Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698835 source statements · aliases may refer to the same vulnerability

CVE-2026-90561Published

Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

cve-program ·

Vendor product: strapi

CVSS 4.0 9.3 · CVSS 3.1 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90474Published

MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

cve-program ·

Vendor product: mcphub

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90473Published

msgpack-java through 0.9.12 Integer Overflow via MAP32

cve-program ·

Vendor product: msgpack-java

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-95846Published

Moquette publishes Last-Will messages without enforcing write authorization

cve-program ·

Vendor product: moquette

CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-90472Published

msgpack-java through 0.9.12 Stack Overflow via Nested Arrays

cve-program ·

Vendor product: msgpack-java

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89266Published

stb_vorbis through 1.22 heap buffer overflow via codebook multiplicands

cve-program ·

Vendor product: stb_vorbis

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89265Published

MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint

cve-program ·

Vendor product: MoguBlog

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89264Published

MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity

cve-program ·

Vendor product: MoguBlog

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89263Published

MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

cve-program ·

Vendor product: MoguBlog

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89262Published

MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

cve-program ·

Vendor product: MoguBlog

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89261Published

MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

cve-program ·

Vendor product: MoguBlog

CVSS 3.1 6.5 · CVSS 4.0 6.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89260Published

MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

cve-program ·

Vendor product: MoguBlog

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89147Published

Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read

cve-program ·

Vendor product: Net-SNMP

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-89146Published

libp2p-rendezvous through 0.17.1 Denial of Service via Unbounded Registration TTL in Discovery Responses

cve-program ·

https://crates.io: libp2p-rendezvous

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88959Published

Anchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints

cve-program ·

https://packagist.org: anchorcms/anchor-cms

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-87930Published

MaxSite CMS through 109.6 PHP Object Injection via ci_session

cve-program ·

Vendor product: MaxSite CMS

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-87929Published

MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

cve-program ·

Vendor product: MaxSite CMS

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-87928Published

MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

cve-program ·

Vendor product: MaxSite CMS

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-87927Published

MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher

cve-program ·

Vendor product: MaxSite CMS

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86544Published

knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions

cve-program ·

Vendor product: knowns

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86543Published

knowns before 0.30.0 Unauthenticated Management API Exposure

cve-program ·

Vendor product: knowns

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86542Published

knowns before 0.30.0 Path Traversal via Import Name

cve-program ·

Vendor product: knowns

CVSS 4.0 8.8 · CVSS 3.1 9.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86541Published

knowns before 0.30.0 Path Traversal via code.replace MCP action

cve-program ·

Vendor product: knowns

CVSS 4.0 7.2 · CVSS 3.1 8.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86540Published

knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

cve-program ·

Vendor product: knowns

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86539Published

knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

cve-program ·

Vendor product: knowns

CVSS 4.0 6.9 · CVSS 3.1 7.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86538Published

knowns before 0.30.0 Path Traversal via templateFile parameter

cve-program ·

Vendor product: knowns

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86439Published

knowns before 0.30.0 Path Traversal via MCP doc and memory tools

cve-program ·

Vendor product: knowns

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86259Published

OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

cve-program ·

Vendor product: OpenMAIC

CVSS 4.0 9.0 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86258Published

nbviewer through 1.0.1 Path Traversal via LocalFileHandler

cve-program ·

Vendor product: nbviewer

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86178Published

Pixelfed through 0.12.9 Unauthorized Story Access via API

cve-program ·

Vendor product: pixelfed

CVSS 3.1 5.4 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86177Published

Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

cve-program ·

Vendor product: panel

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86176Published

NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

cve-program ·

Vendor product: netbox

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86175Published

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

cve-program ·

Vendor product: netbox

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86174Published

Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

cve-program ·

Vendor product: plane

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86173Published

MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

cve-program ·

Vendor product: mindsdb

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86169Published

Axolotl before 0.19.0 Remote Code Execution via Multipack Patching

cve-program ·

Vendor product: axolotl

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86124Published

AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server

cve-program ·

Vendor product: AutoAgent

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86123Published

SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints

cve-program ·

Vendor product: sqlchat

CVSS 4.0 9.4 · CVSS 3.1 8.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86122Published

Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

cve-program ·

Vendor product: rowboat

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86121Published

Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

cve-program ·

Vendor product: cua-computer-server

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86120Published

APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard

cve-program ·

Vendor product: apitable

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86119Published

Webstudio through 0.296.0 SSRF via /cgi proxy routes

cve-program ·

Vendor product: webstudio

CVSS 4.0 9.2 · CVSS 3.1 8.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86118Published

gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

cve-program ·

Vendor product: gonic

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86117Published

Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

cve-program ·

Vendor product: coolify

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86116Published

Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

cve-program ·

Vendor product: metabase

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86115Published

Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path

cve-program ·

Vendor product: sim

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86114Published

Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints

cve-program ·

Vendor product: arcane

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86113Published

BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records

cve-program ·

Vendor product: bookwyrm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86112Published

BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

cve-program ·

Vendor product: bookwyrm

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86111Published

BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

cve-program ·

Vendor product: bookwyrm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.