Driver

CVSS 4.0 5.1 · CVSS 3.1 4.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106437Published

Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver

cve-program ·

Vendor product: C Driver

CVSS 4.0 5.9 · CVSS 3.1 6.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106431Published

One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver

cve-program ·

Vendor product: C Driver

CVSS 4.0 5.9 · CVSS 3.1 5.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107322Published

OS command injection in Amazon Agent Plugins for AWS databases-on-aws

cve-program ·

Vendor product: databases-on-aws

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107703Published

@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

cve-program ·

https://www.npmjs.com/package/@enmaso/node-convert: @enmaso/node-convert

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106428Published

Out-of-bounds read in SCRAM response parsing in MongoDB C Driver

cve-program ·

Vendor product: C Driver

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-12260Published

SQL injection in the NetBoard CRM demo platform

cve-program ·

Vendor product: NetBoard CRM Demo Platform

CVSS 4.0 10.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87688Published

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are h…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 8.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107589Published

Authentication Bypass by Spoofing in Jacamar CI

cve-program ·

Vendor product: Jacamar CI

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107585Published

Allocation of Resources Without Limits or Throttling in hMailServer

cve-program ·

Vendor product: hMailServer

CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107586Published

Allocation of Resources Without Limits or Throttling in hMailServer

cve-program ·

Vendor product: hMailServer

CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-19585Published

Go-getter vulnerable to a path traversal in S3/GCS directory download handling

cve-program ·

Vendor product: Shared library

CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-10631Published

Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier

cve-program ·

Vendor product: Zimbra Collaboration Suite

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-50054Published

Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right

cve-program ·

Vendor product: Zimbra Collaboration Suite

CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-50055Published

Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion

cve-program ·

Vendor product: Zimbra Collaboration Suite

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-39678Published

WordPress Pinpoint Booking System plugin <= 2.9.9.7.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: booking-system

CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2019-20330Published

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-32582Published

WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: iato-mcp

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-9548Published

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

cve-program ·

Vendor product: n/a

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-13956Published

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

cve-program ·

Vendor product: Apache HttpClient

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107382Published

MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS

cve-program ·

Vendor product: mariadb-connector-nodejs

CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107376Published

webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input

cve-program ·

Vendor product: graphql-php

CVSS 3.1 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107378Published

CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

cve-program ·

Vendor product: CairoSVG

CVSS 4.0 8.7Source modified 8 Oct 2026Recorded 23 Oct 2026

MAL-2026-17701Published

Malicious code in @kxafunc/xbails (npm)

osv ·

npm: @kxafunc/xbails

Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-107702Published

QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking

cve-program ·

Vendor product: QloApps

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-57089Published

Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-50454Published

Windows User Interface Core Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2 · Vendor product: Windows 11 version 26H1

CVSS 3.1 7.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-50436Published

Windows Kernel Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2 · Vendor product: Windows 11 version 26H1

CVSS 3.1 7.8Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.