Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698127 source statements · aliases may refer to the same vulnerability

CVE-2026-1403Published

Allocation of Resources Without Limits or Throttling in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-92543Published

Docker Engine insecure-registry fallback via malicious DNS responses

cve-program ·

Vendor product: Docker Engine · Vendor product: github.com/moby/moby/v2

CVSS 4.0 7.6Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-92542Published

Blind VXLAN injection into encrypted overlay networks from cluster peer

cve-program ·

Vendor product: Docker Engine · Vendor product: github.com/docker/docker/libnetwork/drivers/overlay · Vendor product: github.com/moby/moby/v2/daemon/libnetwork/drivers/overlay

CVSS 4.0 6.9Source modified 7 Oct 2026Recorded 23 Oct 2026

GHSA-472h-9c5j-prrrPublished

Backstage: Inconsistent credential enforcement for overlapping proxy routes

osv · CVE-2026-106456

npm: @backstage/plugin-proxy-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-4q3p-rj5x-xv7pPublished

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

osv · CVE-2026-106111

NuGet: SixLabors.ImageSharp

MODERATESource modified 7 Oct 2026Recorded 23 Oct 2026

GHSA-q38j-6vcm-2f5mPublished

Backstage: Improper validation of MkDocs plugin configuration in TechDocs

osv · CVE-2026-106455

npm: @backstage/plugin-techdocs-node · npm: @backstage/plugin-techdocs-node

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-xm5q-p7w3-x6cpPublished

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

osv · CVE-2026-106460

npm: @backstage/plugin-auth-node · npm: @backstage/plugin-auth-node

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-89vp-x45c-52cqPublished

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

osv · CVE-2026-106101

npm: quasar

LOWSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-ffp7-56pq-64mrPublished

ImageSharp: ICC LUT16 output channel count can write beyond Vector4

osv · CVE-2026-106112

NuGet: SixLabors.ImageSharp

HIGHSource modified 7 Oct 2026Recorded 23 Oct 2026

GHSA-g734-fhp4-7mfpPublished

Backstage: Improper input validation in Sentry scaffolder actions

osv · CVE-2026-106459

npm: @backstage/plugin-scaffolder-backend-module-sentry

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-c36c-cf6r-ghgjPublished

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates

osv · CVE-2026-106458

npm: @backstage/plugin-catalog-backend-module-bitbucket-server

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-q333-f498-w2x7Published

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

osv · CVE-2026-106457

npm: @backstage/plugin-auth-backend-module-cloudflare-access-provider

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

CVE-2026-92415Published

Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.jackrabbit:jackrabbit-spi2dav

CVSS 4.0 6.9Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-92414Published

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.jackrabbit:jackrabbit-jcr-server

CVSS 4.0 9.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107278Published

MISP Object Sync Drops Objects and Attributes When Description Is Empty

cve-program ·

Vendor product: MISP

CVSS 4.0 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107276Published

MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

cve-program ·

Vendor product: MISP

CVSS 4.0 6.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-33586Published

Authenticated SMTP Sender Address Forgery

cve-program ·

Vendor product: OVHcloud

CVSS 4.0 6.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-70521Published

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code …

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-70516Published

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operation…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-42617Published

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extendin…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106288Published

Missing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-88514Published

An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-104632Published

Gitea fork workflow approval bypass through cancel and rerun

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-104626Published

Gitea fork workflow job revival through later approval

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-101029Published

Gitea migration and pull mirror SSRF through multi-answer DNS

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-103667Published

Gitea container registry stored XSS through blob media type

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-101919Published

Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: multicluster-engine/hypershift-rhel9-operator

CVSS 3.1 8.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-89430Published

Gitea push mirror SSRF and forced writes to internal Git hosts

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2022-30168Published

Microsoft Photos App Remote Code Execution Vulnerability

cve-program ·

Vendor product: Microsoft Photos

CVSS 3.1 7.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-103504Published

Gitea API team demotion not applied to unit permissions

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-104636Published

Gitea SSRF through Git HTTP redirects in mirrors and fetches

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-71299Published

Maestro: maestro: rest api write endpoints registered without authentication middleware

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: multicluster-engine/cloudevents-conductor-rhel9 · https://access.redhat.com/downloads/content/package-browser/: multicluster-engine/maestro-rhel9

CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2017-16138Published

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

cve-program ·

Vendor product: mime node module

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-70357Published

Gitea repository migration SSRF through DNS rebinding

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-94205Published

Gitea fork workflow approval bypass through maintainer-triggered events

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2020-9546Published

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-96399Published

Gitea denial of service through external issue tracker patterns

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2021-20722Published

Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe allows an attacker to gain privileges and execute a…

cve-program ·

Vendor product: The installers of ScanSnap Manager and the Software Download Installer

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-55183Published

An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-tu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-55184Published

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-66202Published

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-66219Published

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-66420Published

Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-66421Published

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-66565Published

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUI…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-66622Published

matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that include custom m.room.join_rules values due to a serialization bug. This can be exploited to cause a denia…

nvd ·

CVSS 4.0 · [email protected] · Secondary 1.3 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-66631Published

CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-67508Published

gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with adm…

nvd ·

CVSS 3.1 · [email protected] · Primary 8.4 · CVSS 3.0 · [email protected] · Secondary 8.0Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-67731Published

Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2025-67779Published

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case. React Server Components versions 19.0.2, 19.1.3 and 19.2.2 are affected, allow…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 7 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.