Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698750 source statements · aliases may refer to the same vulnerability

CVE-2026-85290Published

InvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging

cve-program ·

Vendor product: InvoicePlane

CVSS 3.1 5.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-39372Published

InvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments

cve-program ·

Vendor product: InvoicePlane

CVSS 3.1 4.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2025-71390Published

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) wi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.8 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-97721Published

Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization

cve-program ·

Vendor product: PublicCMS

CVSS 4.0 5.1 · CVSS 3.1 2.7 · CVSS 3.0 2.7 · CVSS 2.0 3.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-55770Published

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaput…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-55776Published

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could terminate the server process by setting derived to true while the type parameter s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-63131Published

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = ["deny"] for …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-63132Published

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticate…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-77285Published

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner …

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.4Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-88056Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-88057Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-88058Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server seria…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-95337Published

UI misrepresentation in Messages in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95346Published

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via crafted network traffic. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-88060Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server seria…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 29 Sep 2026Recorded 25 Oct 2026

CVE-2026-17107Published

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-proxy-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-proxy-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-proxy-rhel9

CVSS 3.1 8.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95291Published

UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95294Published

UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95320Published

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95371Published

Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium sec…

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95363Published

UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95321Published

UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95323Published

UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95307Published

UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95279Published

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95309Published

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95288Published

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95364Published

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95305Published

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102242Published

Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

cve-program ·

Vendor product: MCP Toolbox for Databases

CVSS 4.0 8.6Source modified 29 Sep 2026Recorded 23 Oct 2026

GHSA-8vvx-rff5-p5rqPublished

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

osv · CVE-2026-100702

npm: nodemailer

MODERATESource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-2jfj-6hjv-fm6jPublished

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

osv · CVE-2026-84933

npm: undici · npm: undici

MODERATESource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-rfgv-xxqx-mfg5Published

undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

osv · CVE-2026-19534

npm: undici · npm: undici · npm: undici

HIGHSource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-pmjh-fq2x-6v4xPublished

undici vulnerable to Denial of Service via orphaned RetryHandler response body

osv · CVE-2026-18149

npm: undici · npm: undici

MODERATESource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-r53p-7pc4-xj5rPublished

undici vulnerable to downstream response splitting via retry interceptor

osv · CVE-2026-18540

npm: undici · npm: undici · npm: undici

LOWSource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-rcw4-f5rp-g42vPublished

adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0

osv · CVE-2026-92000

npm: adm-zip

HIGHSource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-3xpg-4rpp-hhhmPublished

undici vulnerable to Denial of Service via unbounded decompression of compressed responses

osv · CVE-2026-84890

npm: undici · npm: undici

MODERATESource modified 29 Sep 2026Recorded 24 Oct 2026

CVE-2026-81930Published

Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain

cve-program ·

https://pypi.python.org: apache-airflow-providers-snowflake

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-86843Published

Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag

cve-program ·

https://pypi.python.org: apache-airflow-providers-teradata

Source modified 29 Sep 2026Recorded 23 Oct 2026

GHSA-w293-vg96-wgc3Published

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

osv · CVE-2026-84961

npm: undici · npm: undici

HIGHSource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-vp8m-p9jh-q5pmPublished

undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

osv · CVE-2026-85152

npm: undici

HIGHSource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-8436-99hf-9mmvPublished

undici vulnerable to caching and replay of unsafe HTTP method responses

osv · CVE-2026-85008

npm: undici · npm: undici

LOWSource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-2gqq-gqf2-x968Published

undici vulnerable to response truncation via oversized chunked responses in the dump interceptor

osv · CVE-2026-84947

npm: undici · npm: undici

LOWSource modified 29 Sep 2026Recorded 24 Oct 2026

CVE-2026-102729Published

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes.…

cve-program ·

Vendor product: GUIX

CVSS 4.0 5.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-97060Published

X-SpringBoot through 6.0 Authorization Bypass via User Management

cve-program ·

Vendor product: X-SpringBoot

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-85417Published

Incomplete property masking in the SANnav logging subsystem

cve-program ·

Vendor product: SANnav

CVSS 4.0 6.4Source modified 29 Sep 2026Recorded 23 Oct 2026

GHSA-vv43-5jgx-7qv8Published

Electron: Local race condition in Squirrel.Mac update installation on macOS

osv · CVE-2026-102672

npm: electron · npm: electron · npm: electron

MODERATESource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-qmv3-fv6v-rmhqPublished

Electron: Sandboxed preload code cache can be poisoned by a compromised renderer

osv · CVE-2026-102677

npm: electron · npm: electron · npm: electron

HIGHSource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-r3ph-w7gj-g6xmPublished

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

osv ·

npm: js-yaml

MODERATESource modified 29 Sep 2026Recorded 24 Oct 2026

GHSA-j84w-jfhq-vhvjPublished

Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled

osv · CVE-2026-102675

npm: electron · npm: electron · npm: electron

HIGHSource modified 29 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.