Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

696120 source statements · aliases may refer to the same vulnerability

CVE-2026-53839Published

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching hostname prefixes instead of exact hostnames. Attackers can exploit this by crafting a hostname prefix resembling a trusted …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-53833Published

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.4 · CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-49144Published

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticate…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-49143Published

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the han…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 8.8Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-47099Published

TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious _constructor-name_ pro…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-40034Published

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initializ…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Secondary 7.8Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-39904Published

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() functi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-34966Published

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default htt…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 7.6Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-32846Published

OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit inc…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-32774Published

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.4 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-32064Published

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can co…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-26226Published

beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams. User-controlled values from Mermaid style and classDef direc…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-101056Published

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-101048Published

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-100839Published

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML injection attack ("BadAML"). ACPI tables containing AML bytecode are passed from the untrus…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4 · CVSS 3.1 · [email protected] · Secondary 8.4Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-100838Published

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root file…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-100582Published

OpenClaw channel plugins (@openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat) before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-9611Published

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a l…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-71405Published

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-71400Published

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 7.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-71399Published

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Secondary 8.6Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-34267Published

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules (Puppeteer and Playwright) with…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-34146Published

A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-15599Published

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. A…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2024-58375Published

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2023-54356Published

Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack (CVE-2016…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 3.7Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-47776Published

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help controller endpoints. Attackers can craft malicious requests to the GetContextHel…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2020-36851Published

Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets (SSRF). Because the proxy forwards requests and headers, an attacker can reach i…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-107217Published

Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows

cve-program ·

Vendor product: excelize

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107222Published

Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check

cve-program ·

Vendor product: excelize

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107228Published

AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)

cve-program ·

Vendor product: async-http-client

CVSS 3.1 6.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107289Published

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 3.1 6.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107604Published

Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-services

CVSS 3.1 4.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107640Published

Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

cve-program ·

Vendor product: Enswitch

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107677Published

FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 5.7 · CVSS 3.1 4.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-14496Published

IBM DataPower Gateway Out-of-bounds Read

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-14509Published

IBM DataPower Gateway Denial of Service

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106198Published

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106326Published

Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106361Published

Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security s…

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-15822Published

IBM DataPower Gateway Denial of Service

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93988Published

QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

cve-program ·

Vendor product: qloapps

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93452Published

snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress

cve-program ·

https://repo1.maven.org/maven2/org/xerial/snappy-java/: snappy-java

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93451Published

snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

cve-program ·

https://repo1.maven.org/maven2/org/xerial/snappy-java/: snappy-java

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-92298Published

EspoCRM through 10.0.8 Weak Token Generation via rand()

cve-program ·

Vendor product: EspoCRM

CVSS 3.1 4.8 · CVSS 4.0 6.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-90559Published

snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

cve-program ·

https://repo1.maven.org/maven2/org/xerial/snappy-java/: snappy-java

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-88877Published

Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

cve-program ·

Vendor product: traefik

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87807Published

siyuan before v3.8.2 SQL Injection via fullTextSearchBlock

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85597Published

Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

cve-program ·

Vendor product: traefik · Vendor product: traefik

CVSS 4.0 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85596Published

Traefik v3.7 Authentication Bypass via TLS Option Conflict

cve-program ·

Vendor product: traefik

CVSS 4.0 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.