Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698242 source statements · aliases may refer to the same vulnerability

CVE-2026-103446Published

WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

cve-program ·

Vendor product: MediaWiki WikiLambda extension

CVSS 4.0 7.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-71168Published

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerabilit…

cve-program ·

Vendor product: System Update

CVSS 3.1 7.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106122Published

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

cve-program ·

Vendor product: rabbitmq-java-client · Vendor product: amqp-client

CVSS 4.0 6.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104914Published

MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View

cve-program ·

Vendor product: MISP

CVSS 4.0 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106106Published

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

cve-program ·

Vendor product: quasar · Vendor product: render-ssr-error · Vendor product: app-vite

CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106112Published

ImageSharp: ICC LUT16 output channel count can write beyond Vector4

cve-program ·

Vendor product: ImageSharp

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106116Published

ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop

cve-program ·

Vendor product: ImageSharp

CVSS 3.1 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105740Published

Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

cve-program ·

Vendor product: langflow

CVSS 3.1 9.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106117Published

ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

cve-program ·

Vendor product: ImageSharp

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106111Published

ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate

cve-program ·

Vendor product: ImageSharp

CVSS 3.1 5.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-81521Published

Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver

cve-program ·

Vendor product: GO Driver

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105750Published

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

cve-program ·

Vendor product: docling · Vendor product: docling-slim

CVSS 3.1 5.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105800Published

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105799Published

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected RediS…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105795Published

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attacker-controlled or compromised OpenAPI description into a generated API plugin man…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105794Published

MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, MsQuic clients using the OpenSSL or QuicTLS TLS backend do not properly verify that a server certific…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105744Published

Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

cve-program ·

Vendor product: docling · Vendor product: docling-slim

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-9032Published

Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200

cve-program ·

Vendor product: Tapo C200 V5 · Vendor product: Tapo C120 V1

CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105764Published

Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE

cve-program ·

Vendor product: immich

CVSS 4.0 7.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105759Published

vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of service)

cve-program ·

Vendor product: vllm

CVSS 3.1 5.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103623Published

Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105755Published

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

cve-program ·

Vendor product: vllm

CVSS 3.1 4.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103631Published

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103627Published

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106105Published

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

cve-program ·

Vendor product: quasar · Vendor product: app-vite · Vendor product: cli

CVSS 4.0 8.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-19954Published

Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names

cve-program ·

https://cpan.org/modules: Net-Whois-Raw

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-77802Published

HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

cve-program ·

Vendor product: Progress® Telerik® Fiddler® Classic

CVSS 3.1 6.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-77803Published

Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic

cve-program ·

Vendor product: Progress® Telerik® Fiddler® Classic

CVSS 3.1 3.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-77804Published

Time-of-check Time-of-use (TOCTOU) Race Condition in Root Certificate Installation in Progress® Telerik® Fiddler® Classic

cve-program ·

Vendor product: Progress® Telerik® Fiddler® Classic

CVSS 3.1 6.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-92931Published

CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK

cve-program ·

Vendor product: @progress/sitefinity-nextjs-sdk

CVSS 3.1 8.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-79311Published

webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.init().

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88416Published

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88360Published

libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly al…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-52001Published

An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88355Published

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88366Published

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculation…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88371Published

ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-sh…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88385Published

Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to t…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88383Published

libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompa…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-97149Published

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense again…

cve-program ·

Vendor product: Swift

CVSS 4.0 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105050Published

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled.

cve-program ·

Vendor product: PeaZip

CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88393Published

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base.php, which executes …

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105792Published

Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager

cve-program ·

Vendor product: UFO

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-78862Published

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (PCB)

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105314Published

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpr…

cve-program ·

https://pypi.org: papermerge-core

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104893Published

Plane: Improper validation allows arbitrary modification of API token rate limits

cve-program ·

Vendor product: plane

CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104961Published

Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access

cve-program ·

Vendor product: plane

CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104966Published

Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

cve-program ·

Vendor product: plane

CVSS 4.0 8.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105383Published

onetwothreeneth HospitalManagementSystem controller.php sql injection

cve-program ·

Vendor product: HospitalManagementSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105387Published

girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection

cve-program ·

Vendor product: Online-Appointment-Booking-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.