Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698276 source statements · aliases may refer to the same vulnerability

CVE-2026-103880Published

Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.directory.api:api-ldap-model

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-97283Published

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: advanced-post-manager

CVSS 3.1 9.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103085Published

WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-manager

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-97305Published

WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: hyve-lite

CVSS 4.0 6.9Source modified 5 Oct 2026Recorded 23 Oct 2026

MAL-2026-17510Published

Malicious code in internallib_v275 (npm)

osv · GHSA-f6rc-jhj3-4p2w

npm: internallib_v275

Source modified 5 Oct 2026Recorded 24 Oct 2026

CVE-2026-88395Published

GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-97070Published

WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: cozy-addons

CVSS 4.0 6.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105638Published

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

cve-program ·

Vendor product: plane

CVSS 3.1 9.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51911Published

vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103352Published

WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-base-booking-of-appointments-services-and-events

CVSS 3.1 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-97304Published

WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: timetics

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-102383Published

WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woo-lookbook

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105635Published

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

cve-program ·

Vendor product: plane

CVSS 3.1 7.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51896Published

infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105630Published

Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

cve-program ·

Vendor product: plane

CVSS 3.1 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104977Published

Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

cve-program ·

Vendor product: plane

CVSS 3.1 7.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51892Published

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105384Published

UNION HospitalManagementSystem patient_info.php sql injection

cve-program ·

Vendor product: HospitalManagementSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104971Published

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

cve-program ·

Vendor product: plane

CVSS 3.1 8.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104967Published

Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

cve-program ·

Vendor product: plane

CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51883Published

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name` parameter to write …

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104962Published

Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

cve-program ·

Vendor product: plane

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104894Published

Plane: Cross-Tenant Module Issue Linking via IDOR

cve-program ·

Vendor product: plane

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51879Published

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tut…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105640Published

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

cve-program ·

Vendor product: plane

CVSS 3.1 9.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51874Published

In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace.

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105633Published

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

cve-program ·

Vendor product: plane

CVSS 3.1 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104056Published

CVE-2026-104056

cve-program ·

Vendor product: Authlib

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51901Published

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different org…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-79701Published

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0

cve-program ·

Vendor product: SP Page Builder (Pro) extension for Joomla

CVSS 4.0 6.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51917Published

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-102731Published

Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.directory.api:api-asn1-ber

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-102426Published

Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2

cve-program ·

Vendor product: SP Page Builder (Pro) extension for Joomla

CVSS 4.0 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2014-125130Published

CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

cve-program ·

Vendor product: CodeArt Google MP3 Audio Player

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-102780Published

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4

cve-program ·

Vendor product: TF Content for Joomla

CVSS 4.0 6.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-102775Published

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

cve-program ·

Vendor product: Phoca Cart extension for Joomla

CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-102428Published

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

cve-program ·

Vendor product: com_os_cck

CVSS 4.0 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-85515Published

OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcpg · https://www.bouncycastle.org/download/bouncy-castle-java-lts/: bcpg-lts8on · https://www.bouncycastle.org/download/bouncy-castle-java-fips/: bcpg-fips

CVSS 4.0 8.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104975Published

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

cve-program ·

Vendor product: plane

CVSS 3.1 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2025-56362Published

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write …

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105628Published

Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

cve-program ·

Vendor product: plane

CVSS 3.1 7.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2025-56363Published

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks pro…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2025-56364Published

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an In…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2025-56365Published

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the cod…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105382Published

onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization

cve-program ·

Vendor product: HospitalManagementSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104960Published

Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

cve-program ·

Vendor product: plane

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104965Published

Plane: Cross-Tenant Issue Relation Creation via IDOR

cve-program ·

Vendor product: plane

CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104969Published

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

cve-program ·

Vendor product: plane

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

GHSA-gcgf-fh7c-8gf2Published

@orpc/zod: Prototype injection in smart coercion

osv · CVE-2026-103918

npm: @orpc/zod

MODERATESource modified 5 Oct 2026Recorded 24 Oct 2026

CVE-2026-42700Published

WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: image-slider-widget

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.