Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698132 source statements · aliases may refer to the same vulnerability

CVE-2020-26259Published

XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling

cve-program ·

Vendor product: xstream

CVSS 3.1 6.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-102478Published

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and t…

cve-program ·

Vendor product: Octopus Server

CVSS 4.0 8.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-19396Published

A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an unauthenticated nearby user to derive the pairing token and read or modify router settings via observ…

cve-program ·

Vendor product: Router

CVSS 4.0 7.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-14911Published

Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authentica…

cve-program ·

Vendor product: Router

CVSS 4.0 9.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-81535Published

wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check

cve-program ·

Vendor product: wolfSSH

CVSS 4.0 6.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-84897Published

wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion

cve-program ·

Vendor product: wolfSSH

CVSS 4.0 6.9Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-19572Published

FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability

cve-program ·

Vendor product: FlexNet Publisher

CVSS 4.0 9.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-9082Published

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

cve-program ·

https://www.drupal.org/project/drupal: Drupal core

CVSS 3.1 9.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106446Published

Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

cve-program ·

Vendor product: handlebars.js

CVSS 3.1 9.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2018-14647Published

Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash c…

cve-program ·

Vendor product: Python

CVSS 3.0 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2013-0248Published

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-76460Published

Cisco Identity Services Engine Authentication Bypass Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 10.0Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-7473Published

Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

cve-program ·

Vendor product: EOS

CVSS 3.1 5.8 · CVSS 4.0 6.9Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-63030Published

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

cve-program ·

Vendor product: WordPress

CVSS 3.1 9.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2019-17267Published

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106451Published

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

cve-program ·

Vendor product: lz4-java

CVSS 4.0 7.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2018-20852Published

http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by us…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106456Published

Backstage: Inconsistent credential enforcement for overlapping proxy routes

cve-program ·

Vendor product: backstage · Vendor product: plugin-proxy-backend

CVSS 3.1 4.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106488Published

Backstage: Improper authentication in the OIDC provider

cve-program ·

Vendor product: backstage · Vendor product: plugin-auth-backend-module-oidc-provider

CVSS 3.1 8.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-85469Published

Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: quay/quay-builder-qemu-rhcos-rhel8

CVSS 3.1 8.0Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-79799Published

Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management Interface

cve-program ·

Vendor product: ClearPass Policy Manager (CPPM)

CVSS 3.1 8.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2019-16935Published

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-32284Published

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2022-0235Published

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

nvd ·

CVSS 3.1 · [email protected] · Primary 6.1 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 6.1 · CVSS 3.0 · [email protected] · Secondary 8.8 · CVSS 2.0 · [email protected] · Primary 5.8Source modified 7 Oct 2026Recorded 24 Oct 2026

CVE-2026-60137Published

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

cve-program ·

Vendor product: WordPress

CVSS 3.1 5.9Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2021-29425Published

Possible limited path traversal vulnerabily in Apache Commons IO

cve-program ·

Vendor product: Apache Commons IO

Source modified 7 Oct 2026Recorded 23 Oct 2026

GHSA-7hfw-grcm-cqm6Published

Backstage: Incorrect authorization in scaffolder task listing

osv · CVE-2026-106461

npm: @backstage/plugin-scaffolder-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-rg9r-hr7g-5gc2Published

Backstage: Improper authorization enforcement for TechDocs static content

osv · CVE-2026-106489

npm: @backstage/plugin-techdocs-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-7mfx-xg57-53c9Published

Backstage: Improper input validation in TechDocs static content requests

osv · CVE-2026-106490

npm: @backstage/plugin-techdocs-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-pcmq-25r3-5w9vPublished

Backstage: Inconsistent enforcement of allowed location types during catalog processing

osv · CVE-2026-106496

npm: @backstage/plugin-catalog-backend

LOWSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-7649-wm97-w3j3Published

