Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698242 source statements · aliases may refer to the same vulnerability

CVE-2026-94543Published

Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

cve-program ·

Vendor product: next.js

CVSS 4.0 6.3Source modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-7c34-32v3-j575Published

Payload relationship-query authorization bypass

osv · CVE-2026-105852

npm: payload · npm: payload

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-8r29-2mp2-pmrwPublished

Payload Ecommerce has an order confirmation validation issue

osv · CVE-2026-105850

npm: @payloadcms/plugin-ecommerce · npm: @payloadcms/plugin-ecommerce

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-xgv3-crq2-6f69Published

Payload: Token refresh and password reset responses may expose restricted user fields

osv · CVE-2026-105853

npm: payload · npm: payload

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-238x-w2j9-gwwrPublished

Payload vulnerable to API key disclosure through ordinary document reads

osv · CVE-2026-105849

npm: payload · npm: payload

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-2g7p-5934-q4w7Published

Payload: ReDoS in Multipart Content-Type Validation

osv · CVE-2026-105854

npm: payload · npm: payload

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-fx49-4h83-wjv9Published

Payload didn't enforce field-level password update restrictions

osv · CVE-2026-105855

npm: payload · npm: payload

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

CVE-2026-104625Published

CodeAstro Simple Loan Management System index.php sql injection

cve-program ·

Vendor product: Simple Loan Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105469Published

girishsaraf Online-Appointment-Booking-System AJAX Endpoint get_town.php sql injection

cve-program ·

Vendor product: Online-Appointment-Booking-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104850Published

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

cve-program ·

Vendor product: typescript-sdk

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105850Published

Payload: Order confirmation validation issue in Payload Ecommerce

cve-program ·

Vendor product: payload · Vendor product: plugin-ecommerce

CVSS 4.0 8.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104612Published

SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting

cve-program ·

Vendor product: Student Result Management System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-63689Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to In…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104609Published

onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection

cve-program ·

Vendor product: HospitalManagementSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105805Published

Payload: Sort queries could expose protected field information

cve-program ·

Vendor product: payload

CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104469Published

YesWiki before 4.6.7 Session Fixation via Login in AuthController.php

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104465Published

YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104461Published

YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-78861Published

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104457Published

YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104453Published

YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-2q76-m6w6-qgc6Published

Payload: Improper access control for MCP API keys

osv · CVE-2026-105806

npm: @payloadcms/plugin-mcp

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-fpww-c55p-cjv6Published

Payload: Polymorphic join queries could disclose hidden fields

osv · CVE-2026-105847

npm: payload · npm: payload

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-r9v2-gg2j-22q5Published

Payload: Insufficient Access Control in Stripe REST Proxy

osv · CVE-2026-105848

npm: @payloadcms/plugin-stripe · npm: @payloadcms/plugin-stripe

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-w84c-53h3-mc2gPublished

Payload: Untrusted redirect URL parameter exploit

osv · CVE-2026-105846

npm: payload · npm: payload · npm: @payloadcms/next

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-v49j-62m6-pgrrPublished

Payload: SQL Injection in SQLite and Postgres

osv · CVE-2026-105845

npm: payload · npm: payload

CRITICALSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-qf28-8hc6-vwrpPublished

Payload: Prototype pollution in Payload Import Export plugin

osv · CVE-2026-105844

npm: @payloadcms/plugin-import-export · npm: @payloadcms/plugin-import-export

CRITICALSource modified 6 Oct 2026Recorded 24 Oct 2026

CVE-2026-104449Published

YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105834Published

Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

cve-program ·

Vendor product: rundeck

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104445Published

YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105839Published

libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD

cve-program ·

Vendor product: libmikmod

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104441Published

YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action

cve-program ·

Vendor product: yeswiki

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106037Published

Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service

cve-program ·

Vendor product: Mooncake

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104891Published

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied cr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105701Published

ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

cve-program ·

Vendor product: ACPT (Premium)

CVSS 3.1 8.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88424Published

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104871Published

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-37719Published

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-w5f4-fx9m-m4q7Published

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

osv · CVE-2026-105794

NuGet: Microsoft.Native.Quic.MsQuic.OpenSSL · NuGet: Microsoft.Native.Quic.MsQuic.OpenSSL · NuGet: Microsoft.Native.Quic.MsQuic.OpenSSL

CRITICALSource modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-rm89-rhwj-9j92Published

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

osv · CVE-2026-105796

NuGet: Microsoft.OpenApi.Kiota · NuGet: Microsoft.OpenApi.Kiota.Builder

HIGHSource modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-q6mq-ch85-c8mmPublished

Payload: Password hashes use insufficient PBKDF2 iterations

osv · CVE-2026-105804

npm: payload · npm: payload

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-9g87-32v6-3c2rPublished

Payload: Sort queries could expose protected field information

osv · CVE-2026-105805

npm: payload · npm: payload

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-6qxp-vccf-f47hPublished

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

osv · CVE-2026-104850

npm: @modelcontextprotocol/sdk · npm: @modelcontextprotocol/client

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-5x6v-p487-7qh2Published

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

osv · CVE-2026-105799

npm: @langchain/redis

LOWSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-6gw6-rv2g-25mgPublished

Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

osv · CVE-2026-105795

NuGet: Microsoft.OpenApi.Kiota · NuGet: Microsoft.OpenApi.Kiota.Builder

LOWSource modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106039Published

Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

cve-program ·

Vendor product: Mooncake

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-42876Published

External Secrets Operator: Privilege escalation with secret overwriting

cve-program ·

Vendor product: external-secrets

CVSS 3.1 4.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-61421Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leadi…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-51873Published

Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-66635Published

WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: slider-wd

CVSS 3.1 7.4Source modified 6 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.