Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698075 source statements · aliases may refer to the same vulnerability

MAL-2026-17673Published

Malicious code in bottino-baileys (npm)

osv · GHSA-5f2x-3c4c-wh5p

npm: bottino-baileys

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17674Published

Malicious code in brat-generator (npm)

osv · GHSA-m45c-2rh6-33g6

npm: brat-generator

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17285Published

Malicious code in @akapaki/baileys (npm)

osv · GHSA-gxxr-g857-qmrh

npm: @akapaki/baileys

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17351Published

Malicious code in @bottino/baileys (npm)

osv · GHSA-qg7r-f2jp-2mmx

npm: @bottino/baileys

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17400Published

Malicious code in my-baileys (npm)

osv · GHSA-6v2q-p64f-6cp6

npm: my-baileys

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17371Published

Malicious code in @nyzzpediaa/baileys-new (npm)

osv · GHSA-xf66-63xx-4682

npm: @nyzzpediaa/baileys-new

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17672Published

Malicious code in @xayz/libsignal-node (npm)

osv · GHSA-f748-f8w7-hf22

npm: @xayz/libsignal-node

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17669Published

Malicious code in @itsmee_aizat.id/baileys (npm)

osv · GHSA-rm53-f4h3-h259

npm: @itsmee_aizat.id/baileys

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17671Published

Malicious code in @xayz/brat-generator (npm)

osv · GHSA-566x-rwjp-9274

npm: @xayz/brat-generator

Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-87681Published

An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categor…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-76273Published

Improper Input Validation through the collect Command in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-76278Published

Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87665Published

A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension sw…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 6.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87669Published

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitor…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 5.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87670Published

An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated …

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 5.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87672Published

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full pro…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 6.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-71183Published

Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2025-11579Published

github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Cr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-53967Published

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl comman…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.0Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-61785Published

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's poss…

nvd ·

CVSS 3.1 · [email protected] · Primary 3.3 · CVSS 3.0 · [email protected] · Secondary 3.3Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-61786Published

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possibl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-61787Published

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Versions prior to 2.5.3 and 2.2.15 are vulnerable to Command Line Injection attacks on Windows when batch files are executed. In Windows, ``CreateProcess()`` always implicitly spawn…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-61913Published

Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit thi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-61925Published

Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header, a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-61926Published

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.6Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2025-61927Published

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks. A Node.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2Source modified 8 Oct 2026Recorded 25 Oct 2026

CVE-2026-71895Published

Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87676Published

A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the lengt…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 6.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-71896Published

Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-103885Published

Apache Directory LDAP API: Denial of service via crafted telephone number values

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.directory.api:api-ldap-model

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-20328Published

Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability

cve-program ·

Vendor product: Cisco License On-Prem

CVSS 3.1 9.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87678Published

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (Id…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 6.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87679Published

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable numb…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 8.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87680Published

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 8.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-76485Published

Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability

cve-program ·

Vendor product: Cisco NX-OS Software

CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93443Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93674Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-97674Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-97678Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-97655Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87682Published

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session v…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-104334Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87683Published

Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping req…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87686Published

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the cli…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87726Published

Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confi…

cve-program ·

Vendor product: NxpNfcRdLib

CVSS 3.1 3.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-56014Published

WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: master-slider

CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-92861Published

The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application.

cve-program ·

Vendor product: Ticket Ryutsu Center

CVSS 3.0 4.0 · CVSS 4.0 5.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-92862Published

The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.

cve-program ·

Vendor product: Ticket Ryutsu Center

CVSS 3.0 3.3 · CVSS 4.0 4.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-95112Published

Gitea issue reference parsing CPU exhaustion

cve-program ·

Vendor product: gitea.dev

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2025-11695Published

When tlsInsecure=False appears in a connection string, certificate validation is disabled.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.0 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 8 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.