Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698307 source statements · aliases may refer to the same vulnerability

CVE-2026-100616Published

capgo.app Authentication Bypass via PostgREST customer_id Mutation

cve-program ·

Vendor product: capgo.app

CVSS 4.0 7.0 · CVSS 3.1 5.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-71886Published

OpenPGP certification accepted from a subkey without certification authority

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcpg

CVSS 4.0 8.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100620Published

Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account

cve-program ·

Vendor product: @capgo/cli

CVSS 4.0 5.1 · CVSS 3.1 3.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-71885Published

MLS X.509 credential not bound to the LeafNode signature key

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcmls

CVSS 4.0 9.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-18040Published

HQC leaks private key information through secret-indexed GF(2^8) tables and a secret-dependent fixed-weight sampler

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcprov

CVSS 4.0 5.9Source modified 5 Oct 2026Recorded 23 Oct 2026

GHSA-rf6f-7fwh-wjghPublished

Prototype Pollution via parse() in NodeJS flatted

osv · CVE-2026-33228

npm: flatted

HIGHSource modified 5 Oct 2026Recorded 24 Oct 2026

CVE-2026-71891Published

BLS12-381 key validation accepts a public key built on a foreign curve

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcprov

CVSS 4.0 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100641Published

SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.6 · CVSS 3.1 8.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-71890Published

MLS external commit can remove an arbitrary group member

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcmls

CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100608Published

Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard

cve-program ·

Vendor product: Flowise

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105112Published

Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

cve-program ·

Vendor product: nezha

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105117Published

OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions

cve-program ·

Vendor product: OpenAM · Vendor product: OpenAM

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100604Published

ClawHub Authentication Bypass via Former Publisher Skill Control

cve-program ·

Vendor product: clawhub

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105122Published

OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri

cve-program ·

Vendor product: OpenAM

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105146Published

Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection

cve-program ·

Vendor product: Discuz!

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2023-54405Published

H3C CVM Unauthenticated File Upload via fileUpload/upload Token

cve-program ·

Vendor product: CVM

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105156Published

YzmCMS MD5 system.func.php password weak password hash

cve-program ·

Vendor product: YzmCMS

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 5 Oct 2026Recorded 23 Oct 2026

GHSA-rxrv-835q-v5mhPublished

locutus is vulnerable to Prototype Pollution

osv · CVE-2026-25521

npm: locutus

CRITICALSource modified 5 Oct 2026Recorded 24 Oct 2026

CVE-2026-105127Published

LaraDashboard 1.4.2 before 1.4.8 Resource Exhaustion via Password Recovery Endpoints

cve-program ·

Vendor product: laradashboard

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105213Published

ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

cve-program ·

Vendor product: zitadel

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105097Published

Omega Solution CoinEx Crypto Customer Information API customer-currency authorization

cve-program ·

Vendor product: CoinEx Crypto

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105144Published

Drogon Static File Router StaticFileRouter.cc route path traversal

cve-program ·

Vendor product: Drogon

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105421Published

WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: convertkit-for-woocommerce

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105224Published

YesWiki before 4.6.7 Stored XSS via Bazar valeur Action

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-67233Published

RabbitMQ: Monitoring-tag user can DELETE shovels

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-76907Published

LaSuite Doc: Public Documents Enumeration

cve-program ·

Vendor product: docs

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-79761Published

Termix: Command injection in SSH key deployment verification

cve-program ·

Vendor product: Termix

CVSS 3.1 6.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-94606Published

authentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage

cve-program ·

Vendor product: authentik

CVSS 3.1 8.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-56738Published

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 8.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-91160Published

OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream

cve-program ·

Vendor product: OpenWA

CVSS 3.1 8.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-91161Published

OpenWA: VIEWER API keys can read WhatsApp group invite codes

cve-program ·

Vendor product: OpenWA

CVSS 3.1 6.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-57175Published

social-auth-core has an Improper Authentication issue

cve-program ·

Vendor product: social-core

CVSS 3.1 6.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-57177Published

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend

cve-program ·

Vendor product: social-core

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-97233Published

volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting

cve-program ·

Vendor product: Anagnorisis

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-85057Published

ZITADEL: Actions V1 sandbox escape: host file read via require()

cve-program ·

Vendor product: zitadel

CVSS 3.1 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-63645Published

OpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials

cve-program ·

Vendor product: openobserve

CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-61815Published

zbateson/mail-mime-parser has CRLF header injection via attachment filename

cve-program ·

Vendor product: mail-mime-parser

CVSS 3.1 7.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-77321Published

TREK MCP trip summary bypasses delegated OAuth read scopes

cve-program ·

Vendor product: TREK

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-48070Published

Docmost: Avatar URL path traversal in avatar cleanup leads to arbitrary local file deletion

cve-program ·

Vendor product: docmost

CVSS 3.1 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-52853Published

Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

cve-program ·

Vendor product: docmost

CVSS 3.1 5.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104873Published

LangGraph SDK custom auth silently ignores actions= on resource decorators

cve-program ·

Vendor product: langgraph

CVSS 4.0 7.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105096Published

Omega Solution CoinEx Crypto Customer Profile API customer authorization

cve-program ·

Vendor product: CoinEx Crypto

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103062Published

WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: translatepress-multilingual

CVSS 3.1 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105141Published

topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

cve-program ·

Vendor product: cognee

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-97307Published

WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: cost-calculator-builder

CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105147Published

SciPhi-AI R2R JWT Secret hard-coded credentials

cve-program ·

Vendor product: R2R

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105157Published

RainyGao DocSys Document Controller doGetTmpFile.do DocController.doGetTmp path traversal

cve-program ·

Vendor product: DocSys

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51894Published

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or m…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105168Published

kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection

cve-program ·

Vendor product: food-waste-management-system

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105172Published

itsourcecode Online Admission System login1.php sql injection

cve-program ·

Vendor product: Online Admission System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.