Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699016 source statements · aliases may refer to the same vulnerability

CVE-2026-19202Published

Token Cache Reuse in mcp-toolbox-sdk-python

cve-program ·

Vendor product: mcp-toolbox-sdk-python

CVSS 4.0 9.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18137Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 8.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-18172Published

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

cve-program ·

Vendor product: Financial Transaction Manager (FTM) for RedHat OpenShift

CVSS 3.1 7.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-88341Published

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration (num_buffers=0) that triggers an assertion failure in yr_ar…

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-92928Published

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account t…

cve-program ·

Vendor product: Apex Network Video Recorder (NVR)

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-92929Published

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to by…

cve-program ·

Vendor product: Apex Network Video Recorder (NVR)

CVSS 3.1 5.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95830Published

theRealSain Pixtream post_upload.php unrestricted upload

cve-program ·

Vendor product: Pixtream

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95925Published

SourceCodester Online Reviewer Management System btn_functions.php update sql injection

cve-program ·

Vendor product: Online Reviewer Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-88415Published

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-95930Published

iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery

cve-program ·

Vendor product: astron-agent

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-17465Published

Multiple Vulnerabilities in IBM Concert Software

cve-program ·

Vendor product: Concert

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-88624Published

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.

cve-program ·

Vendor product: n/a

Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-50227Published

MQTT WebSocket Command Execution Vulnerability in NitroSense

cve-program ·

Vendor product: NitroSense V5

CVSS 4.0 6.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-50228Published

Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense

cve-program ·

Vendor product: NitroSense V5

CVSS 4.0 6.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-92378Published

uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login

cve-program ·

Vendor product: uniFLOW Online

CVSS 4.0 4.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91790Published

Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91791Published

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91792Published

Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91794Published

Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91795Published

Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91796Published

Foxit PDF Editor/Reader importIcon NTLM Response Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 6.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91793Published

Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91805Published

Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handling

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91800Published

Foxit PDF Editor installer local privilege escalation

cve-program ·

Vendor product: Foxit PDF Editor

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91801Published

Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-84791Published

Broken Access Control vulnerability

cve-program ·

Vendor product: ManageEngine OpManager · Vendor product: ManageEngine Firewall Analyzer

CVSS 3.1 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91802Published

Foxit PDF Editor/Reader — Heap Buffer Overflow in WebP Image Decoding via Bitmap Stride Confusion

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91799Published

Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91804Published

Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While Rendering

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91806Published

Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91807Published

Foxit PDF Editor/Reader PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 6.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91798Published

Foxit PDF Editor/Reader Updater Privilege Escalation

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91803Published

Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijacking

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91810Published

Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 6.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91811Published

Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91812Published

Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 7.9Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-91813Published

Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability

cve-program ·

Vendor product: Foxit PDF Editor · Vendor product: Foxit PDF Reader

CVSS 3.1 8.8Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-75728Published

Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-89275Published

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 10.0Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-82011Published

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 9.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-73369Published

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

cve-program ·

Vendor product: Adobe Campaign Classic

CVSS 3.1 10.0Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77244Published

[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 10.0Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77252Published

MCP Atlassian: JIRA_PROJECTS_FILTER and CONFLUENCE_SPACES_FILTER can be bypassed in search tools

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 6.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77261Published

MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 7.1Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-80444Published

Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS

cve-program ·

Vendor product: AVESİS

CVSS 3.1 5.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77257Published

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

cve-program ·

Vendor product: mcp-atlassian

CVSS 4.0 8.3Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77272Published

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 5.4Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-77268Published

MCP Atlassian: Insecure File Permissions on OAuth Token Storage

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 5.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-89277Published

CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: Content Credentials Command-Line Tool

CVSS 3.1 5.5Source modified 23 Sep 2026Recorded 23 Oct 2026

CVE-2026-75632Published

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: Content Credentials Command-Line Tool

CVSS 3.1 7.5Source modified 23 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.