Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698142 source statements · aliases may refer to the same vulnerability

GHSA-p75x-jh7p-ppcxPublished

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

osv · CVE-2026-106505

npm: @backstage/plugin-techdocs-node

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-fwxr-j5w2-587mPublished

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

osv · CVE-2026-106120

npm: liquidjs

MODERATESource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-wmpw-j6qv-mw88Published

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

osv · CVE-2026-106103

npm: @quasar/icongenie

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-8w7q-29mw-gf5cPublished

Backstage: Improper validation of MkDocs theme configuration in TechDocs

osv · CVE-2026-106509

npm: @backstage/plugin-techdocs-node

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

GHSA-6j9g-8fxc-25hqWithdrawn

Duplicate Advisory: Flowise contains an unauthenticated sandbox escape

osv ·

npm: flowise · npm: flowise-components

CRITICALSource modified 7 Oct 2026Recorded 24 Oct 2026

CVE-2026-101154Published

Security Advisory 0189

cve-program ·

Vendor product: CloudVision Portal

CVSS 3.1 7.2 · CVSS 4.0 8.6Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106449Published

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

cve-program ·

Vendor product: lz4-java

CVSS 3.1 3.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-97671Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105240Published

Apache log4net: NUL character truncates OutputDebugStringAppender records

cve-program ·

NuGet: log4net · NuGet: log4net

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-46570Published

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is tri…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106454Published

Twisted: IMAP wildcardToRegexp() ReDoS

cve-program ·

Vendor product: twisted

CVSS 3.1 4.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2020-12360Published

Out of bounds read in the firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106459Published

Backstage: Improper input validation in Sentry scaffolder actions

cve-program ·

Vendor product: backstage · Vendor product: plugin-scaffolder-backend-module-sentry

CVSS 3.1 8.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2020-12359Published

Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

cve-program ·

Vendor product: Intel(R) Processors

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106461Published

Backstage: Incorrect authorization in scaffolder task listing

cve-program ·

Vendor product: backstage · Vendor product: plugin-scaffolder-backend

CVSS 3.1 4.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106553Published

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

cve-program ·

Vendor product: OpenSSH

CVSS 3.1 2.2Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-101331Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 7.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106486Published

Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions

cve-program ·

Vendor product: backstage · Vendor product: plugin-scaffolder-backend-module-bitbucket-cloud · Vendor product: plugin-scaffolder-backend-module-bitbucket-server

CVSS 3.1 8.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2022-42004Published

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customi…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106504Published

Backstage: Sensitive information exposure in scaffolder task logs

cve-program ·

Vendor product: backstage · Vendor product: plugin-scaffolder-backend

CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2023-24998Published

Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

cve-program ·

Vendor product: Apache Commons FileUpload · Vendor product: Apache Tomcat

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106586Published

In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerability than CVE-2026-73283.

cve-program ·

Vendor product: OpenSSH

CVSS 3.1 2.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106497Published

Backstage: Inconsistent catalog property permission evaluation

cve-program ·

Vendor product: backstage · Vendor product: plugin-catalog-backend

CVSS 3.1 4.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2022-42003Published

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS featu…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106569Published

ImageMagick: Denial of service in ASE decoder because of missing security checks

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-93679Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 4.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107174Published

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: openshift-serverless-1/kn-client-kn-rhel9 · https://access.redhat.com/downloads/content/package-browser/: openshift-serverless-1/kn-plugin-func-func-util-rhel9 · https://access.redhat.com/downloads/content/package-browser/: openshift-serverless-clients

CVSS 3.1 6.4Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106574Published

ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2023-50572Published

An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106556Published

Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

cve-program ·

Vendor product: backstage · Vendor product: plugin-techdocs-node

CVSS 3.1 7.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106559Published

Backstage: Improper input validation in Confluence to Markdown scaffolder module

cve-program ·

Vendor product: backstage · Vendor product: plugin-scaffolder-backend-module-confluence-to-markdown

CVSS 3.1 6.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2021-24112Published

.NET Core Remote Code Execution Vulnerability

cve-program ·

Vendor product: Visual Studio 2019 for Mac · Vendor product: Mono 6.12.0 · Vendor product: .NET Core 2.1

CVSS 3.1 8.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106564Published

ImageMagick: Heap Buffer Over-Write in EXR decoder

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106562Published

Backstage: Incorrect authorization in search engine permission filtering

cve-program ·

Vendor product: backstage · Vendor product: plugin-search-backend · Vendor product: plugin-search-backend-module-elasticsearch

CVSS 3.1 4.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106567Published

ImageMagick: Infinite Loop in PSD decoder on 32-bit builds

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.9Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106505Published

Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend

cve-program ·

Vendor product: backstage · Vendor product: plugin-techdocs-node

CVSS 3.1 7.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2023-41074Published

The issue was addressed with improved checks. This issue is fixed in tvOS 17, Safari 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may lead to arbitrary code execution.

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: tvOS · Vendor product: Safari

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107206Published

LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

cve-program ·

Vendor product: LMCache

CVSS 4.0 8.8 · CVSS 3.1 9.4Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105268Published

Gitea issue attachment API allows changing comment attachments

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2021-31957Published

ASP.NET Core Denial of Service Vulnerability

cve-program ·

Vendor product: Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3) · Vendor product: Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) · Vendor product: Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)

CVSS 3.1 5.9Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106572Published

ImageMagick: Stack Overflown CALS decoder due to missing depth check.

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2021-31204Published

.NET and Visual Studio Elevation of Privilege Vulnerability

cve-program ·

Vendor product: .NET Core 3.1 · Vendor product: .NET 5.0 · Vendor product: Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)

CVSS 3.1 7.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2021-34485Published

.NET Core and Visual Studio Information Disclosure Vulnerability

cve-program ·

Vendor product: .NET 5.0 · Vendor product: .NET Core 2.1 · Vendor product: .NET Core 3.1

CVSS 3.1 5.0Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106577Published

ImageMagick: Code Injection in the postscript coders

cve-program ·

Vendor product: ImageMagick

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107272Published

Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages

cve-program ·

Vendor product: gophish

CVSS 4.0 2.3 · CVSS 3.1 4.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106584Published

In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more severe effect on users in certain Antarctic locations.

cve-program ·

Vendor product: OpenSSH

CVSS 3.1 2.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-19029Published

HDF5 scale-offset filter heap buffer over-read via crafted chunk

cve-program ·

Vendor product: HDF5

CVSS 4.0 6.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-70518Published

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code …

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2020-9493Published

Java deserialization in Chainsaw

cve-program ·

Vendor product: Apache Chainsaw

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-103670Published

Gitea trusted workflow cancellation by unapproved fork runs

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.