Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698260 source statements · aliases may refer to the same vulnerability

CVE-2026-105642Published

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105645Published

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.9Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105647Published

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.0Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105650Published

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105652Published

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not pr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105677Published

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.2Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105679Published

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restricti…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105682Published

Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hosts from the Ghost server. This issue is fixed in version 6.27.0.

nvd ·

CVSS 3.1 · [email protected] · Secondary 2.7Source modified 6 Oct 2026Recorded 25 Oct 2026

CVE-2026-105793Published

Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

cve-program ·

Vendor product: UFO

CVSS 3.1 9.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104970Published

Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

cve-program ·

Vendor product: plane

CVSS 3.1 8.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104976Published

Plane: SSRF in Gitea OAuth

cve-program ·

Vendor product: plane

CVSS 4.0 8.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105629Published

Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup

cve-program ·

Vendor product: plane

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105634Published

Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

cve-program ·

Vendor product: plane

CVSS 3.1 8.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105639Published

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

cve-program ·

Vendor product: plane

CVSS 3.1 9.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105644Published

Ghost: Stored XSS via SVG Files in Content Imports

cve-program ·

Vendor product: Ghost

CVSS 3.1 6.8Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105649Published

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

cve-program ·

Vendor product: Ghost

CVSS 3.1 7.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105676Published

Ghost: Path Traversal via Locale Setting

cve-program ·

Vendor product: Ghost

CVSS 3.1 4.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105681Published

Ghost: Authorization Bypass in Comments Feature

cve-program ·

Vendor product: Ghost

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105687Published

Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

cve-program ·

Vendor product: penpot

CVSS 3.1 4.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105921Published

Kusalkasilva Learning-Management-System search_class.php sql injection

cve-program ·

Vendor product: Learning-Management-System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105692Published

Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create

cve-program ·

Vendor product: penpot

CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-71297Published

Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: multicluster-engine/cloudevents-conductor-rhel9 · https://access.redhat.com/downloads/content/package-browser/: multicluster-engine/maestro-rhel9

CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105745Published

Docling: Plugin entry points are imported before the allow_external_plugins check

cve-program ·

Vendor product: docling · Vendor product: docling-slim

CVSS 3.1 6.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105747Published

Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

cve-program ·

Vendor product: docling · Vendor product: docling-slim

CVSS 3.1 4.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-78860Published

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105752Published

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

cve-program ·

Vendor product: vllm

CVSS 3.1 3.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104852Published

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

cve-program ·

Vendor product: graphql-tools

CVSS 4.0 8.2Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105761Published

Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

cve-program ·

Vendor product: dify

CVSS 3.1 7.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105783Published

Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

cve-program ·

Vendor product: joplin

CVSS 3.1 8.0Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105798Published

SimpleChat: Stored XSS via group document filename in inline onclick handler

cve-program ·

Vendor product: simplechat

CVSS 3.1 8.7Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105789Published

Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool

cve-program ·

Vendor product: UFO

CVSS 3.1 5.4Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105756Published

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

cve-program ·

Vendor product: vllm

CVSS 3.1 6.5Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105760Published

vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustion

cve-program ·

Vendor product: vllm

CVSS 3.1 5.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-59358Published

UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

cve-program ·

Vendor product: UAA · Vendor product: cf-deployment

CVSS 4.0 7.6Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88392Published

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-79113Published

OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow.

cve-program ·

Vendor product: OpenAPV

CVSS 4.0 5.1Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-77050Published

Potential denial-of-service vulnerability in get_supported_language_variant()

cve-program ·

https://pypi.org/project/Django/: django

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-51888Published

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is: src/backend/base/langflow/api/v1/knowledge_bases.py:knowledge_bases-…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105748Published

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

cve-program ·

Vendor product: docling · Vendor product: docling-slim

CVSS 3.1 4.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-84429Published

Potential denial-of-service vulnerability in HTTP header parsing

cve-program ·

https://pypi.org/project/Django/: django

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-105767Published

Chainguard Academy (edu) integrate-platform-docs composite action interpolates inputs into shell commands

cve-program ·

Vendor product: Chainguard Academy (edu)

CVSS 4.0 2.1 · CVSS 3.1 3.3Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104714Published

Apache Struts: Shared message formatter exposes date and time values across concurrent requests

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.struts:struts2-core

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104713Published

Apache Struts: Unbounded request body read in the REST plugin

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.struts:struts2-rest-plugin

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-95265Published

Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe interna…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104712Published

Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.struts:struts2-core

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-104711Published

Apache Struts: OGNL injection in the legacy RESTful action mapper

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.struts:struts2-core

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-82989Published

CVE-2026-82989

cve-program ·

Vendor product: vCast

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-87890Published

Potential request forgery via spatial lookup byte values

cve-program ·

https://pypi.org/project/Django/: django

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-95263Published

Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protectio…

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

CVE-2026-88397Published

ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.

cve-program ·

Vendor product: n/a

Source modified 6 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.