Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698821 source statements · aliases may refer to the same vulnerability

CVE-2026-85293Published

InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms

cve-program ·

Vendor product: InvoicePlane

CVSS 3.1 4.8Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-79319Published

Stencil core 4.43.5 is vulnerable to Incorrect Access Control.

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-79153Published

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected syst…

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-85289Published

InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints

cve-program ·

Vendor product: InvoicePlane

CVSS 3.1 6.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97366Published

jhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection

cve-program ·

Vendor product: react-native-debugger

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-92288Published

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party

cve-program ·

https://cpan.org/modules: Lemonldap-NG-Portal

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-0856Published

Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify t…

cve-program ·

Vendor product: Meona Client · Vendor product: Meona Server

CVSS 3.1 7.8Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97646Published

ningzichun student-management-system getStudent.php authorization

cve-program ·

Vendor product: student-management-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-92608Published

Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.qpid:qpid-broker-plugins-amqp-msg-conv-0-10-to-1-0

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-88370Published

libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a …

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-95832Published

Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell

cve-program ·

Vendor product: kitty

CVSS 4.0 9.3Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-80430Published

Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory

cve-program ·

Vendor product: kitty

CVSS 4.0 4.6Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97737Published

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.

cve-program ·

Vendor product: Wakapi

CVSS 3.1 7.4Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97648Published

ningzichun student-management-system cross-site request forgery

cve-program ·

Vendor product: student-management-system

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-93030Published

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw.

cve-program ·

Vendor product: IBM Financial Transaction Manager (FTM) for Redhat OpenShift

CVSS 3.1 6.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97866Published

Zhonglun CloudPOS Automatic Update Program.cs channel accessible

cve-program ·

Vendor product: CloudPOS

CVSS 4.0 6.3 · CVSS 3.1 5.6 · CVSS 3.0 5.6 · CVSS 2.0 5.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-97731Published

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never …

cve-program ·

Vendor product: MinIO

CVSS 3.1 7.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-100172Published

Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes

cve-program ·

Vendor product: ail framework

CVSS 4.0 8.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-100174Published

Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

cve-program ·

Vendor product: ail framework

CVSS 4.0 5.1Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-88388Published

Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jsl…

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2025-51457Published

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system c…

cve-program ·

Vendor product: n/a

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-80431Published

Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process

cve-program ·

Vendor product: kitty

CVSS 4.0 6.8Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-100176Published

Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

cve-program ·

Vendor product: ail framework

CVSS 4.0 8.5Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-100177Published

Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment

cve-program ·

Vendor product: ail framework

CVSS 4.0 6.3Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-100187Published

AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation

cve-program ·

Vendor product: ail framework

CVSS 4.0 6.9Source modified 25 Sep 2026Recorded 23 Oct 2026

RUSTSEC-2018-0011Published

Enum repr causing potential memory corruption

osv · CVE-2018-20998 · GHSA-69fv-gw6g-8ccg

crates.io: arrayfire

Source modified 25 Sep 2026Recorded 24 Oct 2026

CVE-2026-74304Published

Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device

cve-program ·

Vendor product: Linux · Vendor product: Linux

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-85750Published

Piwigo arbitrary file read and remote code execution via insecure image processing

cve-program ·

Vendor product: Piwigo

CVSS 3.1 7.2Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-25602Published

Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the re…

cve-program ·

Vendor product: Meona Server · Vendor product: Meona Client

CVSS 3.1 2.3Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-60101Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-60100Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-60099Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-60098Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-60097Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 25 Sep 2026Recorded 23 Oct 2026

CVE-2026-60096Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 25 Sep 2026Recorded 23 Oct 2026

MAL-2026-17185Published

Malicious code in shoplist-app (npm)

osv ·

npm: shoplist-app

Source modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-p2x3-8689-cwpgPublished

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

osv · BIT-parse-2026-32594 · CVE-2026-32594

npm: parse-server · npm: parse-server

MODERATESource modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-3x6r-wxxg-53vvPublished

rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response Panic

osv · BIT-rclone-2026-79778 · CVE-2026-79778 · GO-2026-6183

Go: github.com/rclone/rclone

MODERATESource modified 25 Sep 2026Recorded 24 Oct 2026

GO-2026-6183Published

Nil pointer dereference in Infinite Scale TUS uploads in github.com/rclone/rclone

osv · BIT-rclone-2026-79778 · CVE-2026-79778 · GHSA-3x6r-wxxg-53vv

Go: github.com/rclone/rclone

Source modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-h4mf-4v27-hggjPublished

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

osv · BIT-rclone-2026-79779 · CVE-2026-79779 · GO-2026-6197

Go: github.com/rclone/rclone

MODERATESource modified 25 Sep 2026Recorded 24 Oct 2026

GO-2026-6197Published

WebDAV credential leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

osv · BIT-rclone-2026-79779 · CVE-2026-79779 · GHSA-h4mf-4v27-hggj

Go: github.com/rclone/rclone

Source modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-7x63-xv5r-3p2xPublished

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing

osv · BIT-oauth2-proxy-2026-40575 · BIT-oauth2-proxy-2026-76835 · CVE-2026-40575 · CVE-2026-76835

Go: github.com/oauth2-proxy/oauth2-proxy/v7

CRITICALSource modified 25 Sep 2026Recorded 24 Oct 2026

GO-2026-5236Published

OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy

osv · BIT-oauth2-proxy-2026-40575 · BIT-oauth2-proxy-2026-76835 · CVE-2026-40575 · CVE-2026-76835

Go: github.com/oauth2-proxy/oauth2-proxy · Go: github.com/oauth2-proxy/oauth2-proxy/v7

Source modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-6mwx-4547-5vc9Published

OpenBao: LDAPi ldaputil (wrong escape func)

osv · BIT-openbao-2026-55770 · CVE-2026-55770 · GO-2026-5182

Go: github.com/openbao/openbao · Go: github.com/openbao/openbao

MODERATESource modified 25 Sep 2026Recorded 24 Oct 2026

GO-2026-5182Published

OpenBao: LDAPi ldaputil (wrong escape func) in github.com/openbao/openbao

osv · BIT-openbao-2026-55770 · CVE-2026-55770 · GHSA-6mwx-4547-5vc9

Go: github.com/openbao/openbao

Source modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-945v-v9p3-v5xwPublished

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

osv · BIT-rclone-2026-79783 · CVE-2026-79783 · GO-2026-6190

Go: github.com/rclone/rclone

LOWSource modified 25 Sep 2026Recorded 24 Oct 2026

GO-2026-6190Published

Unsafe file permission restoration from metadata in github.com/rclone/rclone

osv · BIT-rclone-2026-79783 · CVE-2026-79783 · GHSA-945v-v9p3-v5xw

Go: github.com/rclone/rclone

Source modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-gx4c-2hqx-cw2rPublished

rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

osv · BIT-rclone-2026-79782 · CVE-2026-79782 · GO-2026-6196

Go: github.com/rclone/rclone

LOWSource modified 25 Sep 2026Recorded 24 Oct 2026

GO-2026-6196Published

S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone

osv · BIT-rclone-2026-79782 · CVE-2026-79782 · GHSA-gx4c-2hqx-cw2r

Go: github.com/rclone/rclone

Source modified 25 Sep 2026Recorded 24 Oct 2026

GHSA-8v25-v8p6-qf7vPublished

rclone: Path traversal in serve s3 allows reading and overwriting root-level files

osv · BIT-rclone-2026-79781 · CVE-2026-79781 · GO-2026-6189

Go: github.com/rclone/rclone

MODERATESource modified 25 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.