Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698979 source statements · aliases may refer to the same vulnerability

CVE-2026-18872Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 9.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18181Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 8.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18173Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 3.7Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18162Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 9.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18152Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18131Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 8.2Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18074Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 8.2Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17644Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17620Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-15915Published

Multiple Vulnerabilities in IBM Concert Software

cve-program ·

Vendor product: Concert

CVSS 3.1 6.2Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-4921Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 2.7Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18875Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18153Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 5.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18176Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18163Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 9.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18184Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18095Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 8.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18132Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17645Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 9.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17635Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 9.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17102Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-16346Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 9.9Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94174Published

WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: email-log

CVSS 3.1 7.6Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94461Published

WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ditty-news-ticker

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-81868Published

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

cve-program ·

Vendor product: security-advisories

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-85717Published

AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

cve-program ·

Vendor product: async-http-client

CVSS 3.1 6.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-89412Published

TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel

cve-program ·

Vendor product: TranslatePress – Translate Multilingual sites with AI Translation

CVSS 3.1 7.2Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18439Published

Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter

cve-program ·

Vendor product: Tutor LMS – eLearning and online course solution

CVSS 3.1 4.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91092Published

wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie

cve-program ·

Vendor product: wpForo Forum

CVSS 3.1 4.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93368Published

Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

cve-program ·

Vendor product: Rename wp-login.php to anything you want

CVSS 3.1 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93527Published

WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: live-copy-paste

CVSS 3.1 8.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93618Published

WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

Vendor product: JetTricks

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93623Published

WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: ai-engine

CVSS 3.1 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93773Published

WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: mollie-forms

CVSS 3.1 8.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94080Published

WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: marketking-multivendor-marketplace-for-woocommerce

CVSS 3.1 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94124Published

WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-easycart

CVSS 3.1 8.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94176Published

WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: mangboard

CVSS 3.1 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94391Published

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ultimate-faqs

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94487Published

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: capability-manager-enhanced

CVSS 3.1 8.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94500Published

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: elementskit-lite

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94680Published

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: the-post-grid

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95515Published

WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ninja-forms

CVSS 3.1 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95523Published

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-frontend

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95527Published

WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: conekta-payment-gateway

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95529Published

WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: calculated-fields-form

CVSS 3.1 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95590Published

WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: tainacan

CVSS 3.1 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95593Published

WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: ultimeter

CVSS 3.1 7.6Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95602Published

WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

Vendor product: YITH WooCommerce Request A Quote

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95604Published

WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: tangible-loops-and-logic

CVSS 3.1 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-96548Published

sfturing hosp_order jdbc.properties hard-coded credentials

cve-program ·

Vendor product: hosp_order

CVSS 4.0 6.3 · CVSS 3.1 5.6 · CVSS 3.0 5.6 · CVSS 2.0 5.1Source modified 23 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.