Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698242 source statements · aliases may refer to the same vulnerability

CVE-2026-106214Published

Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106254Published

Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-19856Published

All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query

cve-program ·

https://wordpress.org/plugins: All in One SEO

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106340Published

Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106119Published

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be i…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106118Published

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame w…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106109Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home dire…

nvd ·

CVSS 4.0 · [email protected] · Secondary 4.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106107Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 3.3.0, several @quasar/app-vite SSR and SSG rendering paths interpolated ssrContext.nonce directly into quoted HTML attributes. An application th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106103Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraini…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106334Published

Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102164Published

Security Advisory 0196

cve-program ·

Vendor product: Wi-Fi Access Points

CVSS 3.1 3.1 · CVSS 4.0 2.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102163Published

Security Advisory 0195

cve-program ·

Vendor product: Wi-Fi Access Points

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102169Published

Security Advisory 0194

cve-program ·

Vendor product: Wi-Fi Access Points

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102168Published

Security Advisory 0194

cve-program ·

Vendor product: Wi-Fi Access Points

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102162Published

Security Advisory 0193

cve-program ·

Vendor product: Wi-Fi Access Points

CVSS 3.1 8.8 · CVSS 4.0 9.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-66666Published

WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

cve-program ·

Vendor product: WordPress

CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-101157Published

Security Advisory 0192

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 8.7 · CVSS 4.0 9.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-101156Published

Security Advisory 0192

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 8.4 · CVSS 4.0 6.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102156Published

Security Advisory 0191

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 6.8 · CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102161Published

Security Advisory 0190

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102160Published

Security Advisory 0190

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 7.2 · CVSS 4.0 8.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104850Published

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to dec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105804Published

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hash…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.7Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105805Published

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected f…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105806Published

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation thr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105845Published

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106101Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS env…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106102Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into tit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106105Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-106106Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from util…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-26287Published

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-102159Published

Security Advisory 0190

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102158Published

Security Advisory 0190

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102157Published

Security Advisory 0190

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 5.9 · CVSS 4.0 6.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102155Published

Security Advisory 0190

cve-program ·

Vendor product: CloudVision CUE

CVSS 3.1 8.5 · CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-101155Published

Security Advisory 0189

cve-program ·

Vendor product: CloudVision Portal

CVSS 3.1 9.1 · CVSS 4.0 8.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102167Published

Security Advisory 0197

cve-program ·

Vendor product: Wi-Fi Access Points

CVSS 3.1 7.5 · CVSS 4.0 9.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102165Published

Security Advisory 0198

cve-program ·

Vendor product: Wi-Fi Access Points

CVSS 3.1 7.5 · CVSS 4.0 7.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102404Published

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102407Published

Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102408Published

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 4.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102409Published

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102410Published

Missing Authorization in Kibana Leading to Information Disclosure

cve-program ·

Vendor product: Kibana

CVSS 3.1 4.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102411Published

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102412Published

Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

cve-program ·

Vendor product: Kibana

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-102413Published

Uncaught Exception in Elastic Endpoint Leading to Denial of Service

cve-program ·

Vendor product: Elastic Agent and Elastic Defend

CVSS 3.1 6.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103005Published

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103006Published

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103008Published

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103009Published

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.