Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699075 source statements · aliases may refer to the same vulnerability

MAL-2026-12750Published

Malicious code in devplatform-sdk (npm)

osv · GHSA-24m2-6frm-vxj3

npm: devplatform-sdk

Source modified 23 Sep 2026Recorded 24 Oct 2026

MAL-2026-14288Published

Malicious code in @wizloft/harness-plugin-repository-files (npm)

osv · GHSA-p4gf-f4rj-hfh8

npm: @wizloft/harness-plugin-repository-files

Source modified 23 Sep 2026Recorded 24 Oct 2026

MAL-2026-14136Published

Malicious code in agora402-payment-utils (npm)

osv · GHSA-pvr5-m9hx-xxfr

npm: agora402-payment-utils

Source modified 23 Sep 2026Recorded 24 Oct 2026

MAL-2026-16424Published

Malicious code in @wizloft/harness-cli-adapter (npm)

osv · GHSA-hmmw-27v2-3qc8

npm: @wizloft/harness-cli-adapter

Source modified 23 Sep 2026Recorded 24 Oct 2026

MAL-2026-16431Published

Malicious code in @wizloft/harness-plugin-memory-context (npm)

osv · GHSA-r4qq-8p58-gfpv

npm: @wizloft/harness-plugin-memory-context

Source modified 23 Sep 2026Recorded 24 Oct 2026

MAL-2026-14289Published

Malicious code in @wizloft/harness-validation (npm)

osv · GHSA-7g98-grc6-6xjh

npm: @wizloft/harness-validation

Source modified 23 Sep 2026Recorded 24 Oct 2026

MAL-2026-16422Published

Malicious code in @httttt/mcp-npx-fetch-1 (npm)

osv · GHSA-q6m6-3rfx-7f62

npm: @httttt/mcp-npx-fetch-1

Source modified 23 Sep 2026Recorded 24 Oct 2026

MAL-2026-16419Published

Malicious code in @gsutevil/hta-stage (npm)

osv ·

npm: @gsutevil/hta-stage

Source modified 22 Sep 2026Recorded 24 Oct 2026

CVE-2026-93676Published

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: xdg-dbus-proxy · https://access.redhat.com/downloads/content/package-browser/: xdg-dbus-proxy

CVSS 3.1 3.2Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2025-62673Published

Heap-based Buffer Overflow Vulnerability in Archer AX53 and AX12

cve-program ·

Vendor product: Archer AX53 v1.0 · Vendor product: Archer AX12 v1

CVSS 4.0 8.6Source modified 22 Sep 2026Recorded 23 Oct 2026

MAL-2026-16418Published

Malicious code in n8n-nodes-data-transformer-utils (npm)

osv ·

npm: n8n-nodes-data-transformer-utils

Source modified 22 Sep 2026Recorded 24 Oct 2026

MAL-2026-16392Published

Malicious code in envforge2 (npm)

osv · GHSA-h8xg-3hfp-rx6q

npm: envforge2

Source modified 22 Sep 2026Recorded 24 Oct 2026

MAL-2026-16394Published

Malicious code in envparse2 (npm)

osv · GHSA-q747-c2cv-gfhj

npm: envparse2

Source modified 22 Sep 2026Recorded 24 Oct 2026

MAL-2026-16405Published

Malicious code in tailwind-form-styles (npm)

osv · GHSA-h48r-xx59-h44r

npm: tailwind-form-styles

Source modified 22 Sep 2026Recorded 24 Oct 2026

MAL-2026-16395Published

Malicious code in envparse3 (npm)

osv · GHSA-vq77-3r62-c2cx

npm: envparse3

Source modified 22 Sep 2026Recorded 24 Oct 2026

MAL-2026-16393Published

Malicious code in envforge3 (npm)

