Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699016 source statements · aliases may refer to the same vulnerability

CVE-2026-92881Published

vgmstream AWB parser awb.c init_vgmstream_awb_memory divide by zero

cve-program ·

Vendor product: vgmstream

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18177Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93504Published

SveltyCMS User Attribute Update Endpoint +server.ts access control

cve-program ·

Vendor product: SveltyCMS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-86350Published

Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93533Published

spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

cve-program ·

Vendor product: Scotty

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-86248Published

Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

cve-program ·

Vendor product: Apache Tomcat

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95820Published

anirbandutta9 College-Notes-Gallery userprofile.php admin1 unrestricted upload

cve-program ·

Vendor product: College-Notes-Gallery

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95831Published

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

cve-program ·

https://cpan.org/modules: Crypt-SelfCertificate

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-82331Published

Apache BuildStream: tar source extraction escape

cve-program ·

https://pypi.python.org: buildstream

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2025-59144Published

[email protected] contains malware after npm account takeover

cve-program ·

Vendor product: debug

CVSS 4.0 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-93342Published

MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX

cve-program ·

Vendor product: MarketKing

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-26825Published

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). Th…

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-26824Published

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by o…

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-47116Published

LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH

cve-program ·

Vendor product: LTK3500SF

CVSS 4.0 9.2 · CVSS 3.1 9.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-3418Published

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

cve-program ·

Vendor product: WSO2 API Manager · Vendor product: WSO2 Traffic Manager · Vendor product: WSO2 API Control Plane

CVSS 3.1 9.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18161Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 4.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77987Published

GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

cve-program ·

Vendor product: Enterprise Server

CVSS 4.0 9.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91809Published

Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91808Published

Foxit PDF Editor/Reader JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 6.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91797Published

Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-42801Published

Deference after null check in as_rrc

cve-program ·

Vendor product: Crane，Falcon

CVSS 3.1 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95676Published

AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

cve-program ·

Vendor product: AuthPoint Authentication Gateway

CVSS 4.0 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-86681Published

Broken Access Control vulnerability

cve-program ·

Vendor product: ManageEngine Applications Manager

CVSS 3.1 7.6Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-12974Published

Security Policy Bypass in Forcepoint Security Engine (NGFW)

cve-program ·

Vendor product: Forcepoint Security Engine (NGFW)

CVSS 4.0 7.9Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-71177Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vuln…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 5.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-62998Published

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

cve-program ·

Vendor product: core

CVSS 3.1 4.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-96609Published

Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription command…

cve-program ·

Vendor product: Albatross

CVSS 4.0 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-73858Published

Solspace Freeform: Limited Twig template injection via submitted field values

cve-program ·

Vendor product: craft-freeform

CVSS 3.1 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-92419Published

IDOR in WEBCON BPS

cve-program ·

Vendor product: WEBCON BPS

CVSS 4.0 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94536Published

lamp-cloud through 5.10.0 Unauthorized Information Disclosure via /anyone/visible/resource

cve-program ·

Vendor product: lamp-cloud

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-88339Published

A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a…

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-88345Published

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex() dereferences the input pointer after i…

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-94625Published

vLLM through 0.29.0 Resource Exhaustion via Ownerless Mooncake Transfer Placeholders

cve-program ·

Vendor product: vllm

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-83801Published

Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

cve-program ·

Vendor product: nautobot

CVSS 3.1 5.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77322Published

SIPGO: DoS via unvalidated WebSocket frame length

cve-program ·

Vendor product: sipgo

CVSS 3.1 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77426Published

Unleash: Missing await on permission check + cross-project IDOR in admin API

cve-program ·

Vendor product: unleash

CVSS 4.0 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-73433Published

Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

cve-program ·

https://gitlab.freedesktop.org/gstreamer/gst-plugins-good: gst-plugins-good · https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-good · https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-good

CVSS 3.1 6.6Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18649Published

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-good · https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-good · https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-good

CVSS 3.1 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-73434Published

Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

cve-program ·

CVSS 3.1 6.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-96260Published

Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

cve-program ·

Vendor product: Mattermost

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-88020Published

Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3

cve-program ·

Vendor product: OpenPLC Runtime

CVSS 3.1 6.1 · CVSS 4.0 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77912Published

Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline

cve-program ·

Vendor product: Enterprise Server

CVSS 4.0 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-75101Published

Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collision

cve-program ·

Vendor product: Enterprise Server

CVSS 4.0 6.0Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2025-36084Published

Multiple Vulnerabilities in IBM Concert Software

cve-program ·

Vendor product: Concert

CVSS 3.1 5.9Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-16469Published

DataStage on Cloud Pak for Data has several vulnerabilities

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17618Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17643Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18066Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.9Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18124Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95897Published

Dask Loader core.py from_npy_stack deserialization

cve-program ·

Vendor product: Dask

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.