Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698866 source statements · aliases may refer to the same vulnerability

CVE-2026-86583Published

Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

cve-program ·

Vendor product: Import and export users and customers

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81208Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94150Published

Omega Solution HRM OS SVG File Upload view cross site scripting

cve-program ·

Vendor product: HRM OS

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97168Rejected

it is a suggestion

cve-program ·

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96676Published

Fast FAC1900R uhttpd get_alias_name stack-based overflow

cve-program ·

Vendor product: FAC1900R

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94144Published

drogonframework drogon ORM Criteria.cc makeCriteria sql injection

cve-program ·

Vendor product: drogon

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96751Published

pmTicket Project-Management-Software add_project.php setSync sql injection

cve-program ·

Vendor product: Project-Management-Software

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96762Published

kvcache-ai mooncake RPC Path UnmountSegment authorization

cve-program ·

Vendor product: mooncake

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96773Published

Intelliants Subrion CMS Login Page login.php authorize redirect

cve-program ·

Vendor product: Subrion CMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96774Published

SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure

cve-program ·

Vendor product: IP Network Audio Device XC-9603

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96881Published

TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization

cve-program ·

Vendor product: lin-cms-spring-boot

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94137Published

Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 denial of service

cve-program ·

Vendor product: shzh

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96603Published

Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization

cve-program ·

Vendor product: online-makeup-store

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94102Published

WuzhiCMS Login index.php redirect

cve-program ·

Vendor product: WuzhiCMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96680Published

ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

cve-program ·

Vendor product: Coze Scraper Extension

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78806Published

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-12370Published

Remote Code Execution Vulnerability

cve-program ·

Vendor product: ManageEngine OpManager · Vendor product: ManageEngine NetFlow Analyzer · Vendor product: ManageEngine Network Configuration Manager

CVSS 3.1 7.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92628Published

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 3.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92874Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-73589Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerab…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 6.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92529Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88410Published

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.

cve-program ·

Vendor product: n/a

CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96803Published

java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection

cve-program ·

Vendor product: MicroCommunity

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97151Published

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through…

cve-program ·

https://registry.npmjs.org: mammoth

CVSS 4.0 8.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97055Published

SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

cve-program ·

Vendor product: signoz

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88405Published

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97056Published

SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

cve-program ·

Vendor product: signoz

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67827Published

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg…

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-77193Published

eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter

cve-program ·

Vendor product: eesy_ID2WP – Publish InDesign HTML5

CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96880Published

TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization

cve-program ·

Vendor product: lin-cms-spring-boot

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96884Published

MantisZip Preview MainWindow.UI.cs Path.Combine path traversal

cve-program ·

Vendor product: MantisZip

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96892Published

Edimax BR-6428nC goform websRedirect redirect

cve-program ·

Vendor product: BR-6428nC

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78313Published

Improper Access Control in DIAEnergie

cve-program ·

Vendor product: DIAEnergie

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-79320Published

Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textC…

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97152Published

Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf.

cve-program ·

Vendor product: Nanomsg

CVSS 4.0 8.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-36469Published

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94097Published

Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection

cve-program ·

Vendor product: NBR200V2

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-11744Published

PaperCut Hive Embedded App for Ricoh: Javascript injection

cve-program ·

Vendor product: PaperCut Hive

CVSS 4.0 3.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94092Published

dmlc dgl utils.py _read_torch_data deserialization

cve-program ·

Vendor product: dgl

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97181Published

ezGlobal｜GPM LIGHT - Sensitive Data Exposure

cve-program ·

Vendor product: GPM LIGHT

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78311Published

SQL Injection in DIAEnergie

cve-program ·

Vendor product: DIAEnergie

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78310Published

Authorization Bypass Through User-Controlled Key in DIAEnergie

cve-program ·

Vendor product: DIAEnergie

CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78312Published

Path Traversal in DIAEnergie

cve-program ·

Vendor product: DIAEnergie

CVSS 3.1 9.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-15731Published

WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

cve-program ·

Vendor product: WP Multilang – Translation and Multilingual Plugin

CVSS 3.1 6.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-4637Published

Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor

cve-program ·

Vendor product: PRTG Network Monitor

CVSS 4.0 5.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-19532Published

Path Traversal in HAVELSAN's Liman MYS

cve-program ·

Vendor product: Liman MYS

CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-79680Published

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module

cve-program ·

Vendor product: qt

CVSS 4.0 4.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-4638Published

Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor

cve-program ·

Vendor product: PRTG Network Monitor

CVSS 4.0 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94050Published

D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure

cve-program ·

Vendor product: DIR-X1860Z

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 3.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-7169Published

Uncontrolled Search Path Element in Evope Collector

cve-program ·

Vendor product: Evope Collector

CVSS 4.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.