osv · GHSA-7chm-5cxc-2wx2

npm: envforge3

Source modified 22 Sep 2026Recorded 24 Oct 2026

CVE-2026-18730Published

Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

cve-program ·

Vendor product: Enterprise Server

CVSS 4.0 8.2Source modified 22 Sep 2026Recorded 23 Oct 2026

GHSA-vc9j-9wph-qghjPublished

mppx: Gas Draining with access list

osv · CVE-2026-63628

npm: mppx

MODERATESource modified 22 Sep 2026Recorded 24 Oct 2026

GHSA-7hvx-28gp-mf6jPublished

Unleash: CR-approval email renders user-controlled raw HTML

osv · CVE-2026-76909

npm: unleash-server

LOWSource modified 22 Sep 2026Recorded 24 Oct 2026

GHSA-72h8-wp98-7hchPublished

Unleash: Missing await on permission check + cross-project IDOR in admin API

osv · CVE-2026-77426

npm: unleash-server

HIGHSource modified 22 Sep 2026Recorded 24 Oct 2026

GHSA-5ffh-6f9q-5hhrPublished

Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

osv · CVE-2026-77425

npm: unleash-server

MODERATESource modified 22 Sep 2026Recorded 24 Oct 2026

GHSA-727h-3vm5-qwq6Published

mppx: Gas Draining with padding

osv · CVE-2026-63627

npm: mppx

MODERATESource modified 22 Sep 2026Recorded 24 Oct 2026

GHSA-8gr3-5j6f-25gpPublished

Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

osv · CVE-2026-75510

npm: @novu/js

MODERATESource modified 22 Sep 2026Recorded 24 Oct 2026

GHSA-8xcj-9hfr-fh9jPublished

Unleash: Clone-feature lets a user copy a feature from a project they cannot read

osv · CVE-2026-76910

npm: unleash-server

MODERATESource modified 22 Sep 2026Recorded 24 Oct 2026

RUSTSEC-2026-0302Published

`stack-graphs` C API exports are safe `extern "C"` functions

osv ·

crates.io: stack-graphs

Source modified 22 Sep 2026Recorded 24 Oct 2026

RUSTSEC-2026-0301Published

Double free in `StackVec::retain` when a predicate or element `Drop` panics

osv ·

crates.io: stack_collections

Source modified 22 Sep 2026Recorded 24 Oct 2026

RUSTSEC-2026-0303Published

`stack-graphs` is archived and unmaintained

osv ·

crates.io: stack-graphs

Source modified 22 Sep 2026Recorded 24 Oct 2026

CVE-2026-93657Published

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answ…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-15630Published

CVE-2026-15630

cve-program ·

Vendor product: Casdoor

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92526Published

itsourcecode Leave Management System index.php sql injection

cve-program ·

Vendor product: Leave Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-20282Published

Cisco Identity Services Engine Authenticated Write Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software

CVSS 3.1 4.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-20235Published

Cisco Identity Services Engine Information Disclosure Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software

CVSS 3.1 4.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-85999Published

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

cve-program ·

Vendor product: soupsieve

CVSS 3.1 5.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-89019Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92595Published

Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` using…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Secondary 5.9Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-92596Published

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a sing…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-92597Published

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-92598Published

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addres…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-92599Published

joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-93599Published

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-93600Published

rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because n…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 2.2Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-93601Published

rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name co…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 2.2Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-93602Published

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attac…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Secondary 4.4Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-93749Published

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous e…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Sep 2026Recorded 25 Oct 2026

CVE-2026-87121Published

Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application

cve-program ·

Vendor product: TCP/IP Stack MQTT

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 22 Sep 2026Recorded 23 Oct 2026

GHSA-89vx-jh4q-vg3wPublished

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

osv · CVE-2026-63116

npm: @deepstream/server

HIGHSource modified 22 Sep 2026Recorded 24 Oct 2026

CVE-2026-76712Published

Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

cve-program ·

Vendor product: ALE

CVSS 3.1 7.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-44756Published

Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

cve-program ·

Vendor product: SAP Extended Passport (EPP) Processing

CVSS 3.1 10.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76713Published

Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)

cve-program ·

Vendor product: ALE

CVSS 3.1 7.2Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76714Published

Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE)

cve-program ·

Vendor product: ALE

CVSS 3.1 7.2Source modified 22 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.