Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698013 source statements · aliases may refer to the same vulnerability

CVE-2026-104658Published

Reliance on Untrusted Inputs in a Security Decision in hMailServer

cve-program ·

Vendor product: hMailServer

CVSS 3.1 7.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107572Published

Inefficient Regular Expression Complexity in hMailServer

cve-program ·

Vendor product: hMailServer

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107449Published

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP addr…

cve-program ·

Vendor product: Heimdall

CVSS 3.1 3.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107584Published

Not Failing Securely ('Failing Open') in hMailServer

cve-program ·

Vendor product: hMailServer

CVSS 3.1 7.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-44036Published

Uncontrolled recursion in DCMTK xml2dcm allows denial of service

cve-program ·

https://github.com/DCMTK/dcmtk: DCMTK

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-14988Published

IBM DataPower Gateway Out-of-bounds Read

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-14507Published

IBM DataPower Gateway Out-of-bounds Write

cve-program ·

Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 7.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-13258Published

IBM DataPower Gateway Cross-Site Scripting

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 5.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107288Published

Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 3.1 3.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-61801Published

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

cve-program ·

Vendor product: sys

CVSS 3.1 5.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107286Published

Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107297Published

msgpack5: Quadratic parsing in the streaming decoder

cve-program ·

Vendor product: msgpack5

CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107660Published

FFmpeg before 8.1.3 and 9.x before 9.0.2 mbedTLS Hostname Verification Bypass for IP Hosts

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107291Published

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 4.0 2.3Source modified 8 Oct 2026Recorded 23 Oct 2026

MAL-2026-17694Published

Malicious code in @bitwardne/jslib (npm)

osv ·

npm: @bitwardne/jslib

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17693Published

Malicious code in @bitwardne/cli (npm)

osv ·

npm: @bitwardne/cli

Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-93699Published

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

cve-program ·

Vendor product: WP Toolkit

CVSS 4.0 8.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-94575Published

A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Success…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 6.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-94576Published

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass a…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-94578Published

Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access …

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107293Published

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

cve-program ·

Vendor product: pydantic-ai · Vendor product: pydantic-ai-slim

CVSS 4.0 2.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2024-8122Published

Potential brute force vulnerability due to non-expiring SMS OTPs

cve-program ·

Vendor product: WSO2 Identity Server

CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-103371Published

Apache Geode: Management REST API: Insertion of Sensitive Information into Log File

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.geode:geode-web-management

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105076Published

WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: vitepos-lite

CVSS 3.1 7.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105110Published

Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter

cve-program ·

Vendor product: Innbox

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105818Published

Vault PKI ACME Issues Certificate With Unvalidated SANs

cve-program ·

Vendor product: Vault · Vendor product: Vault Enterprise

CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105820Published

Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

cve-program ·

Vendor product: Vault Enterprise

CVSS 3.1 5.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105830Published

league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser

cve-program ·

Vendor product: commonmark

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105878Published

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: yith-woocommerce-product-bundles

CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105886Published

WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: ultimate-post-kit

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105893Published

WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: event-tickets

CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106196Published

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106389Published

Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-62167Rejected

This CVE is a duplicate of another CVE.

cve-program ·

Source modified 8 Oct 2026Recorded 23 Oct 2026

MAL-2026-3653Published

Malicious code in @design-system-coopeuch/web (npm)

osv · GHSA-vhjp-6vjm-vq35

npm: @design-system-coopeuch/web

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17688Published

Malicious code in @galicia-toolkit/core (npm)

osv · GHSA-ff43-rphq-9mgw

npm: @galicia-toolkit/core

Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-62166Rejected

This CVE is a duplicate of another CVE.

cve-program ·

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106408Published

Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-62163Rejected

Reason: This candidate is a duplicate of CVE-2026-60089.

cve-program ·

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2013-3900Published

WinVerifyTrust Signature Validation Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows Server 2019

CVSS 3.1 5.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-39790Published

WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: vikrentcar

CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-39723Published

WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wc-gateway-greeninvoice

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-88879Published

Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are canonicalized only on dashes, so X-Auth-User, X_Auth_User and X.Auth.User are treated as three distinct…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 8.2Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-88878Published

Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoints.<name>.transport.respondingTimeouts settings — notably readTimeout, which is enabled by default …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-84199Published

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 7.7Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-82868Published

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-82867Published

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with craf…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-82866Published

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template fi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9 · CVSS 3.1 · [email protected] · Secondary 6.8Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-82865Published

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inje…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.4Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-82864Published

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.