Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698800 source statements · aliases may refer to the same vulnerability

CVE-2026-100705Published

Kyverno before 1.19.1 SSRF via legacy apiCall service executor

cve-program ·

Vendor product: kyverno

CVSS 4.0 8.3 · CVSS 3.1 7.6Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100713Published

Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

cve-program ·

Vendor product: froxlor

CVSS 4.0 7.1 · CVSS 3.1 7.8Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2023-54365Published

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique).…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Sep 2026Recorded 24 Oct 2026

CVE-2026-100706Published

kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

cve-program ·

Vendor product: kyverno

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100710Published

Froxlor before 2.3.12 DKIM Private Key Disclosure via API

cve-program ·

Vendor product: froxlor

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100714Published

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

cve-program ·

Vendor product: froxlor

CVSS 4.0 9.4 · CVSS 3.1 9.1Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100718Published

Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

cve-program ·

Vendor product: froxlor

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100719Published

Froxlor before 2.3.12 Credential Disclosure via DirProtections API

cve-program ·

Vendor product: froxlor

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100720Published

Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

cve-program ·

Vendor product: froxlor

CVSS 4.0 9.3 · CVSS 3.1 8.7Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100626Published

capgo through 12.128.2 IDOR via PUT /app icon endpoint

cve-program ·

Vendor product: capgo.app

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-72662Published

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

cve-program ·

Vendor product: Kibana

CVSS 3.1 6.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-78582Published

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

cve-program ·

Vendor product: Kibana

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-82294Published

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-94398Published

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-94399Published

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-94400Published

Uncontrolled Resource Consumption in Kibana Leading to denial of service

cve-program ·

Vendor product: Kibana

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-94396Published

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-94397Published

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-94408Published

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 4.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-75699Published

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 10.0Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-82003Published

Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 8.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-82013Published

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-89276Published

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-75633Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: Content Credentials Command-Line Tool

CVSS 3.1 5.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-75684Published

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Connect · Vendor product: Adobe Connect Android Mobile App

CVSS 3.1 9.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-83964Published

Adobe Connect | Improper Certificate Validation (CWE-295)

cve-program ·

Vendor product: Adobe Connect · Vendor product: Adobe Connect Android Mobile App

CVSS 3.1 6.2Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-71178Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit t…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 3.7Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-96611Published

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX…

cve-program ·

Vendor product: FFmpeg

CVSS 3.1 6.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-96807Published

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this…

cve-program ·

Vendor product: Flatpak

CVSS 3.1 4.0Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-88840Published

Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: busybox

CVSS 3.1 5.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-80412Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-81537Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-97155Published

Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAI…

cve-program ·

Vendor product: Folio Client

CVSS 3.1 6.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-97176Published

Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-services

CVSS 3.1 4.2Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-18104Published

IBM Db2 Mirror for i is vulnerable to obtain sensitive information []

cve-program ·

Vendor product: Db2 Mirror for i

CVSS 3.1 3.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-77825Published

IBM ContextForge MCP Gateway is affected by path traversal

cve-program ·

Vendor product: ContextForge MCP Gateway

CVSS 3.1 4.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-81548Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-97404Published

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone aut…

cve-program ·

Vendor product: Zaqar

CVSS 4.0 9.2Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-92680Published

Araxis Merge insufficiently protected credentials

cve-program ·

Vendor product: Merge

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-97730Published

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To explo…

cve-program ·

Vendor product: pfSense Plus · Vendor product: pfSense CE

CVSS 3.1 8.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-97736Published

tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.

cve-program ·

https://proxy.golang.org: github.com/tinyauthapp/tinyauth

CVSS 3.1 5.4Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-93399Published

Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

cve-program ·

Vendor product: Online Scheduling and Appointment Booking System – Bookly

CVSS 3.1 9.1Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-93306Published

This Power System update is being released to address

cve-program ·

Vendor product: Server Firmware

CVSS 3.1 7.1Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100377Published

Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

cve-program ·

Vendor product: Mediawiki - WikiLambda Extension

CVSS 4.0 6.9Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100376Published

TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

cve-program ·

Vendor product: Mediawiki - TemplateSandbox Extension

CVSS 4.0 4.8Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-10758Published

Esri Lerc has a security vulnerability

cve-program ·

Vendor product: Lerc

CVSS 3.1 7.5Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100378Published

Missing permission check in the Translate sandbox doRemind action

cve-program ·

Vendor product: Mediawiki - Translate Extension

CVSS 4.0 5.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100379Published

Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

cve-program ·

Vendor product: Wikipedia Android App

CVSS 4.0 5.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100380Published

Reflected XSS in Wikibase Special:SetLabel language validation

cve-program ·

Vendor product: Mediawiki - Wikibase Extension

CVSS 4.0 5.3Source modified 26 Sep 2026Recorded 23 Oct 2026

CVE-2026-100381Published

UploadWizard Flickr collection and set titles allow DOM XSS

cve-program ·

Vendor product: Mediawiki - UploadWizard Extension

CVSS 4.0 5.3Source modified 26 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.