Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698828 source statements · aliases may refer to the same vulnerability

CVE-2026-96810Published

huanzi-qch base-admin Add User CommonController.java save cross site scripting

cve-program ·

Vendor product: base-admin

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96891Published

D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write

cve-program ·

Vendor product: DIR-825

CVSS 4.0 9.3 · CVSS 3.1 9.8 · CVSS 3.0 9.8 · CVSS 2.0 10.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97057Published

redis-parser through 3.0.0 Denial of Service via Invalid Array Length

cve-program ·

Vendor product: redis-parser

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97224Published

Excalidraw Imported File restore.ts cross site scripting

cve-program ·

Vendor product: Excalidraw

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-63203Published

Logto: Account API can disclose stored third-party provider tokens without the identities scope

cve-program ·

Vendor product: logto

CVSS 3.1 7.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97362Published

HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread

cve-program ·

Vendor product: hfs2

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

GHSA-2fcr-jfvc-vgg2Published

Gitea: Two SSRF findings

osv · CVE-2026-58314 · GO-2026-6038

Go: code.gitea.io/gitea

HIGHSource modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-77581Published

BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass

cve-program ·

Vendor product: bentopdf

CVSS 3.1 8.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2025-32000Published

Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.

cve-program ·

Vendor product: HCL Sametime

CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

MAL-2026-17166Published

Malicious code in cache-swipper (npm)

osv ·

npm: cache-swipper

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17165Published

Malicious code in c2-client (npm)

osv ·

npm: c2-client

Source modified 24 Sep 2026Recorded 24 Oct 2026

GHSA-4xjf-493q-98p3Published

Gitea SSH Key Parser Denial of Service

osv · CVE-2026-56657 · GO-2026-6042

Go: code.gitea.io/gitea · Go: gitea.dev

MODERATESource modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-77246Published

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 7.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91129Published

Home Assistant: mDNS Server-Side Request Forgery

cve-program ·

Vendor product: core

CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-77248Published

MCP Atlassian: Unauthenticated arbitrary local file read via upload_attachment file_path, chained with missing auth on streamable-http transport

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 8.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82409Published

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

cve-program ·

Vendor product: klever-go

CVSS 4.0 8.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82406Published

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

cve-program ·

Vendor product: klever-go

CVSS 4.0 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81549Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 9.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67224Published

RabbitMQ: Admin path-traversal write via trace name

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 2.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96601Published

Abdurrab5 online-makeup-store Admin Login index.php sql injection

cve-program ·

Vendor product: online-makeup-store

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-61570Published

MPXJ: XXE Vulnerability in MerlinReader

cve-program ·

Vendor product: mpxj

CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96898Published

yhx070424 ShopXO Ueditor Upload ueditor.php path traversal

cve-program ·

Vendor product: ShopXO

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-63628Published

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-supplied access_list from a 0x78 FeePayerEnvelope without validating its length or…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 24 Sep 2026Recorded 25 Oct 2026

CVE-2026-59167Published

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler at…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 24 Sep 2026Recorded 25 Oct 2026

CVE-2026-97179Published

O2OA Cipher Connection CipherConnectionAction.java list information disclosure

cve-program ·

Vendor product: O2OA

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 24 Sep 2026Recorded 23 Oct 2026

GHSA-6rf4-v2fh-m6p4Published

SunEditor: Critical XSS vulnerability - sanitizer bypass

osv · CVE-2026-59167

npm: suneditor

CRITICALSource modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-4806Published

Custom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset

cve-program ·

Vendor product: Custom Thank You Page for WooCommerce

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82405Published

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

cve-program ·

Vendor product: klever-go

CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67238Published

RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-66080Published

RabbitMQ: Super-stream partitions unbounded allocation

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 5.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-66068Published

RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 5.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67235Published

RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67232Published

RabbitMQ: Web-MQTT decompression bomb

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-6718Published

Multiple Vulnerabilities in IBM Concert Software

cve-program ·

Vendor product: Concert

CVSS 3.1 6.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-80423Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-18467Published

Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter

cve-program ·

Vendor product: Paytium: Mollie payment forms & donations

CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-18335Published

Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter

cve-program ·

Vendor product: Kirki – Freeform Page Builder, Website Builder & Customizer

CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-58008Published

Unchecked HKDF key-size input in EL3 causes a stack buffer overflow

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-58007Published

Unchecked SDM mailbox response address enables EL3 secure-memory corruption

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-58006Published

Altera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-58005Published

Unvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3.

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-58004Published

Crafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware.

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97360Published

HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine

cve-program ·

Vendor product: hfs2

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-13467Published

Systemic Missing Address Validation in SiP SMC Handlers

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

GHSA-25hc-qcg6-38wjPublished

socket.io has an unhandled 'error' event

osv · CVE-2024-38355

npm: socket.io · npm: socket.io

MODERATESource modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-13466Published

Unit Confusion in VAB Authentication

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-12227Published

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

cve-program ·

Vendor product: Visual Composer Website Builder

CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-13465Published

EL3 Stack Buffer Overflow in FCS HKDF Request

cve-program ·

Vendor product: Trusted Firmware

CVSS 4.0 8.3 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-77707Published

TLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render Engine

cve-program ·

Vendor product: Liman Render Engine

CVSS 3.1 5.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-51995Published

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.