Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698835 source statements · aliases may refer to the same vulnerability

CVE-2026-91995Published

pig before 4.1.0 Unverified Password Change via /register/password

cve-program ·

Vendor product: pig

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91994Published

Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

cve-program ·

Vendor product: semaphore

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91993Published

Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list

cve-program ·

Vendor product: Jpom

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91939Published

Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

cve-program ·

Vendor product: Cotonti

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91925Published

Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine

cve-program ·

Vendor product: polyaxon

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91924Published

pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

cve-program ·

Vendor product: pgweb

CVSS 4.0 8.4 · CVSS 3.1 8.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91923Published

KubeSphere through 4.1.3 SSRF via git credential verification endpoint

cve-program ·

Vendor product: kubesphere

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91922Published

Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

cve-program ·

Vendor product: steedos-platform

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91774Published

Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

cve-program ·

Vendor product: yao

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91773Published

Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks

cve-program ·

Vendor product: soft-serve

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91772Published

Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

cve-program ·

Vendor product: halo

CVSS 3.1 6.1 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91771Published

Weights & Biases wandb before 0.29.0 Path Traversal via File Download

cve-program ·

Vendor product: wandb

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91770Published

IceHRM before 36.0.0 Broken Access Control via Employee ID

cve-program ·

Vendor product: icehrm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91752Published

GNU libextractor before 1.15 Stack Overflow via OLE2

cve-program ·

Vendor product: libextractor

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91751Published

Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API

cve-program ·

Vendor product: flextype

CVSS 4.0 7.2 · CVSS 3.1 8.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91750Published

WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

cve-program ·

Vendor product: WeKnora

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-9141Published

Taiko AG1000-01A Rev 7.3/8 Authentication Bypass via Web Interface

cve-program ·

Vendor product: AG1000-01A SMS Alert Gateway

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91201Published

DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

cve-program ·

Vendor product: DocsGPT

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91200Published

DevSpace through 6.3.21 Path Traversal via tar extraction

cve-program ·

Vendor product: devspace

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91199Published

Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

cve-program ·

Vendor product: refly

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91198Published

GrowthBook through 5.0.1 Information Disclosure via Public Endpoints

cve-program ·

Vendor product: growthbook

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91197Published

Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory

cve-program ·

Vendor product: flowable-engine

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91146Published

Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme

cve-program ·

Vendor product: takahe

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91145Published

Activiti through 7.1.0.M6 Expression Injection via Mail Task

cve-program ·

Vendor product: Activiti

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91144Published

ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint

cve-program ·

Vendor product: zfile

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91143Published

goproxy through 15.3 Authentication Bypass via CONNECT

cve-program ·

Vendor product: goproxy

CVSS 4.0 6.9 · CVSS 3.1 7.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91081Published

Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

cve-program ·

Vendor product: docs

CVSS 4.0 6.9 · CVSS 3.1 5.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91080Published

webhook through 2.8.3 Memory Exhaustion via Oversized Request Body

cve-program ·

Vendor product: webhook

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-91079Published

Huly Platform through 0.7.426 SSRF via Print Service

cve-program ·

Vendor product: platform

CVSS 4.0 6.3 · CVSS 3.1 8.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90946Published

DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket

cve-program ·

Vendor product: deepwiki-open

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90945Published

Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

cve-program ·

Vendor product: crawlab

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90944Published

Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse

cve-program ·

Vendor product: laravel-crm

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90942Published

Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

cve-program ·

Vendor product: casdoor

CVSS 4.0 9.3 · CVSS 3.1 9.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90941Published

novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint

cve-program ·

Vendor product: novel-plus

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90940Published

novel-plus through 5.3.3 Default Cache Management Password in the Front Portal

cve-program ·

Vendor product: novel-plus

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90939Published

novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

cve-program ·

Vendor product: novel-plus

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90780Published

SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content

cve-program ·

Vendor product: sipp

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90779Published

SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter

cve-program ·

Vendor product: sipp

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90778Published

SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag

cve-program ·

Vendor product: sipp

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90777Published

ESPnet before 202609 Remote Code Execution via Unsafe Deserialization

cve-program ·

Vendor product: espnet

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90776Published

Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

cve-program ·

Vendor product: nodemailer

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90774Published

rustypaste before 0.18.1 Path Traversal via filename header

cve-program ·

Vendor product: rustypaste

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90773Published

procs through 0.14.12 Terminal Escape Sequence Injection via Command

cve-program ·

Vendor product: procs

CVSS 4.0 2.4 · CVSS 3.1 3.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90772Published

Amundsen Frontend through 4.3.0 Stored XSS via Description

cve-program ·

Vendor product: amundsen-frontend

CVSS 4.0 8.3 · CVSS 3.1 7.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90771Published

joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

cve-program ·

Vendor product: joi

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90770Published

Spug through 3.4.0 Remote Code Execution via ping_check

cve-program ·

Vendor product: spug

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90769Published

Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

cve-program ·

Vendor product: open-notebook

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90768Published

CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

cve-program ·

Vendor product: CAPEv2

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90767Published

Froxlor before 2.3.12 SSH Key Injection via authorized_keys

cve-program ·

Vendor product: Froxlor

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90562Published

LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

cve-program ·

Vendor product: LangBot

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.