Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698276 source statements · aliases may refer to the same vulnerability

GHSA-gxm5-99cw-xjw9Published

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

osv · CVE-2026-74866

npm: @fastify/busboy

MODERATESource modified 5 Oct 2026Recorded 24 Oct 2026

GHSA-4xmw-hh9q-4q7cWithdrawn

Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

osv ·

npm: vm2

CRITICALSource modified 5 Oct 2026Recorded 24 Oct 2026

GHSA-j3hm-6rg5-mchvPublished

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

osv · CVE-2026-92946

npm: vm2

CRITICALSource modified 5 Oct 2026Recorded 24 Oct 2026

GHSA-r4fx-v8hh-22mvPublished

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

osv · CVE-2026-92942

npm: vm2

HIGHSource modified 5 Oct 2026Recorded 24 Oct 2026

GHSA-wjwh-qqvp-g4p4Published

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

osv · CVE-2026-92956

npm: vm2

CRITICALSource modified 5 Oct 2026Recorded 24 Oct 2026

GHSA-c8x8-7fp4-3x9wPublished

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

osv · CVE-2026-104847

npm: prosemirror-view

HIGHSource modified 5 Oct 2026Recorded 24 Oct 2026

GHSA-2vh9-cv26-p97mWithdrawn

Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack

osv ·

npm: vm2

MODERATESource modified 5 Oct 2026Recorded 24 Oct 2026

MAL-2026-17542Published

Malicious code in @inpeek/odata (npm)

osv · GHSA-cmm5-vwvx-cv5f

npm: @inpeek/odata

Source modified 5 Oct 2026Recorded 24 Oct 2026

MAL-2026-17543Published

Malicious code in @inpeek/odata-angular (npm)

osv · GHSA-7p27-jmq6-46ph

npm: @inpeek/odata-angular

Source modified 5 Oct 2026Recorded 24 Oct 2026

CVE-2026-94544Published

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular reques…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 4.2Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-104859Published

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. T…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.3Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-104846Published

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-104182Published

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-53953Published

GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

cve-program ·

Vendor product: GetSimpleCMS-CE

CVSS 3.1 9.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-28667Published

In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exp…

cve-program ·

Vendor product: Android

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-70650Published

GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content

cve-program ·

Vendor product: GetSimpleCMS-CE

CVSS 4.0 8.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105690Published

Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access

cve-program ·

Vendor product: penpot

CVSS 3.1 5.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105695Published

Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

cve-program ·

Vendor product: penpot

CVSS 3.1 5.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105684Published

Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

cve-program ·

Vendor product: penpot

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-76782Published

Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102

cve-program ·

https://www.drupal.org/project/screenshot: Screenshot

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93354Published

Taskview Community Missing Authentication via OAuth Dynamic Client Registration

cve-program ·

Vendor product: taskview-community

CVSS 4.0 8.5 · CVSS 3.1 8.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-82040Published

UTMStack < 11.2.16 SSRF via IdentityProviderService

cve-program ·

Vendor product: UTMStack

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-82045Published

UTMStack < 11.2.16 JPQL Injection via searchPropertyValues

cve-program ·

Vendor product: UTMStack

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104477Published

Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

cve-program ·

Vendor product: showdown

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105083Published

ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 1.8 · CVSS 3.1 3.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105116Published

OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page

cve-program ·

Vendor product: OpenAM · Vendor product: OpenAM · Vendor product: OpenAM

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105121Published

OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping

cve-program ·

Vendor product: OpenAM

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105126Published

LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering

cve-program ·

Vendor product: laradashboard

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105131Published

mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint

cve-program ·

Vendor product: ezBookkeeping

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105214Published

Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

cve-program ·

Vendor product: zitadel

CVSS 4.0 2.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105221Published

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

cve-program ·

Vendor product: gist

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105294Published

Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig

cve-program ·

Vendor product: Legcord

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-94544Published

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

cve-program ·

Vendor product: next.js

CVSS 4.0 6.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104182Published

stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk

cve-program ·

Vendor product: stream-json

CVSS 3.1 6.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-55251Published

NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

cve-program ·

Vendor product: devicetype-library

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-94484Published

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared r…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 4.8Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-104846Published

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

cve-program ·

Vendor product: seroval

CVSS 3.1 9.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104859Published

Nx: OS command injection in the @nx/docker release pipeline

cve-program ·

Vendor product: nx

CVSS 4.0 7.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-94484Published

Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

cve-program ·

Vendor product: next.js

CVSS 4.0 6.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104851Published

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

cve-program ·

Vendor product: filesystem_spec

CVSS 3.1 8.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103036Published

@orpc/json-schema: Prototype injection in smart coercion

cve-program ·

Vendor product: orpc

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104964Published

Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

cve-program ·

Vendor product: plane

CVSS 3.1 6.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105652Published

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

cve-program ·

Vendor product: Ghost

CVSS 3.1 3.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104891Published

mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control

cve-program ·

Vendor product: mppx-condition-gate · Vendor product: mppx-condition-gate · Vendor product: mppx-token-gate

CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105647Published

Ghost: Server-Side Request Forgery in Bookmark Fetching

cve-program ·

Vendor product: Ghost

CVSS 3.1 4.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105679Published

Ghost: Stored XSS via File Uploads on Local Storage

cve-program ·

Vendor product: Ghost

CVSS 3.1 7.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-55265Published

In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for …

cve-program ·

Vendor product: Android

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-89039Published

Arbitrary file read via the convert_playwright_script prompt in mcp-k6

cve-program ·

Vendor product: mcp-k6

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-76945Published

Ebyte NE2-D11 Use of Client-Side Authentication

cve-program ·

Vendor product: Ebyte NE2-D11 Firmware

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-75813Published

Ebyte NE2-D11 Missing Authorization

cve-program ·

Vendor product: Ebyte NE2-D11 Firmware

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.