Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698903 source statements · aliases may refer to the same vulnerability

CVE-2026-6925Published

Multiple Vulnerabilities in IBM Concert Software

cve-program ·

Vendor product: Concert

CVSS 3.1 5.3Source modified 24 Sep 2026Recorded 23 Oct 2026

MAL-2026-17162Published

Malicious code in simple-date-formatter-new-16 (npm)

osv ·

npm: simple-date-formatter-new-16

Source modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-80379Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-19125Published

EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

cve-program ·

Vendor product: EthPress – Web3 Login

CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

MAL-2026-17154Published

Malicious code in @nf-addons/am-global-header (npm)

osv ·

npm: @nf-addons/am-global-header

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17153Published

Malicious code in @birbalo/aliftech-ui (npm)

osv ·

npm: @birbalo/aliftech-ui

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17155Published

Malicious code in @osl-design/react (npm)

osv ·

npm: @osl-design/react

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17156Published

Malicious code in aliftech-ui (npm)

osv ·

npm: aliftech-ui

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17160Published

Malicious code in simple-date-formatter-new-14 (npm)

osv ·

npm: simple-date-formatter-new-14

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17158Published

Malicious code in simple-date-formatter-new-11 (npm)

osv ·

npm: simple-date-formatter-new-11

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17159Published

Malicious code in simple-date-formatter-new-13 (npm)

osv ·

npm: simple-date-formatter-new-13

Source modified 24 Sep 2026Recorded 24 Oct 2026

MAL-2026-17161Published

Malicious code in simple-date-formatter-new-15 (npm)

osv ·

npm: simple-date-formatter-new-15

Source modified 24 Sep 2026Recorded 24 Oct 2026

CVE-2026-80425Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81536Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92530Published

Use of Less Trusted Source in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-59980Published

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

cve-program ·

Vendor product: hpack

CVSS 4.0 6.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-86583Published

Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

cve-program ·

Vendor product: Import and export users and customers

CVSS 3.1 8.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-81208Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 7.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94150Published

Omega Solution HRM OS SVG File Upload view cross site scripting

cve-program ·

Vendor product: HRM OS

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97168Rejected

it is a suggestion

cve-program ·

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96676Published

Fast FAC1900R uhttpd get_alias_name stack-based overflow

cve-program ·

Vendor product: FAC1900R

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94144Published

drogonframework drogon ORM Criteria.cc makeCriteria sql injection

cve-program ·

Vendor product: drogon

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96751Published

pmTicket Project-Management-Software add_project.php setSync sql injection

cve-program ·

Vendor product: Project-Management-Software

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96762Published

kvcache-ai mooncake RPC Path UnmountSegment authorization

cve-program ·

Vendor product: mooncake

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96773Published

Intelliants Subrion CMS Login Page login.php authorize redirect

cve-program ·

Vendor product: Subrion CMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96774Published

SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure

cve-program ·

Vendor product: IP Network Audio Device XC-9603

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96881Published

TaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization

cve-program ·

Vendor product: lin-cms-spring-boot

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94137Published

Hangzhou Shunwang Technology shzh IRP_MJ_DEVICE_CONTROL shdrv_x64.sys sub_180004AC0 denial of service

cve-program ·

Vendor product: shzh

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96603Published

Abdurrab5 online-makeup-store Admin functions.php confirm_user authorization

cve-program ·

Vendor product: online-makeup-store

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-94102Published

WuzhiCMS Login index.php redirect

cve-program ·

Vendor product: WuzhiCMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96680Published

ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization

cve-program ·

Vendor product: Coze Scraper Extension

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78806Published

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-12370Published

Remote Code Execution Vulnerability

cve-program ·

Vendor product: ManageEngine OpManager · Vendor product: ManageEngine NetFlow Analyzer · Vendor product: ManageEngine Network Configuration Manager

CVSS 3.1 7.6Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92628Published

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 3.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92874Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 5.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-73589Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerab…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 6.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-92529Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88410Published

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.

cve-program ·

Vendor product: n/a

CVSS 3.1 7.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96803Published

java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection

cve-program ·

Vendor product: MicroCommunity

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97151Published

mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through…

cve-program ·

https://registry.npmjs.org: mammoth

CVSS 4.0 8.4Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97055Published

SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

cve-program ·

Vendor product: signoz

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-88405Published

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-97056Published

SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

cve-program ·

Vendor product: signoz

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-67827Published

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg…

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-77193Published

eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter

cve-program ·

Vendor product: eesy_ID2WP – Publish InDesign HTML5

CVSS 3.1 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96880Published

TaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization

cve-program ·

Vendor product: lin-cms-spring-boot

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96884Published

MantisZip Preview MainWindow.UI.cs Path.Combine path traversal

cve-program ·

Vendor product: MantisZip

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-96892Published

Edimax BR-6428nC goform websRedirect redirect

cve-program ·

Vendor product: BR-6428nC

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-78313Published

Improper Access Control in DIAEnergie

cve-program ·

Vendor product: DIAEnergie

CVSS 3.1 6.5Source modified 24 Sep 2026Recorded 23 Oct 2026

CVE-2026-79320Published

Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textC…

cve-program ·

Vendor product: n/a

Source modified 24 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.