Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698835 source statements · aliases may refer to the same vulnerability

CVE-2026-82277Published

Argo Rollouts Dashboard Unauthenticated Mutating Operations

cve-program ·

Vendor product: argo-rollouts

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82276Published

StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

cve-program ·

Vendor product: starrocks

CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82275Published

Qwen-Agent Arbitrary File Read via Caller-Supplied Document Path

cve-program ·

Vendor product: qwen-agent

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82274Published

Twenty Open Redirect via OAuth Propagator Callback

cve-program ·

Vendor product: twenty

CVSS 4.0 5.3 · CVSS 3.1 4.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82273Published

Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

cve-program ·

Vendor product: @mastra/server

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82272Published

Immich Locked Assets Remain Readable Through Albums and Shared Links

cve-program ·

Vendor product: immich

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82271Published

R2R Missing Ownership Check Allows Modifying Other Users' Conversations

cve-program ·

Vendor product: r2r

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82270Published

Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*

cve-program ·

Vendor product: @portkey-ai/gateway

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82269Published

Gophish Account Lockout and Forced Password Change Bypassable via API Key

cve-program ·

Vendor product: gophish

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82268Published

Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL

cve-program ·

Vendor product: qwen-agent

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82267Published

Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check

cve-program ·

Vendor product: komodo

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82266Published

Redpanda Admin API Unauthenticated Superuser Access via Default Configuration

cve-program ·

Vendor product: redpanda

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82265Published

Zipkin Unauthenticated Spring Boot Actuator Endpoints Exposure

cve-program ·

Vendor product: zipkin

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82264Published

Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

cve-program ·

Vendor product: duplicacy

CVSS 4.0 6.1 · CVSS 3.1 6.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82263Published

Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL

cve-program ·

Vendor product: logto

CVSS 4.0 8.2 · CVSS 3.1 6.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-82262Published

Logto Server-Side Request Forgery via webhook test endpoint

cve-program ·

Vendor product: logto

CVSS 4.0 8.2 · CVSS 3.1 6.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81735Published

UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution

cve-program ·

https://github.com/bytedance/UI-TARS-desktop: UI-TARS-desktop

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81731Published

Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

cve-program ·

Vendor product: frappe

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81730Published

Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename

cve-program ·

Vendor product: dolibarr

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81729Published

Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81728Published

Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys

cve-program ·

Vendor product: dolibarr

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-80211Published

FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage

cve-program ·

Vendor product: FrontAccounting

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-80210Published

FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms

cve-program ·

Vendor product: FrontAccounting

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-80209Published

Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler

cve-program ·

Vendor product: fonoster

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-80208Published

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Account Closure Endpoints

cve-program ·

Vendor product: apitable

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-80207Published

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint

cve-program ·

Vendor product: apitable

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-79784Published

Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configuration

cve-program ·

Vendor product: vocos

CVSS 4.0 8.6 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78122Published

docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

cve-program ·

https://hub.docker.com/r/tecnativa/docker-socket-proxy: docker-socket-proxy

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-77067Published

Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

cve-program ·

Vendor product: omnivore

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-77066Published

Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

cve-program ·

Vendor product: omnivore

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-76850Published

LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector

cve-program ·

https://pypi.org: lmdeploy

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-76032Published

Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler

cve-program ·

Vendor product: cells

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75926Published

Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

cve-program ·

Vendor product: hugo

CVSS 4.0 9.3 · CVSS 3.1 8.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75904Published

libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File

cve-program ·

Vendor product: libmodplug

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75898Published

RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

cve-program ·

Vendor product: ragflow

CVSS 4.0 8.4 · CVSS 3.1 8.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75627Published

Bastillion Authentication Bypass via Path-Prefix Routing Mismatch

cve-program ·

Vendor product: Bastillion

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75626Published

SpiderFoot Stored Cross-Site Scripting via Correlation Titles

cve-program ·

Vendor product: spiderfoot

CVSS 4.0 9.3 · CVSS 3.1 9.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75625Published

Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass

cve-program ·

Vendor product: kraken

CVSS 4.0 9.1 · CVSS 3.1 9.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75482Published

SWE-agent Trajectory Inspector Path Traversal File Disclosure

cve-program ·

Vendor product: SWE-agent

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75481Published

SkyPilot Authentication Bypass via Service Account Role Escalation

cve-program ·

Vendor product: skypilot

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75480Published

OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

cve-program ·

Vendor product: OpenViking

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75479Published

JimuReport Unauthenticated Report Listing and Share Token Disclosure

cve-program ·

Vendor product: jimureport

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75111Published

Evidently UI Path Traversal via Dataset Materialization Filename

cve-program ·

Vendor product: evidently

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75110Published

MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

cve-program ·

Vendor product: MemOS

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75109Published

Determined Missing Authorization Check on Generic Task Endpoints

cve-program ·

Vendor product: determined

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75108Published

Next Terminal Missing Per-Asset Authorization on Portal Endpoints

cve-program ·

Vendor product: next-terminal

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75107Published

Grav Form Plugin before 9.1.19 Stored XSS via Field Properties

cve-program ·

Vendor product: grav

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75105Published

phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter

cve-program ·

Vendor product: phpipam

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75104Published

Hugging Face Transformers Path Traversal via Checkpoint Index

cve-program ·

Vendor product: transformers

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-75103Published

Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover

cve-program ·

Vendor product: crawlab

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.