Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698979 source statements · aliases may refer to the same vulnerability

CVE-2026-94679Published

WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: fluent-support

CVSS 3.1 5.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-96758Published

orval @orval/core before 8.28.0 Code Injection via Form-Data

cve-program ·

Vendor product: orval

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95514Published

WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

cve-program ·

https://wordpress.org/plugins: netgsm

CVSS 3.1 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95525Published

WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-frontend

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95586Published

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ultimate-addons-for-contact-form-7

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-28183Published

WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

cve-program ·

https://wordpress.org/plugins: capability-manager-enhanced

CVSS 3.1 7.2Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-76805Published

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 23 Sep 2026Recorded 25 Oct 2026

GHSA-x5c9-v98j-722rPublished

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

osv · CVE-2026-56675

npm: 9router

HIGHSource modified 23 Sep 2026Recorded 24 Oct 2026

GHSA-vmjq-hvgq-2wv4Published

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

osv · CVE-2026-56679

npm: 9router

HIGHSource modified 23 Sep 2026Recorded 24 Oct 2026

GHSA-cmhj-wh2f-9cgxPublished

9router: Image prefetch DNS rebinding allows SSRF to internal services

osv · CVE-2026-56676

npm: 9router

HIGHSource modified 23 Sep 2026Recorded 24 Oct 2026

GHSA-6mwv-4mrm-5p3mPublished

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

osv · CVE-2026-56678

npm: 9router

MODERATESource modified 23 Sep 2026Recorded 24 Oct 2026

CVE-2026-84298Published

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map bef…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-95601Published

WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woo-product-filter

CVSS 3.1 9.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-61628Published

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the han…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-96808Published

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A maliciou…

cve-program ·

Vendor product: Flatpak

CVSS 3.1 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-79310Published

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompi…

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77403Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enfor…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77404Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77406Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQ…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77407Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.op…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77408Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77410Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77411Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the de…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.5Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77412Published

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-93970Published

aiyiyi121 SxDevOps Settings settings.py hard-coded credentials

cve-program ·

Vendor product: SxDevOps

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-79664Published

Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil E…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1 · CVSS 3.1 · [email protected] · Secondary 7.4Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-79669Published

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 4.3Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-45723Published

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 2.7Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-58268Published

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is en…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-61685Published

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.$…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-63458Published

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-63627Published

mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to validate fee-sponsored calldata but did not reject trailing bytes. A client could app…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-64684Published

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-65829Published

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrar…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-75523Published

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint passes recorded request URIs thro…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-76909Published

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77322Published

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transport_ws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length be…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77425Published

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-77426Published

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-79767Published

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compar…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 23 Sep 2026Recorded 25 Oct 2026

CVE-2026-87022Published

Apache Tomcat: WebSocket message smuggling with per-message-deflate

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-86247Published

Apache Tomcat Native: Client certificate requirements can be down-graded

cve-program ·

Vendor product: Apache Tomcat Native

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-86246Published

Apache Tomcat Native: Insecure OpenSSL options enabled

cve-program ·

Vendor product: Apache Tomcat Native

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-86243Published

Apache Tomcat Native: DoS via TLS handshake

cve-program ·

Vendor product: Apache Tomcat Native

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-79677Published

Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-78437Published

Apache Tomcat: HTTP/2 DoS via malformed request

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-78383Published

Apache Tomcat: AJP DoS via missing request body

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77791Published

Apache Tomcat: DoS via busy wait during WebSocket close

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77756Published

Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-75973Published

Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.