Backstage: Improper input validation in cloud storage URL readers

osv · CVE-2026-106494

npm: @backstage/backend-defaults

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-75qf-886x-5xf2Published

Backstage: Improper input validation in Confluence to Markdown scaffolder module

osv · CVE-2026-106559

npm: @backstage/plugin-scaffolder-backend-module-confluence-to-markdown

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-29gx-h2m3-xw44Published

Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback

osv · CVE-2026-106462

npm: @backstage/plugin-scaffolder-backend · npm: @backstage/plugin-scaffolder-backend-module-github · npm: @backstage/plugin-scaffolder-backend-module-gitlab

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-2cmg-v53w-8xfpPublished

Backstage: Improper repository path validation in a Scaffolder backend module

osv · CVE-2026-106560

npm: @backstage/plugin-scaffolder-backend-module-confluence-to-markdown

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-g8rx-f7m5-7794Published

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

osv · CVE-2026-106486

npm: @backstage/plugin-scaffolder-backend-module-bitbucket-cloud · npm: @backstage/plugin-scaffolder-backend-module-bitbucket-server

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-h53x-hjx6-25grPublished

Backstage: Unsupported catalog cluster authentication mode in kubernetes backend

osv · CVE-2026-106487

npm: @backstage/plugin-kubernetes-backend

LOWSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-hmp2-4m7g-22cvPublished

Backstage: Scaffolder action input authorization bypass

osv · CVE-2026-106503

npm: @backstage/plugin-scaffolder-backend · npm: @backstage/plugin-scaffolder-backend · npm: @backstage/plugin-scaffolder-backend

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-qmw3-745m-w99gPublished

Backstage: Improper validation of TechDocs MkDocs configuration

osv · CVE-2026-106558

npm: @backstage/plugin-techdocs-node

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-pq68-rvw4-xp4rPublished

vm2 contains a sandbox escape vulnerability

osv · CVE-2026-93605

npm: vm2

CRITICALSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-p795-mqf2-36mfPublished

Backstage has a sensitive information disclosure in Kubernetes resource queries

osv · CVE-2026-106561

npm: @backstage/plugin-kubernetes-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-9ghw-48h5-v2w5Published

Backstage: Improper input validation in proxy-backend

osv · CVE-2026-106491

npm: @backstage/plugin-proxy-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-cq7v-rfgc-5c7vPublished

Backstage: Improper preservation of access restrictions during service credential delegation

osv · CVE-2026-106492

npm: @backstage/backend-defaults

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-r9ph-3637-55pxPublished

Backstage: Improper entity validation in deprecated Kubernetes services endpoint

osv · CVE-2026-106563

npm: @backstage/plugin-kubernetes-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-9325-vq29-gp3vPublished

Backstage has incorrect authorization in search engine permission filtering

osv · CVE-2026-106562

npm: @backstage/plugin-search-backend · npm: @backstage/plugin-search-backend-module-elasticsearch

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-xvh9-35w9-42m4Published

Backstage: Cloud storage catalog locations may cross configured storage boundaries

osv · CVE-2026-106493

npm: @backstage/plugin-catalog-backend-module-azure · npm: @backstage/plugin-catalog-backend-module-aws · npm: @backstage/backend-defaults

LOWSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-9hxx-m5g2-2q3hWithdrawn

Duplicate Advisory: vm2 contains a sandbox escape vulnerability

osv ·

npm: vm2

CRITICALSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-mfvq-x7vr-rgqgPublished

Backstage: Secret-derived values may be exposed in scaffolder task logs

osv · CVE-2026-106499

npm: @backstage/plugin-scaffolder-backend

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-gp6m-x9vw-5c5xPublished

Backstage has improper authorization in GitLab organizational user ingestion

osv · CVE-2026-106463

npm: @backstage/plugin-catalog-backend-module-gitlab

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-jg6q-3qfh-r9f8Published

mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control

osv · CVE-2026-104891

npm: @insumermodel/mppx-condition-gate · npm: @insumermodel/mppx-token-gate

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-g2v8-7jhw-pp8pPublished

Backstage: Sensitive information exposure in Scaffolder

osv · CVE-2026-106501

npm: @backstage/plugin-scaffolder-backend · npm: @backstage/plugin-scaffolder-backend · npm: @backstage/plugin-scaffolder-backend

CRITICALSource modified 7 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.