Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698828 source statements · aliases may refer to the same vulnerability

CVE-2026-75907Published

CVE-2026-75907

cve-program ·

Vendor product: door access control

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-61732Published

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

cve-program ·

Vendor product: Decepticon · Vendor product: decepticon-core · Vendor product: decepticon-sdk

CVSS 3.1 10.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-73064Published

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

cve-program ·

Vendor product: Mbed TLS

CVSS 3.1 2.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88372Published

libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88368Published

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled…

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88357Published

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly…

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-17511Published

This Power System update is being released to address

cve-program ·

Vendor product: PowerVM Hypervisor

CVSS 3.1 3.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-6544Published

Multiple Vulnerabilities in IBM Concert Software

cve-program ·

Vendor product: Concert

CVSS 3.1 6.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81547Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82094Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-61742Published

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

cve-program ·

Vendor product: dbhub

CVSS 4.0 9.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97232Published

volotat Anagnorisis page.html start_streaming path traversal

cve-program ·

Vendor product: Anagnorisis

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91121Published

Discourse: Chat upload filenames rendered as raw HTML in excerpts

cve-program ·

Vendor product: discourse

CVSS 3.1 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91122Published

Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

cve-program ·

Vendor product: discourse

CVSS 3.1 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91120Published

Discourse: Stored HTML injection in video notification emails

cve-program ·

Vendor product: discourse

CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-95985Published

Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

cve-program ·

Vendor product: Kiro IDE

CVSS 3.1 8.8 · CVSS 4.0 8.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97226Published

DbGate files-style Endpoint files.js fs.readFile path traversal

cve-program ·

Vendor product: DbGate

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-79758Published

Termix: Authenticated users can read other users' host status and clear global SSH connections

cve-program ·

Vendor product: Termix

CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2024-29992Published

Azure Identity Library for .NET Information Disclosure Vulnerability

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-93541Published

Out-of-bounds read in libXi's XQueryDeviceState()

cve-program ·

Vendor product: libXi

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-79764Published

Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist

cve-program ·

Vendor product: Termix

CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93542Published

Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()

cve-program ·

Vendor product: libXi

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93425Published

Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

cve-program ·

Vendor product: dokploy

CVSS 3.1 9.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93543Published

Out-of-bounds read in libXi's XI2 class parser

cve-program ·

Vendor product: libXi

CVSS 3.1 7.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93544Published

Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing

cve-program ·

Vendor product: libXi

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94612Published

authentik: Authentication bypass via assertion confusion in SAML sources

cve-program ·

Vendor product: authentik

CVSS 3.1 7.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93545Published

Out-of-bounds read in libXi's XListInputDevices()

cve-program ·

Vendor product: libXi

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94281Published

Out-of-bounds read in libXi's XListInputDevices() class parsing

cve-program ·

Vendor product: libXi

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-62368Published

Snipe-IT: Stored XSS via Custom Field name in asset-list column headers

cve-program ·

Vendor product: snipe-it

CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91133Published

Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure

cve-program ·

Vendor product: discourse

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91123Published

Discourse: Reject literal backslash path separators in iframe src traversal guard

cve-program ·

Vendor product: discourse

CVSS 3.1 7.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-79763Published

Termix: MFA-critical operations accept the account password as a sole factor (regression of CVE-2026-45749)

cve-program ·

Vendor product: Termix

CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96744Published

Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel

cve-program ·

Vendor product: Laravel MongoDB (PHP)

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94611Published

authentik: Stored credentials are readable with view permission alone

cve-program ·

Vendor product: authentik

CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-57590Published

Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-47132Published

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

cve-program ·

Vendor product: phpMyFAQ

CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-84302Published

Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

cve-program ·

Vendor product: discourse

CVSS 3.1 4.2Source modified 24 Sep 2026Recorded 23 Oct 2026

MAL-2026-16409Published

Malicious code in ubiquiti-agents-link-mcp (npm)

osv · GHSA-rqpx-hw2h-g3hc

npm: ubiquiti-agents-link-mcp

Source modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-88830Published

Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: busybox

CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94604Rejected

This CVE is a duplicate of another CVE.

cve-program ·

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82409Published

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request witho…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4Source modified 24 Sep 2026Recorded 25 Oct 2026

CVE-2026-82406Published

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 24 Sep 2026Recorded 25 Oct 2026

CVE-2026-82405Published

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Sep 2026Recorded 25 Oct 2026

CVE-2026-61570Published

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS col…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Sep 2026Recorded 25 Oct 2026

GHSA-7p4h-3gxq-x3h3Published

Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118

osv · CVE-2026-56443 · GO-2026-6045

Go: code.gitea.io/gitea · Go: gitea.dev

MODERATESource modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-16672Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96552Published

sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt

cve-program ·

Vendor product: hosp_order

CVSS 4.0 2.3 · CVSS 3.1 3.1 · CVSS 3.0 3.1 · CVSS 2.0 2.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96604Published

SoftNews Media Group DataLife Engine Search search.php strip_data sql injection

cve-program ·

Vendor product: DataLife Engine

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96739Published

SEMCMS KindEditor Upload upload_json.php cross site scripting

cve-program ·

Vendor product: SEMCMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96772Published

Intelliants Subrion CMS actions.json assign-owner information disclosure

cve-program ·

Vendor product: Subrion CMS

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.