Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698242 source statements · aliases may refer to the same vulnerability

CVE-2026-105680Published

Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they did not author. This issue is fixed in version 6.60.0.

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105675Published

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than the…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105648Published

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.0Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105643Published

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in pos…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-104872Published

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.8Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-104855Published

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder mut…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.0Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-104849Published

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.file…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-104845Published

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105790Published

Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects

cve-program ·

Vendor product: UFO

CVSS 3.1 6.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106041Published

Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC

cve-program ·

Vendor product: Mooncake

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106026Published

tftp-hpa 5.4 before 6.0 Out-of-Bounds Read via tftpd Remap Jump Rule

cve-program ·

Vendor product: tftp-hpa

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105860Published

Payload: Tenant authorization bypass in Multi-Tenant Plugin

cve-program ·

Vendor product: payload

CVSS 4.0 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105838Published

libmikmod before 3.3.14 Heap Out-of-Bounds Read via IT Module Loader

cve-program ·

Vendor product: libmikmod

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105919Published

Kusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection

cve-program ·

Vendor product: Learning-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105865Published

Payload: Incomplete validation during the upload file lifecycle

cve-program ·

Vendor product: payload

CVSS 3.1 8.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2017-20285Published

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

cve-program ·

https://cpan.org/modules: YAML

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-7507Published

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

cve-program ·

https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-4634Published

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

cve-program ·

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-2092Published

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

cve-program ·

CVSS 3.1 7.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2019-25777Published

YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

cve-program ·

https://cpan.org/modules: YAML

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105386Published

onetwothreeneth HospitalManagementSystem print.php get sql injection

cve-program ·

Vendor product: HospitalManagementSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105643Published

Ghost: Stored XSS via Embed Card Previews

cve-program ·

Vendor product: Ghost

CVSS 3.1 7.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105648Published

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

cve-program ·

Vendor product: Ghost

CVSS 3.1 4.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-71298Published

Maestro: sql identifier injection via properties.* search filter and orderby field

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: multicluster-engine/cloudevents-conductor-rhel9 · https://access.redhat.com/downloads/content/package-browser/: multicluster-engine/maestro-rhel9

CVSS 3.1 6.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105098Published

Omega Solution CoinEx Crypto Support Ticket API customer information disclosure

cve-program ·

Vendor product: CoinEx Crypto

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105675Published

Ghost: Invite Token Disclosure in Ghost Admin API

cve-program ·

Vendor product: Ghost

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105129Published

LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

cve-program ·

Vendor product: laradashboard

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105680Published

Ghost: Authorization Issue Allowed Author Role to Delete any Post

cve-program ·

Vendor product: Ghost

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105124Published

W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

cve-program ·

Vendor product: wcms

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105686Published

Penpot: Repeated chunk index causes temporary-storage amplification

cve-program ·

Vendor product: penpot

CVSS 4.0 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105119Published

OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105114Published

OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page

cve-program ·

Vendor product: OpenAM

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104982Published

Linux Mint Xreader EPUB File epub-document.c g_strdup_printf path traversal

cve-program ·

Vendor product: Xreader

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105691Published

Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

cve-program ·

Vendor product: penpot

CVSS 3.1 9.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105080Published

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

cve-program ·

Vendor product: ConvertX

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105696Published

Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command

cve-program ·

Vendor product: penpot

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105029Published

UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint

cve-program ·

Vendor product: support-center-bundle · Vendor product: community-skeleton

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-7307Published

Keycloak: keycloak: denial of service via specially crafted saml input

cve-program ·

https://github.com/keycloak/keycloak: keycloak · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104475Published

IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload

cve-program ·

Vendor product: idurar-erp-crm

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105741Published

Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

cve-program ·

Vendor product: langflow

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105046Published

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.

cve-program ·

Vendor product: Xperience

CVSS 3.1 4.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-82043Published

UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint

cve-program ·

Vendor product: UTMStack

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104872Published

Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

cve-program ·

Vendor product: opentelemetry-js-contrib · Vendor product: instrumentation-cassandra-driver · Vendor product: instrumentation-knex

CVSS 3.1 5.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105746Published

Docling: KServe v2 OCR engine does not enforce enable_remote_services

cve-program ·

Vendor product: docling · Vendor product: docling-slim

CVSS 3.1 2.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104991Published

Phproject < 1.8.7 Missing Authorization via Issues REST API

cve-program ·

Vendor product: phproject

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104855Published

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

cve-program ·

Vendor product: wasmtime

CVSS 4.0 2.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105751Published

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

cve-program ·

Vendor product: docling

CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104849Published

Tinypool: Prototype Pollution Gadget to RCE in run() options

cve-program ·

Vendor product: tinypool

CVSS 4.0 9.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104845Published

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

cve-program ·

Vendor product: seroval

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-94483Published

Next.js: Server-Side Request Forgery in Image Optimization

cve-program ·

Vendor product: next.js

CVSS 4.0 8.3Source modified 6 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.