Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698835 source statements · aliases may refer to the same vulnerability

CVE-2026-86112Published

BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

cve-program ·

Vendor product: bookwyrm

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86111Published

BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses

cve-program ·

Vendor product: bookwyrm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85214Published

vhr Missing Authorization in PUT /hr/info Allows Arbitrary Profile Overwrite

cve-program ·

Vendor product: vhr

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85213Published

Kill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints

cve-program ·

Vendor product: killbill

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85212Published

CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check

cve-program ·

Vendor product: CRMEB

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85211Published

Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

cve-program ·

Vendor product: label-studio

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67229Published

RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85183Published

Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

cve-program ·

Vendor product: taipy

CVSS 4.0 9.3 · CVSS 3.1 9.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85182Published

vhr Missing Authorization in PUT /hr/pass Allows Cross-Account Password Change

cve-program ·

Vendor product: vhr

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85181Published

CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

cve-program ·

Vendor product: cat

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85180Published

Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect

cve-program ·

Vendor product: ollama

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85179Published

Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

cve-program ·

Vendor product: label-studio

CVSS 4.0 8.4 · CVSS 3.1 8.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85178Published

Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter

cve-program ·

Vendor product: helicone

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85177Published

CRMEB through 6.0.0 Unauthorized Message Modification via edit_message

cve-program ·

Vendor product: CRMEB

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85176Published

DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

cve-program ·

Vendor product: dbgate

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-85093Published

Cheshire Cat AI Memory Collection Endpoint Information Disclosure

cve-program ·

Vendor product: core

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-84811Published

agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode

cve-program ·

Vendor product: agentverus-scanner

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-84810Published

claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan

cve-program ·

Vendor product: claude-skill-antivirus

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-84809Published

Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

cve-program ·

Vendor product: AI-Infra-Guard · https://pypi.org: aig-skill-scan

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-84715Published

FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update

cve-program ·

Vendor product: FeatherPanel

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-84485Published

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint

cve-program ·

Vendor product: apitable

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-84484Published

ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnv

cve-program ·

Vendor product: ION-DTN

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82882Published

Devtron through 2.2.0 Missing Authorization via webhook API token endpoint

cve-program ·

Vendor product: devtron

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82640Published

browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage

cve-program ·

Vendor product: web-ui

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82639Published

NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure

cve-program ·

Vendor product: NextChat

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82638Published

jina-ai reader Server-Side Request Forgery via disabled private-address guard

cve-program ·

Vendor product: reader

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82637Published

browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

cve-program ·

Vendor product: web-ui

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82457Published

su-exec through 0.3 Privilege Escalation via Numeric User ID

cve-program ·

https://github.com/ncopa/su-exec: su-exec

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82456Published

argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

cve-program ·

https://github.com/argoproj-labs/mcp-for-argocd: argocd-mcp

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82454Published

Omnivore before android-0.227.0 Authentication Bypass via Apple Sign-in

cve-program ·

Vendor product: omnivore

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82453Published

rust-iot-platform Cleartext Password Storage via User Model

cve-program ·

https://github.com/iot-ecology/rust-iot-platform: rust-iot-platform

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82452Published

rust-iot-platform Authentication Bypass via Missing Request Guards

cve-program ·

https://github.com/iot-ecology/rust-iot-platform: rust-iot-platform

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82449Published

Cockpit CMS before 2.14.1 Account Enumeration via Auth Timing

cve-program ·

Vendor product: cockpit

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82448Published

Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

cve-program ·

https://gitlab.com/Shinobi-Systems/Shinobi: Shinobi

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82447Published

Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock

cve-program ·

Vendor product: skyvern

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82306Published

StarRocks Query Detail Endpoint Returns Every User's Query History

cve-program ·

Vendor product: starrocks

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82291Published

HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

cve-program ·

Vendor product: heyform

CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82290Published

Chainlit Feedback Endpoints Missing Ownership Validation

cve-program ·

Vendor product: chainlit

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82289Published

Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure

cve-program ·

Vendor product: gitingest

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82288Published

Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

cve-program ·

Vendor product: stable-diffusion-webui

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82287Published

Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials

cve-program ·

Vendor product: rybbit

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82286Published

gpt-crawler Arbitrary File Write via outputFileName Parameter

cve-program ·

Vendor product: gpt-crawler

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82285Published

BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

cve-program ·

Vendor product: bisheng

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82284Published

Quivr Chat Endpoints Missing Ownership Validation

cve-program ·

Vendor product: quivr

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82283Published

VoltAgent Memory API Handlers Missing Ownership Checks

cve-program ·

Vendor product: @voltagent/server-core

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82282Published

Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

cve-program ·

Vendor product: atlantis

CVSS 4.0 8.8 · CVSS 3.1 8.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82280Published

Quivr Prompt Endpoints Missing Ownership Validation

cve-program ·

Vendor product: quivr

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82279Published

HyperDX Team Management Operations Missing Role-Based Access Control

cve-program ·

Vendor product: hyperdx

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82278Published

BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

cve-program ·

Vendor product: bisheng

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67219Published

RabbitMQ: Consistent-hash exchange unbounded weight

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.0Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.