Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698242 source statements · aliases may refer to the same vulnerability

CVE-2026-105438Published

O2OA General url ActionUploadExcelWithUrl server-side request forgery

cve-program ·

Vendor product: O2OA

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105470Published

girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection

cve-program ·

Vendor product: Online-Appointment-Booking-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-95153Published

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105486Published

OSSRS srs System API api.go systemAPI.Run missing authentication

cve-program ·

Vendor product: srs

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105573Published

newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error

cve-program ·

Vendor product: newbee-mall

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105703Published

PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization

cve-program ·

Vendor product: User Registration & Login and User Management System

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105804Published

Payload: Password hashes use insufficient PBKDF2 iterations

cve-program ·

Vendor product: payload

CVSS 4.0 5.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105707Published

uptrace user_handler.go Login information exposure

cve-program ·

Vendor product: uptrace

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105778Published

Tenda AC5 Wifi setWifi stack-based overflow

cve-program ·

Vendor product: AC5

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105918Published

Kusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection

cve-program ·

Vendor product: Learning-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105794Published

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

cve-program ·

Vendor product: msquic

CVSS 4.0 9.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105922Published

vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of service

cve-program ·

Vendor product: vLLM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105799Published

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

cve-program ·

Vendor product: langchainjs · Vendor product: redis

CVSS 4.0 2.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105806Published

Payload: Improper access control for MCP API keys

cve-program ·

Vendor product: payload · Vendor product: plugin-mcp

CVSS 4.0 8.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105846Published

Payload: Untrusted redirect URL parameter exploit

cve-program ·

Vendor product: payload · Vendor product: next

CVSS 3.1 6.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105851Published

Payload: Field access control bypass on auth collections

cve-program ·

Vendor product: payload

CVSS 4.0 9.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105856Published

Payload: SQL injection in SQLite/Postgres

cve-program ·

Vendor product: payload · Vendor product: db-d1-sqlite · Vendor product: db-postgres

CVSS 4.0 8.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105786Published

Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

cve-program ·

Vendor product: joplin

CVSS 4.0 8.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105861Published

Payload external upload trust validation issue

cve-program ·

Vendor product: payload

CVSS 4.0 7.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105866Published

Payload: Unauthenticated account-lockout denial of service

cve-program ·

Vendor product: payload

CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106102Published

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

cve-program ·

Vendor product: quasar

CVSS 3.1 10.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105859Published

Payload: Unauthorized update to collection documents

cve-program ·

Vendor product: payload

CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105797Published

SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)

cve-program ·

Vendor product: simplechat

CVSS 3.1 8.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-77178Published

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105854Published

Payload: ReDoS in Multipart Content-Type Validation

cve-program ·

Vendor product: payload

CVSS 4.0 8.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106100Published

Payload: Field-level write access bypass in Payload on MongoDB

cve-program ·

Vendor product: payload

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-2575Published

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

cve-program ·

https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator

CVSS 3.1 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105845Published

Payload: SQL Injection in SQLite and Postgres

cve-program ·

Vendor product: payload

CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105849Published

Payload: API key disclosure through ordinary document reads

cve-program ·

Vendor product: payload

CVSS 4.0 7.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106101Published

Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service

cve-program ·

Vendor product: quasar

CVSS 3.1 3.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105864Published

Payload: Cross-tenant create in @payloadcms/plugin-multi-tenant

cve-program ·

Vendor product: payload · Vendor product: plugin-multi-tenant

CVSS 4.0 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105867Published

Payload: Client uploads could overwrite S3 objects

cve-program ·

Vendor product: payload · Vendor product: storage-s3

CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105862Published

Payload: Bypassed sanitization of user uploaded SVGs

cve-program ·

Vendor product: payload

CVSS 3.1 8.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105857Published

Payload: RCE in Payload Form Builder

cve-program ·

Vendor product: payload

CVSS 3.1 10.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105852Published

Payload relationship-query authorization bypass

cve-program ·

Vendor product: payload

CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105847Published

Payload: Polymorphic join queries could disclose hidden fields

cve-program ·

Vendor product: payload

CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-26287Published

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

cve-program ·

Vendor product: external-secrets

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-94293Published

Missing authentication for critical function in the aas-edge-client REST API

cve-program ·

Vendor product: Software AAS Edge Client all versions

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105392Published

Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key

cve-program ·

Vendor product: Django-Vue-Lyadmin

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105950Published

getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

cve-program ·

Vendor product: formwork

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2025-8352Published

Denial-of-service vulnerability in ESET PROTECT On-Prem

cve-program ·

Vendor product: ESET PROTECT On-Prem

CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-63690Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access c…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-61411Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to In…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 7.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105800Published

i18next-http-backend incomplete URL validation permits SSRF

cve-program ·

Vendor product: i18next-http-backend

CVSS 3.1 3.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105855Published

Payload: Field-level password update restrictions were not enforced

cve-program ·

Vendor product: payload

CVSS 4.0 7.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-63688Published

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploi…

cve-program ·

Vendor product: Dell Container Storage Modules (CSM)

CVSS 3.1 10.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105795Published

Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

cve-program ·

Vendor product: kiota · Vendor product: Microsoft.OpenApi.Kiota · Vendor product: Microsoft.OpenApi.Kiota.Builder

CVSS 3.1 3.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106219Published

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

cve-program ·

Vendor product: TeamCity

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-94543Published

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a respon…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-94483Published

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized im…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 6 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.