Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698307 source statements · aliases may refer to the same vulnerability

CVE-2026-105238Published

ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery

cve-program ·

Vendor product: NextChat

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100727Published

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

cve-program ·

Vendor product: GROWI

CVSS 3.0 5.3 · CVSS 4.0 6.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105248Published

vgmstream TXTP File txtp_parser.c txtp_parse out-of-bounds write

cve-program ·

Vendor product: vgmstream

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105253Published

itsourcecode Online Admission System Project login1.php sql injection

cve-program ·

Vendor product: Online Admission System Project

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105181Published

itsourcecode Online Admission System register1.php sql injection

cve-program ·

Vendor product: Online Admission System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105263Published

Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery

cve-program ·

Vendor product: Shaarli

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105177Published

SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection

cve-program ·

Vendor product: Drug Recommendation System

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105295Published

GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

cve-program ·

Vendor product: GitAhead

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105173Published

code-projects Human Resource Management Event Creation EventStore.php cross site scripting

cve-program ·

Vendor product: Human Resource Management

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105169Published

kishor-23 food-waste-management-system Take Order delivery.php sql injection

cve-program ·

Vendor product: food-waste-management-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105165Published

devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment

cve-program ·

Vendor product: secrets-replicator

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105217Published

Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

cve-program ·

Vendor product: cockpit

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104402Published

WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: mindio-magic-mcp

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104706Published

Mitel MiVoice Office 400 view system files path traversal

cve-program ·

Vendor product: Mitel MiVoice Office 400

CVSS 4.0 8.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100102Published

RCE via exposed JDWP debug agent in P4Search

cve-program ·

Vendor product: P4Search

CVSS 4.0 9.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104807Published

Mitel MiVoice Office 400 stored Cross-Site Scripting

cve-program ·

Vendor product: Mitel MiVoice Office 400

CVSS 4.0 1.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104808Published

Mitel MiVoice Office 400 stored Cross-Site Scripting

cve-program ·

Vendor product: Mitel MiVoice Office 400

CVSS 4.0 1.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104404Published

WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: give

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104401Published

WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: memberful-wp

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104805Published

Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

cve-program ·

Vendor product: Mitel MiVoice Office 400

CVSS 4.0 8.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105068Published

WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: events-manager

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103084Published

WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: premium-addons-for-elementor

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104809Published

Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

cve-program ·

Vendor product: Mitel MiVoice Office 400

CVSS 4.0 8.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104675Published

WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: event-tickets

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-5782Published

Reflected XSS in MRV Technology's TurkHotspot

cve-program ·

Vendor product: TurkHotspot

CVSS 3.1 5.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103351Published

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability

cve-program ·

https://wordpress.org/plugins: ecab-taxi-booking-manager

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105069Published

WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: qr-redirector

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105285Published

Totolink A3002MU QoS Rule formIpQoS stack-based overflow

cve-program ·

Vendor product: A3002MU

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105289Published

feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

cve-program ·

Vendor product: feelcrm-os

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104810Published

Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability

cve-program ·

Vendor product: Mitel MiVoice Office 400

CVSS 4.0 8.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-39763Published

WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-dummy-content-generator

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-63277Published

RCE via calcext:data-mappings, sql provider and jdbc connector

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 8.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-63266Published

Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 6.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-63267Published

LFI and GET SSRF via calcext:data-mappings and csv provider

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 6.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-63268Published

LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 6.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-63269Published

LFI and GET SSRF via GStreamer and HLS playlists

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 6.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-63270Published

Environment/ini-file leaks

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 6.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104811Published

Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution

cve-program ·

Vendor product: Mitel MiVoice Office 400

CVSS 4.0 8.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103512Published

Ticket host-binding bypass via spoofed client IP in P4Search

cve-program ·

Vendor product: P4Search

CVSS 4.0 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103511Published

Arbitrary file-write via extension installation in P4Search

cve-program ·

Vendor product: P4Search

CVSS 4.0 5.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105055Published

WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-mailster

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103335Published

WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: video-conferencing-with-zoom-api

CVSS 4.0 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2023-39999Published

WordPress < 6.3.2 is vulnerable to Broken Access Control

cve-program ·

Vendor product: WordPress

CVSS 3.1 4.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103510Published

Authentication bypass via blank auth token in P4Search

cve-program ·

Vendor product: P4Search

CVSS 4.0 9.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104388Published

WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: powerpress

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2025-58222Published

WordPress Team Manager plugin <= 2.6.8 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-team-manager

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-19395Published

An empty <img> attribute value in styled text triggers a parser error that halts the device.

cve-program ·

Vendor product: Qt for MCUs

CVSS 4.0 6.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105287Published

feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

cve-program ·

Vendor product: feelcrm-os

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-59782Published

JavaScript preprocessing memory disclosure

cve-program ·

Vendor product: Zabbix

CVSS 4.0 6.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-59783Published

Server DoS via binary items

cve-program ·

Vendor product: Zabbix

CVSS 4.0 2.3Source modified 5 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.