Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698142 source statements · aliases may refer to the same vulnerability

CVE-2026-66636Published

WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wise-chat

CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-39730Published

WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wise-chat

CVSS 3.1 7.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105811Published

Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS

cve-program ·

Vendor product: qnabot-on-aws

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-69016Published

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: auxin-elements

CVSS 3.1 4.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-57737Published

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: auxin-elements

CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-89417Published

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

cve-program ·

Vendor product: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.

CVSS 3.1 7.2Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-51882Published

The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the `openai_files` directory by crafting malicious filenames.

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-92531Published

Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET

cve-program ·

Vendor product: BugTracker.NET

CVSS 4.0 7.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-92533Published

Path Traversal in BugTracker.NET

cve-program ·

Vendor product: BugTracker.NET

CVSS 4.0 7.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105244Published

Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

cve-program ·

NuGet: log4net · NuGet: log4net

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105243Published

Apache log4net: Oversize EventLogAppender record silently discarded

cve-program ·

NuGet: log4net · NuGet: log4net

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105242Published

Apache log4net: Request validation failure drops the event in the aspnet-request converter

cve-program ·

NuGet: log4net · NuGet: log4net

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105241Published

Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch

cve-program ·

NuGet: log4net · NuGet: log4net

CVSS 3.1 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

MAL-2026-14486Published

Malicious code in spf-analytics (npm)

osv · GHSA-fj97-8h42-crgr

npm: spf-analytics

Source modified 7 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0332Published

`WaveFormat::parse` reads past the end of a `&WAVEFORMATEX`

osv ·

crates.io: wasapi

Source modified 7 Oct 2026Recorded 24 Oct 2026

CVE-2026-106057Published

patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

cve-program ·

Vendor product: patool

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-105139Published

Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources

cve-program ·

Vendor product: obot

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107180Published

MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required Instances

cve-program ·

Vendor product: MISP

CVSS 4.0 7.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106447Published

StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags

cve-program ·

Vendor product: stablelib

CVSS 4.0 8.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107175Published

MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

cve-program ·

Vendor product: MISP

CVSS 4.0 5.3Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-103435Published

Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

cve-program ·

Vendor product: @anthropic-ai/claude-code

CVSS 4.0 7.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-42532Published

A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to…

cve-program ·

Vendor product: visidata

CVSS 3.1 5.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-41958Published

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted U…

cve-program ·

Vendor product: visidata

CVSS 3.1 6.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-102258Published

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator…

cve-program ·

Vendor product: SMA1000

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-107183Published

llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-46434Published

wger: Trainer Privilege Escalation - Improper Privilege Management

cve-program ·

Vendor product: wger

CVSS 3.1 7.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-42618Published

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is trig…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-96589Published

Gitea private repository access retained after rejected transfer

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-46571Published

In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information in ntfs-3g process memory by crafting a malicious NTFS image. The out-…

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-96404Published

Gitea installer authentication bypass for existing accounts

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-79960Published

Gitea deploy key pushes acting as the repository owner

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-103059Published

Gitea built-in SSH server authentication bypass through key case folding

cve-program ·

Vendor product: gitea.dev

Source modified 7 Oct 2026Recorded 23 Oct 2026

GHSA-m62c-5q34-f3cfPublished

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

osv · CVE-2026-57449

npm: @actual-app/sync-server

HIGHSource modified 7 Oct 2026Recorded 24 Oct 2026

CVE-2026-106442Published

Hydra instantiate target blacklist bypasses permit code execution

cve-program ·

Vendor product: hydra

CVSS 3.1 7.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-71384Published

Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-70414Published

Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

cve-program ·

Vendor product: Command | Configure (DCC)

CVSS 3.1 5.5Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-87114Published

Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

cve-program ·

https://catalog.redhat.com/software/containers/: openshift4/kube-compare-artifacts-rhel9 · https://catalog.redhat.com/software/containers/: openshift4/kube-compare-artifacts-rhel9 · https://catalog.redhat.com/software/containers/: openshift4/kube-compare-artifacts-rhel9

CVSS 3.1 7.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106310Published

Use of released resource in FontAccess in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106582Published

In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.

cve-program ·

Vendor product: OpenSSH

CVSS 3.1 3.7Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106386Published

Uninitialized resource in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106588Published

In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.

cve-program ·

Vendor product: OpenSSH

CVSS 3.1 3.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-104945Published

Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500

cve-program ·

Vendor product: Tapo C500 v2.0

CVSS 4.0 6.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-104944Published

Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500

cve-program ·

Vendor product: Tapo C500 v2.0

CVSS 4.0 7.1Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-45871Published

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.

cve-program ·

Vendor product: n/a

Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-106444Published

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile() uses quotedString() in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScrip…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7Source modified 7 Oct 2026Recorded 25 Oct 2026

CVE-2026-56212Published

Capgo - Improper 2FA Enforcement Logic via Team Security Settings

cve-program ·

Vendor product: Capgo

CVSS 4.0 5.1 · CVSS 3.1 3.8Source modified 7 Oct 2026Recorded 23 Oct 2026

MAL-2026-17645Published

Malicious code in vectorizers (npm)

osv · GHSA-q8rg-7mvv-2c63

npm: vectorizers

Source modified 7 Oct 2026Recorded 24 Oct 2026

CVE-2025-64392Published

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

cve-program ·

Vendor product: Backup Enterprise Manager

CVSS 4.0 4.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2026-58068Published

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.

cve-program ·

Vendor product: Agent for Windows

CVSS 4.0 6.8Source modified 7 Oct 2026Recorded 23 Oct 2026

CVE-2025-13158Published

Prototype pollution vulnerability in apidoc-core versions 0.2.0 and all subsequent versions allows remote attackers to modify JavaScript object prototypes via malformed data structures, including the “define” property processed by the appli…

nvd ·

CVSS 4.0 · 103e4ec9-0a87-450b-af77-479448ddef11 · Secondary 9.3Source modified 7 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.