Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698811 source statements · aliases may refer to the same vulnerability

CVE-2026-67237Published

RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-66071Published

RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-100248Published

The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.

cve-program ·

Vendor product: Cosmowarp Contract

CVSS 4.0 8.4Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67223Published

RabbitMQ: LDAP DN injection via unescaped substitution

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.3Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67409Published

RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 8.2Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97878Published

zhistaredu StarTraining Druid Console index.html anonymous missing authentication

cve-program ·

Vendor product: StarTraining

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67227Published

RabbitMQ: Atom exhaustion: to_atom on global-parameter :name

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 5.9Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67410Published

RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 8.2Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-56724Published

Zammad: Incorrect implementation of permission checks in the knowledge base module

cve-program ·

Vendor product: zammad

CVSS 4.0 7.1Source modified 25 Sep 2026Recorded 23 Oct 2026

GHSA-jgm3-qmp2-c4p7Published

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

osv · CVE-2026-63460

npm: @vendure/core

HIGHSource modified 25 Sep 2026Recorded 24 Oct 2026

CVE-2026-56723Published

Zammad: Missing authorization on ticket attachment download

cve-program ·

Vendor product: zammad

CVSS 4.0 7.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-56727Published

Zammad: PGP signature spoofing via unvalidated verification return

cve-program ·

Vendor product: zammad

CVSS 4.0 7.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-56732Published

Zammad: Malicious input in Ticket Body Enables Session Termination

cve-program ·

Vendor product: zammad

CVSS 4.0 5.3Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-61525Published

Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

cve-program ·

Vendor product: zammad

CVSS 4.0 8.8Source modified 25 Sep 2026Recorded 23 Oct 2026

GHSA-qjrq-cvv4-3g9wWithdrawn

Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

osv ·

npm: knowns

HIGHSource modified 25 Sep 2026Recorded 24 Oct 2026

CVE-2026-97883Published

mathurvishal CloudClassroom-PHP-Project updatequery.php sql injection

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-88373Published

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently p…

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97877Published

zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password

cve-program ·

Vendor product: StarTraining

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67407Published

RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 5.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-48543Published

Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description

cve-program ·

Vendor product: laravel-crm

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 25 Sep 2026Recorded 23 Oct 2026

GHSA-8qqm-fp2q-v734Published

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

osv · CVE-2026-65838 · GO-2026-6019

Go: github.com/zalando/skipper

HIGHSource modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-w47m-jpv2-qfw5Withdrawn

Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem

osv ·

npm: knowns

CRITICALSource modified 25 Sep 2026Recorded 24 Oct 2026

CVE-2026-97868Published

sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting

cve-program ·

Vendor product: zen

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-56729Published

Zammad: Titles of knowledge base answers will be shown across all categories via the global search

cve-program ·

Vendor product: zammad

CVSS 4.0 2.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-94445Published

Malicious user input may lead to RCE in golang.org/x/playground

cve-program ·

https://pkg.go.dev: golang.org/x/playground

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-100237Published

Stored i18n XSS in the Flow integration of Thanks

cve-program ·

Vendor product: Mediawiki - Thanks Extension

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97326Published

songxinjianqwe Chat chat-server ChatServer.java server-side request forgery

cve-program ·

Vendor product: Chat

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97879Published

zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication

cve-program ·

Vendor product: StarTraining

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67419Published

RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 7.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67406Published

RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 4.6Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-95835Published

Missing ownership check on the shared memory object named by the kitty askpass escape code

cve-program ·

Vendor product: kitty

CVSS 4.0 5.6Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-95834Published

Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer

cve-program ·

Vendor product: kitty

CVSS 4.0 4.6Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-18311Published

CVE-2026-18311

cve-program ·

Vendor product: Reader

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-18320Published

CVE-2026-18320

cve-program ·

Vendor product: Reader

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-18312Published

CVE-2026-18312

cve-program ·

Vendor product: Reader

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67411Published

RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-87720Published

Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

cve-program ·

Vendor product: Gerrit

CVSS 4.0 7.6Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-80432Published

Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop

cve-program ·

Vendor product: kitty

CVSS 4.0 6.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-88386Published

libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4…

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-87721Published

Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

cve-program ·

Vendor product: Gerrit

CVSS 4.0 8.7Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-78902Published

Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-88421Published

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sideb…

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67412Published

RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-87722Published

Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review

cve-program ·

Vendor product: Gerrit

CVSS 4.0 8.7Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67239Published

RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 7.6Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-66073Published

RabbitMQ: Atom table exhaustion via management API node field

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-67225Published

RabbitMQ: Stream-protocol frame length never validated against frame_max

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.3Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97871Published

Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection

cve-program ·

Vendor product: CloudPos

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-44642Published

Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

cve-program ·

Vendor product: Piwigo

CVSS 3.1 8.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97875Published

DNS rebinding vulnerability in rojo serve HTTP API

cve-program ·

https://crates.io: rojo

CVSS 3.1 8.1Source modified 25 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.