Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

697350 source statements · aliases may refer to the same vulnerability

CVE-2026-105863Published

Payload authentication token field handling issue

cve-program ·

Vendor product: payload

CVSS 4.0 9.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105858Published

Payload: Remote Code Execution through first-register

cve-program ·

Vendor product: payload

CVSS 3.1 8.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105853Published

Payload: Token refresh and password reset responses may expose restricted user fields

cve-program ·

Vendor product: payload

CVSS 4.0 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-104070Published

SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

cve-program ·

Vendor product: SPIP Crayons Plugin

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105848Published

Payload: Insufficient Access Control in Stripe REST Proxy

cve-program ·

Vendor product: payload · Vendor product: plugin-stripe

CVSS 4.0 6.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105957Published

SourceCodester Performance Indicator System view_product.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105844Published

Payload: Prototype pollution in Payload Import Export plugin

cve-program ·

Vendor product: payload · Vendor product: plugin-import-export

CVSS 4.0 9.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-63691Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially ex…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 6.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-67270Published

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerabilit…

cve-program ·

Vendor product: Container Storage Modules (CSM)

CVSS 3.1 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105801Published

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

cve-program ·

Vendor product: openapi-python-client

CVSS 4.0 8.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-63692Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Eleva…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 10.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105796Published

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

cve-program ·

Vendor product: kiota · Vendor product: Microsoft.OpenApi.Kiota · Vendor product: Microsoft.OpenApi.Kiota.Builder

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105791Published

Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

cve-program ·

Vendor product: UFO

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106038Published

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

cve-program ·

Vendor product: Mooncake

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17711Published

Malicious code in wix-reg-poc-bypass (npm)

osv ·

npm: wix-reg-poc-bypass

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-105840Published

lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

cve-program ·

Vendor product: lrzsz

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105920Published

Kusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection

cve-program ·

Vendor product: Learning-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105835Published

PLANKA 2.2.0 through 2.2.1 TOTP Brute Force via verify-totp Endpoint

cve-program ·

Vendor product: planka

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105808Published

SourceCodester Simple Student Information System searchresults.php clean cross site scripting

cve-program ·

Vendor product: Simple Student Information System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105775Published

vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds

cve-program ·

Vendor product: vLLM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-75962Published

Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

cve-program ·

Vendor product: Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

CVSS 3.1 7.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-15688Published

Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting

cve-program ·

Vendor product: GX Works3 · Vendor product: Motion Control Setting

CVSS 4.0 9.2Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17644Published

Malicious code in random-certs (npm)

osv · GHSA-2cfv-92gp-9f6m

npm: random-certs

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17655Published

Malicious code in css-flow-render-shim (npm)

osv ·

npm: css-flow-render-shim

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17638Published

Malicious code in css-jptvix-polyfill (npm)

osv ·

npm: css-jptvix-polyfill

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17662Published

Malicious code in hardhat-promised (npm)

osv ·

npm: hardhat-promised

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17709Published

Malicious code in revine (npm)

osv · GHSA-gr77-3hqf-674h

npm: revine

Source modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-x937-hj6v-793pPublished

fast-jwt: Verifier cache accepts expired JWTs without iat.

osv · CVE-2026-107719

npm: fast-jwt

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-2m6q-8v3h-jqwwPublished

AdonisJS: Unencoded route parameters can produce open redirects

osv · CVE-2026-107718

npm: @adonisjs/http-server · npm: @adonisjs/http-server

MODERATESource modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-100197Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-0289Published

Prisma Browser: Inappropriate Implementation in Account Protection

cve-program ·

Vendor product: Prisma Browser

CVSS 4.0 0.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-0290Published

Prisma Browser: Sensitive Information Disclosure Vulnerability

cve-program ·

Vendor product: Prisma Browser

CVSS 4.0 0.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-30589Published

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2022-32189Published

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2022-21986Published

.NET Denial of Service Vulnerability

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 2.0 · [email protected] · Primary 4.3Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2022-0144Published

shelljs is vulnerable to Improper Privilege Management

nvd ·

CVSS 3.1 · [email protected] · Primary 7.1 · CVSS 3.0 · [email protected] · Secondary 7.1 · CVSS 2.0 · [email protected] · Primary 3.6Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-3807Published

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.0 · [email protected] · Secondary 7.5 · CVSS 2.0 · [email protected] · Primary 7.8Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-3449Published

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello)…

nvd ·

CVSS 3.1 · [email protected] · Primary 5.9 · CVSS 2.0 · [email protected] · Primary 4.3Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23450Published

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23383Published

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23369Published

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2021-23337Published

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 7.2 · CVSS 2.0 · [email protected] · Primary 6.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2020-7788Published

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the conte…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2020-5258Published

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 2.0 · [email protected] · Primary 5.0Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2020-28500Published

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 5.3 · CVSS 2.0 · [email protected] · Primary 5.0Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2019-20920Published

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to ru…

nvd ·

CVSS 3.1 · [email protected] · Primary 8.1 · CVSS 2.0 · [email protected] · Primary 6.8Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2018-7160Published

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …

nvd ·

CVSS 3.1 · [email protected] · Primary 8.8 · CVSS 2.0 · [email protected] · Primary 6.8Source modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-8wpc-h4q6-8fxvPublished

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

osv · CVE-2026-107720

npm: fast-jwt

HIGHSource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-5hjw-83fp-phq9Published

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

osv · CVE-2026-107723

npm: fast-jwt

HIGHSource modified 8 Oct 2026Recorded 24 Oct 2026

GHSA-ww5h-9m49-7xx4Published

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

osv · CVE-2026-107722

npm: fast-jwt

CRITICALSource modified 8 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.