Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698835 source statements · aliases may refer to the same vulnerability

CVE-2026-63002Published

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

cve-program ·

Vendor product: core

CVSS 3.1 4.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67240Published

RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 2.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96600Published

Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

cve-program ·

Vendor product: isotope-core

CVSS 4.0 7.0 · CVSS 3.1 5.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96599Published

Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

cve-program ·

Vendor product: isotope-core

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96560Published

LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel

cve-program ·

Vendor product: LightLLM

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96271Published

Photoview through 2.4.0 Authorization Bypass via shareAlbum

cve-program ·

Vendor product: photoview

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93873Published

Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin

cve-program ·

Vendor product: Cotonti

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93872Published

Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

cve-program ·

Vendor product: Cotonti

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93871Published

Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix

cve-program ·

Vendor product: Cotonti

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93870Published

Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler

cve-program ·

Vendor product: Cotonti

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93869Published

Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex

cve-program ·

Vendor product: Cotonti

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93868Published

Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

cve-program ·

Vendor product: Cotonti

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93841Published

vLLM through 0.29.0 Adjacent-Request Sampler State Corruption via Unvalidated Prompt Token IDs

cve-program ·

Vendor product: vllm

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93840Published

vLLM before 0.29.0 Cross-Request Logits Corruption via allowed_token_ids

cve-program ·

Vendor product: vllm

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93839Published

LightLLM through 1.2.0 Missing Authentication in PD Master /pd_register WebSocket Endpoint

cve-program ·

Vendor product: LightLLM

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93838Published

SGLang through 0.5.20 Unbounded Memory Allocation via STAGING_REQ chunk_idx

cve-program ·

https://pypi.org/project/sglang: sglang

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93752Published

CSSOM through 0.5.0 Denial of Service via length Property

cve-program ·

Vendor product: CSSOM

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93751Published

uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

cve-program ·

Vendor product: uri-js

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93750Published

http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard

cve-program ·

Vendor product: http-cache-semantics

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93749Published

source-map-js through 1.2.1 Event Loop Denial of Service

cve-program ·

Vendor product: source-map-js

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93690Published

uri-js through 4.4.1 Denial of Service via removeDotSegments

cve-program ·

https://www.npmjs.com/package/uri-js: uri-js

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93689Published

WinFsp through 2.2.26215 NULL Pointer Dereference via Fast I/O

cve-program ·

Vendor product: winfsp

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93456Published

django-page-cms through 2.0.13 CSRF via admin mutation views

cve-program ·

Vendor product: django-page-cms

CVSS 4.0 8.4 · CVSS 3.1 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93455Published

django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

cve-program ·

Vendor product: django-page-cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-93436Published

vLLM through 0.29.0 Memory Exhaustion via Rejected Requests

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92987Published

roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

cve-program ·

Vendor product: roxmltree

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92921Published

admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5

cve-program ·

Vendor product: admin3

CVSS 3.1 4.9 · CVSS 4.0 6.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92920Published

admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled

cve-program ·

Vendor product: admin3

CVSS 3.1 5.4 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92919Published

admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename

cve-program ·

Vendor product: admin3

CVSS 3.1 8.1 · CVSS 4.0 7.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92918Published

admin3 through 3.0.0 Session Token Disclosure via Audit Log

cve-program ·

Vendor product: admin3

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92720Published

Kubero through 3.1.1 Unauthenticated Notifications API Access

cve-program ·

https://github.com/kubero-dev/kubero: kubero

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92719Published

Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

cve-program ·

https://github.com/quickwit-oss/quickwit: quickwit

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92718Published

Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

cve-program ·

https://github.com/projectdiscovery/nuclei: nuclei

CVSS 4.0 7.0 · CVSS 3.1 7.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92717Published

Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub

cve-program ·

https://github.com/cobbr/Covenant: Covenant

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92716Published

Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation

cve-program ·

https://github.com/Shuffle/Shuffle: Shuffle

CVSS 4.0 8.6 · CVSS 3.1 9.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92605Published

IRIS through 2.4.29 Unauthorized Comment Access via Object ID

cve-program ·

https://github.com/dfir-iris/iris-web: iris-web

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92604Published

Scirius through 3.8.0 Arbitrary File Write via PCAP Upload

cve-program ·

https://github.com/StamusNetworks/scirius: scirius

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92603Published

ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController

cve-program ·

https://github.com/continew-org/continew-admin: continew-admin

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92602Published

TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

cve-program ·

https://github.com/TDuckCloud/tduck-survey-form: tduck-survey-form

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92601Published

Guns through 8.3.5 Improper Access Control via SysNoticeController

cve-program ·

https://github.com/stylefeng/Guns: Guns

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92600Published

Guns through 8.3.5 Information Disclosure via Missing Permission Check

cve-program ·

https://github.com/stylefeng/Guns: Guns

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92570Published

reNgine through 2.2.0 Unauthorized Configuration File Read

cve-program ·

Vendor product: rengine

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92569Published

Hippo4j through 1.5.0 SSRF via clientAddress Parameter

cve-program ·

Vendor product: hippo4j

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92568Published

MLRun through 1.11.0 Server-Side Request Forgery via Webhook

cve-program ·

Vendor product: mlrun

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92567Published

TDuck survey form through 5.0 Unauthorized Data Modification

cve-program ·

Vendor product: tduck-survey-form

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92566Published

DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview

cve-program ·

Vendor product: datagear

CVSS 3.1 8.2 · CVSS 4.0 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92000Published

adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

cve-program ·

https://www.npmjs.com/package/adm-zip: adm-zip

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91998Published

Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp

cve-program ·

Vendor product: casdoor

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91997Published

evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

cve-program ·

Vendor product: evolution-api

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91996Published

lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint

cve-program ·

Vendor product: lamp-cloud

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.