Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

697814 source statements · aliases may refer to the same vulnerability

CVE-2026-102554Published

Denial of Service via Eager Array Allocation During Deserialization in Guava

cve-program ·

Vendor product: Guava

CVSS 4.0 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-90983Published

OTP Code Exposure in Hayat Hospital's Hayat Mobile

cve-program ·

Vendor product: Hayat Mobile

CVSS 3.1 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107783Published

Insertion of sensitive information into log file in AWS Tools for PowerShell

cve-program ·

Vendor product: aws-tools-for-powershell

CVSS 3.1 5.9 · CVSS 4.0 6.7Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-78795Published

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107886Published

OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation…

cve-program ·

Vendor product: CUPS

CVSS 3.1 2.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-87109Published

Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings

cve-program ·

Vendor product: Ops Manager

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-101028Published

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

cve-program ·

https://repo.hex.pm: ash · https://github.com: ash-project/ash

CVSS 4.0 6.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106145Published

Privilege Escalation in Telerik Report Server Service-Agent Hub

cve-program ·

Vendor product: Telerik Report Server

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106155Published

Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

cve-program ·

Vendor product: Telerik Report Server

CVSS 3.1 8.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-97075Published

WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-rocket

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107833Published

OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

cve-program ·

Vendor product: coraza

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107836Published

RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

cve-program ·

Vendor product: RIOT

CVSS 4.0 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107819Published

MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

cve-program ·

Vendor product: server

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106505Published

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to co…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 8.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-107807Published

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107826Published

OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

cve-program ·

Vendor product: coraza

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-55797Published

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

cve-program ·

Vendor product: argo-cd

CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-14502Published

IBM DataPower Gateway Improper Authentication

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-75348Published

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses re…

cve-program ·

Vendor product: n/a

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-78407Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-4264Published

Reflected Cross-Site Scripting in BeeTienda eCommerce platform

cve-program ·

Vendor product: eCommerce Platform

CVSS 4.0 5.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-78013Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vul…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 5.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106506Published

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-106508Published

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (te…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-96337Published

WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-avatar

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2025-12103Published

Openshift-ai: trusty ai grants all authenticated users to list pods in any namespace

cve-program ·

https://catalog.redhat.com/software/containers/: rhoai/odh-ta-lmes-driver-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel9 · https://access.redhat.com/downloads/content/package-browser/: rhoai/odh-trustyai-service-operator-rhel8

CVSS 3.1 5.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2025-6193Published

Trustyai-explainability: command injection via lmevaljob cr

cve-program ·

https://github.com/trustyai-explainability/trustyai-service-operator: trustyAI · https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel8 · https://access.redhat.com/downloads/content/package-browser/: rhoai/odh-rhel8-operator

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-95598Published

WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: search-in-place

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94062Published

WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability

cve-program ·

https://wordpress.org/plugins: werkstatt

CVSS 3.1 8.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107821Published

MariaDB: insufficient validation of binary frm data when opening a table

cve-program ·

Vendor product: server

CVSS 3.1 8.0Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94663Published

WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: profilegrid-user-profiles-groups-and-communities

CVSS 3.1 8.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94668Published

WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: salon-booking-system

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-96607Published

WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: nex-forms-express-wp-form-builder

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94161Published

WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: grandrestaurant

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-62029Published

WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wpfunnels

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106509Published

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is configured to build d…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-105877Published

WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: qa-heatmap-analytics

CVSS 4.0 6.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107803Published

ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

cve-program ·

Vendor product: processmaker

CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94066Published

WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

cve-program ·

https://themeforest.net: pond

CVSS 3.1 7.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-108105Published

Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request

cve-program ·

Vendor product: open5gs

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17745Published

Malicious code in @tunstock/remact-dom (npm)

osv ·

npm: @tunstock/remact-dom

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-108109Published

PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

cve-program ·

Vendor product: phpnuxbill

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 9 Oct 2026Recorded 23 Oct 2026

MAL-2026-17670Published

Malicious code in @itsmee_aizat.id/baileys2 (npm)

osv · GHSA-g6w5-p954-xcfr

npm: @itsmee_aizat.id/baileys2

Source modified 9 Oct 2026Recorded 24 Oct 2026

MAL-2026-17348Published

Malicious code in @bellaxchuu/teambails (npm)

osv ·

npm: @bellaxchuu/teambails

Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-107808Published

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

cve-program ·

Vendor product: nginx-ui

CVSS 3.1 8.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-94440Published

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-94439Published

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CO…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-78669Published

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-78667Published

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 9 Oct 2026Recorded 25 Oct 2026

CVE-2026-78663Published

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.1Source modified 9 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.