Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698307 source statements · aliases may refer to the same vulnerability

CVE-2026-105176Published

SourceCodester Drug Recommendation System edit_class.php sql injection

cve-program ·

Vendor product: Drug Recommendation System

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105180Published

Jeebase UserService info updateUser dynamically-determined object attributes

cve-program ·

Vendor product: Jeebase

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105184Published

itsourcecode Online Admission System creteria.php sql injection

cve-program ·

Vendor product: Online Admission System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105188Published

code-projects Human Resource Management System Live Event History liveEventHistory.php cross site scripting

cve-program ·

Vendor product: Human Resource Management System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105230Published

kishor-23 food-waste-management-system deliverymyord.php sql injection

cve-program ·

Vendor product: food-waste-management-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105237Published

linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication

cve-program ·

Vendor product: litemall

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105247Published

SourceCodester Online Reviewer Management System btn_functions.php course sql injection

cve-program ·

Vendor product: Online Reviewer Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105251Published

vgmstream VAG File psx_decoder.c ps_find_padding out-of-bounds

cve-program ·

Vendor product: vgmstream

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103078Published

WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: js-support-ticket

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105062Published

WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-admin-audit

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104673Published

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: mp3-music-player-by-sonaar

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104397Published

WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

cve-program ·

https://wordpress.org/plugins: name-directory

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103079Published

WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: js-support-ticket

CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105284Published

Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization

cve-program ·

Vendor product: A3002MU

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-39721Published

WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: astra-sites

CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105288Published

feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting

cve-program ·

Vendor product: feelcrm-os

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105307Published

Casdoor API Endpoint authz_filter.go ApiFilter missing authentication

cve-program ·

Vendor product: Casdoor

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-39783Published

WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: polylang

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-56298Published

Capgo - EXIF Metadata Exposure in App Information Image Upload

cve-program ·

Vendor product: Capgo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-77805Published

Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic

cve-program ·

Vendor product: Progress® Telerik® Fiddler® Classic

CVSS 3.1 7.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100633Published

SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.5 · CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-79820Published

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

cve-program ·

Vendor product: HPE Integrated Lights-Out (iLO) 7

CVSS 3.1 9.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105163Published

crossplane crossplane-runtime ImageConfig client.go Get toctou

cve-program ·

Vendor product: crossplane-runtime

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2025-29189Published

Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.6Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-100624Published

Capgo.app before 12.264.5 Upload Expiry Bypass via build upload

cve-program ·

Vendor product: capgo.app

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104479Published

Shopclass before 6.2.0 Stored XSS via Listing Description Field

cve-program ·

Vendor product: shopclass

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105220Published

Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

cve-program ·

Vendor product: twinejs

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100637Published

SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.3 · CVSS 3.1 7.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104419Published

Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes

cve-program ·

Vendor product: zebra

CVSS 4.0 6.3 · CVSS 3.1 4.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103004Published

Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function tha…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-105167Published

kishor-23 food-waste-management-system donate.php sql injection

cve-program ·

Vendor product: food-waste-management-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-94486Published

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-105171Published

kishor-23 food-waste-management-system Role Attribute admin.php authorization

cve-program ·

Vendor product: food-waste-management-system

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-94485Published

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious websi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 5 Oct 2026Recorded 25 Oct 2026

CVE-2026-105293Published

Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

cve-program ·

Vendor product: Legcord

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100391Published

MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

cve-program ·

Vendor product: mediaflow-proxy

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100501Published

Flame through 2.4.0 Brute-Force Attack via Login Endpoint

cve-program ·

Vendor product: flame

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100505Published

Ghidra 9.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager

cve-program ·

Vendor product: ghidra

CVSS 4.0 4.8 · CVSS 3.1 4.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100523Published

Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

cve-program ·

Vendor product: Cotonti

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100527Published

OpenClaw before 2026.8.2 Denial of Service via Browser Relay

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100535Published

OpenClaw before 2026.8.1 Privilege Escalation via Session Memory

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100539Published

OpenClaw before 2026.8.1 Memory Access Control Bypass

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 2.1 · CVSS 3.1 2.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100543Published

OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100547Published

OpenClaw before 2026.8.1 Authentication Bypass via File URL

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100551Published

OpenClaw iOS Control UI TLS Pin Enforcement Bypass

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 9.0 · CVSS 3.1 8.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100555Published

OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100559Published

OpenClaw before 2026.8.1 Command Injection via Escaped Newlines

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 8.6 · CVSS 3.1 8.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100563Published

OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100568Published

OpenClaw before 2026.8.1 Unauthorized Command Job Access

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100572Published

OpenClaw before 2026.8.1 Denial of Service via Rate Limit

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.