Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698260 source statements · aliases may refer to the same vulnerability

CVE-2026-105805Published

Payload: Sort queries could expose protected field information

cve-program ·

Vendor product: payload

CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104469Published

YesWiki before 4.6.7 Session Fixation via Login in AuthController.php

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104465Published

YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104461Published

YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-78861Published

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104457Published

YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104453Published

YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-2q76-m6w6-qgc6Published

Payload: Improper access control for MCP API keys

osv · CVE-2026-105806

npm: @payloadcms/plugin-mcp

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-fpww-c55p-cjv6Published

Payload: Polymorphic join queries could disclose hidden fields

osv · CVE-2026-105847

npm: payload · npm: payload

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-r9v2-gg2j-22q5Published

Payload: Insufficient Access Control in Stripe REST Proxy

osv · CVE-2026-105848

npm: @payloadcms/plugin-stripe · npm: @payloadcms/plugin-stripe

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-w84c-53h3-mc2gPublished

Payload: Untrusted redirect URL parameter exploit

osv · CVE-2026-105846

npm: payload · npm: payload · npm: @payloadcms/next

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-v49j-62m6-pgrrPublished

Payload: SQL Injection in SQLite and Postgres

osv · CVE-2026-105845

npm: payload · npm: payload

CRITICALSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-qf28-8hc6-vwrpPublished

Payload: Prototype pollution in Payload Import Export plugin

osv · CVE-2026-105844

npm: @payloadcms/plugin-import-export · npm: @payloadcms/plugin-import-export

CRITICALSource modified 6 Oct 2026Recorded 24 Oct 2026

CVE-2026-104449Published

YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105834Published

Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

cve-program ·

Vendor product: rundeck

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104445Published

YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105839Published

libmikmod before 3.3.14 Heap Buffer Overflow via OKT Loader OKT_doPBOD

cve-program ·

Vendor product: libmikmod

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104441Published

YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action

cve-program ·

Vendor product: yeswiki

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106037Published

Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service

cve-program ·

Vendor product: Mooncake

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104891Published

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied cr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105701Published

ACPT (Premium) <= 2.0.66 - Authenticated (Subscriber+) Remote Code Execution via REST API Email Template

cve-program ·

Vendor product: ACPT (Premium)

CVSS 3.1 8.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88424Published

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104871Published

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-37719Published

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-w5f4-fx9m-m4q7Published

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

osv · CVE-2026-105794

NuGet: Microsoft.Native.Quic.MsQuic.OpenSSL · NuGet: Microsoft.Native.Quic.MsQuic.OpenSSL · NuGet: Microsoft.Native.Quic.MsQuic.OpenSSL

CRITICALSource modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-rm89-rhwj-9j92Published

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

osv · CVE-2026-105796

NuGet: Microsoft.OpenApi.Kiota · NuGet: Microsoft.OpenApi.Kiota.Builder

HIGHSource modified 6 Oct 2026Recorded 23 Oct 2026

GHSA-q6mq-ch85-c8mmPublished

Payload: Password hashes use insufficient PBKDF2 iterations

osv · CVE-2026-105804

npm: payload · npm: payload

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-9g87-32v6-3c2rPublished

Payload: Sort queries could expose protected field information

osv · CVE-2026-105805

npm: payload · npm: payload

MODERATESource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-6qxp-vccf-f47hPublished

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

osv · CVE-2026-104850

npm: @modelcontextprotocol/sdk · npm: @modelcontextprotocol/client

HIGHSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-5x6v-p487-7qh2Published

LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values

osv · CVE-2026-105799

npm: @langchain/redis

LOWSource modified 6 Oct 2026Recorded 24 Oct 2026

GHSA-6gw6-rv2g-25mgPublished

Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

osv · CVE-2026-105795

NuGet: Microsoft.OpenApi.Kiota · NuGet: Microsoft.OpenApi.Kiota.Builder

LOWSource modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-106039Published

Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC

cve-program ·

Vendor product: Mooncake

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-42876Published

External Secrets Operator: Privilege escalation with secret overwriting

cve-program ·

Vendor product: external-secrets

CVSS 3.1 4.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-61421Published

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leadi…

cve-program ·

Vendor product: Container Storage Modules

CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-51873Published

Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside the intended project workspace.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-66635Published

WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: slider-wd

CVSS 3.1 7.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-66616Published

WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: form-maker

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-32576Published

WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: woorechnung

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2025-31626Published

WordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ticket-help-desk-system-lite

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-51878Published

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn. A remote caller can enumerate or obtain a session_id and trigger regenerate on another user's session.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-103918Published

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105681Published

Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they were not authorized to access. This issue is fixed in version 6.44.1.

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105676Published

Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentiall…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.9Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105649Published

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to hos…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105644Published

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the si…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-104852Published

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does not …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105048Published

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).

cve-program ·

Vendor product: Attu

CVSS 3.1 4.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105788Published

Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app

cve-program ·

Vendor product: UFO

CVSS 3.1 8.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-59870Published

js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

cve-program ·

Vendor product: js-yaml

CVSS 3.1 7.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105163Published

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use.…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 2.0 · [email protected] · Secondary 5.0Source modified 6 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.