Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698364 source statements · aliases may refer to the same vulnerability

CVE-2026-104183Published

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named proto invokes the i…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.1Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-96780Published

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered widt…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 2 Oct 2026Recorded 25 Oct 2026

GHSA-q7jf-gf43-6x6pPublished

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

osv · CVE-2025-71381

npm: hono

MODERATESource modified 2 Oct 2026Recorded 24 Oct 2026

GHSA-6g2r-675j-hx59Published

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

osv ·

crates.io: xxhash-rust

LOWSource modified 2 Oct 2026Recorded 24 Oct 2026

GHSA-cw3j-28qq-x3xhWithdrawn

Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

osv ·

npm: hono

MODERATESource modified 2 Oct 2026Recorded 24 Oct 2026

CVE-2026-103921Published

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-103922Published

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a vi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.3Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104843Published

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a di…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104844Published

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104847Published

ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes tha…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104848Published

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited f…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.5Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-102626Published

LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

cve-program ·

Vendor product: LimeSurvey

CVSS 4.0 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102795Published

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 9.3 · CVSS 4.0 7.0Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-27874Published

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials.

cve-program ·

Vendor product: EasyIO FS32

CVSS 4.0 5.0Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-71451Published

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection.

cve-program ·

Vendor product: EasyIO FS32

CVSS 4.0 5.6Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-71452Published

- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.

cve-program ·

Vendor product: EasyIO FS32

CVSS 4.0 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-71449Published

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.

cve-program ·

Vendor product: EasyIO FS32

CVSS 4.0 9.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-27873Published

- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying.

cve-program ·

Vendor product: EasyIO FG

CVSS 4.0 5.6Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-64849Published

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

cve-program ·

Vendor product: mlflow

CVSS 3.1 9.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103764Published

Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

cve-program ·

Vendor product: Mooncake

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-21140Published

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

cve-program ·

Vendor product: Samsung Mobile Devices

CVSS 4.0 6.9Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104861Published

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

cve-program ·

Vendor product: probe-image-size

CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103098Published

GV-Eye Sensitive information exposure in URL query parameter Vulnerability

cve-program ·

Vendor product: tw.com.geovision.gveye

CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104480Published

Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

cve-program ·

https://github.com: discord/libdave

CVSS 4.0 9.4Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104053Published

itsourcecode Pet Shop Management System admin_reservefilter.php sql injection

cve-program ·

Vendor product: Pet Shop Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104854Published

Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory and s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104853Published

Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.8Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104418Published

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme co…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 7.2Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104414Published

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104411Published

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Secondary 7.3Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104123Published

SourceCodester Online Reviewer Management System btn_functions.php activity sql injection

cve-program ·

Vendor product: Online Reviewer Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-93698Published

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

cve-program ·

Vendor product: cPanel · Vendor product: WP Squared

CVSS 3.0 9.9Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-93697Published

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

cve-program ·

Vendor product: cPanel · Vendor product: WP Squared

CVSS 3.0 9.0Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-93029Published

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

cve-program ·

Vendor product: cPanel · Vendor product: WP Squared

CVSS 3.0 9.0Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63568Published

Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-64818Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63567Published

IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63566Published

DTLS handshake reassembler allocates buffer from unchecked 24-bit length

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103426Published

Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter

cve-program ·

Vendor product: Relevanssi Premium

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-94541Published

WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

cve-program ·

Vendor product: WPMobile.App – Android and iOS App Builder

CVSS 3.1 9.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-97634Published

Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

cve-program ·

Vendor product: Event Tickets and Registration

CVSS 3.1 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-100182Published

Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

cve-program ·

Vendor product: Download Monitor

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-15999Published

AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-95817Published

DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

cve-program ·

Vendor product: DoFollow Case by Case

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-16000Published

KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-100649Published

vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

cve-program ·

Vendor product: vllm

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-97336Published

CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

cve-program ·

Vendor product: CMB2

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104413Published

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Secondary 7.3Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104415Published

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 3.1Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104417Published

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale se…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 4.9Source modified 2 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.