Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699106 source statements · aliases may refer to the same vulnerability

CVE-2026-74765Published

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode

cve-program ·

https://cpan.org/modules: Net-IDN-Encode

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2020-6851Published

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2016-15059Published

Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode

cve-program ·

https://cpan.org/modules: Net-IDN-Encode

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76802Published

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

cve-program ·

Vendor product: nuclei

CVSS 3.1 4.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76819Rejected

Further research determined the issue results from a dependency.

cve-program ·

Source modified 22 Sep 2026Recorded 23 Oct 2026

MAL-2026-16387Published

Malicious code in @mr-supun-fernando/supunmd-bail (npm)

osv ·

npm: @mr-supun-fernando/supunmd-bail

Source modified 22 Sep 2026Recorded 24 Oct 2026

CVE-2026-89040Published

Tencent Mass Service Engine in Cluster (MSEC) path traversal

cve-program ·

Vendor product: Mass Service Engine in Cluster (MSEC)

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76796Published

Newell Brands DYMO Connect Desktop improper file path validation

cve-program ·

Vendor product: DYMO Connect Desktop

CVSS 3.1 4.0 · CVSS 4.0 5.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92072Published

Incorrect boundary conditions in the Safe Browsing component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-81883Published

radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode

cve-program ·

Vendor product: radare2

CVSS 3.1 3.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93967Published

aiyiyi121 SxDevOps Command services.py generate_host_task command injection

cve-program ·

Vendor product: SxDevOps

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92074Published

Mitigation bypass in the Popup Blocker component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92075Published

Mitigation bypass in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92076Published

Incorrect boundary conditions in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92079Published

Mitigation bypass in the Widget: Win32 component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-38999Published

A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2025-56566Published

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authen…

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92385Published

SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting

cve-program ·

Vendor product: Online Food Ordering System

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2025-36147Published

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.

cve-program ·

Vendor product: Financial Transaction Manager for SWIFT Services for Multiplatforms

CVSS 3.1 6.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94054Published

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

cve-program ·

Vendor product: Exim

CVSS 3.1 7.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-77619Published

Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.

cve-program ·

Vendor product: vector

CVSS 4.0 8.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93962Published

Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow

cve-program ·

Vendor product: Kamailio

CVSS 4.0 6.9 · CVSS 3.1 8.3 · CVSS 3.0 8.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2025-56565Published

DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email noti…

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93957Published

olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison

cve-program ·

Vendor product: PHP-FTS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-79312Published

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after…

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93989Published

vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words

cve-program ·

Vendor product: vllm

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-88010Published

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

cve-program ·

Vendor product: traefik

CVSS 4.0 6.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94057Published

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

cve-program ·

Vendor product: Exim

CVSS 3.1 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-75510Published

Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

cve-program ·

Vendor product: novu

CVSS 4.0 5.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92706Published

Dark Reader: Ability to request icon-like bitmap data from certain local web servers

cve-program ·

Vendor product: darkreader

CVSS 3.1 3.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93741Published

Totolink A3002MU formWlWds buffer overflow

cve-program ·

Vendor product: A3002MU

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95806Published

MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths

cve-program ·

Vendor product: MISP

CVSS 4.0 7.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95805Published

MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

cve-program ·

Vendor product: MISP

CVSS 4.0 5.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95754Published

MISP: Disabled-user check ineffective in pre-authentication TOTP login branch

cve-program ·

Vendor product: MISP

CVSS 4.0 6.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93922Published

SiYuan through 3.8.4 Stored XSS via notebook names

cve-program ·

https://pkg.go.dev: github.com/siyuan-note/siyuan/kernel

CVSS 4.0 8.6 · CVSS 3.1 8.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-89407Published

jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS

cve-program ·

https://repo1.maven.org/maven2: com.fasterxml.jackson.core:jackson-core · https://repo1.maven.org/maven2: tools.jackson.core:jackson-core

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-85271Published

Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

cve-program ·

Vendor product: openedx-platform

CVSS 3.1 6.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-17054Published

Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 5.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-57223Published

Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation

cve-program ·

Vendor product: suricata

CVSS 3.1 7.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95654Published

Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token

cve-program ·

Vendor product: Databasement

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-63448Published

Suricata smb: some SMB flows can cause resource exhaustion

cve-program ·

Vendor product: suricata

CVSS 3.1 5.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-75607Published

Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations

cve-program ·

Vendor product: frigate

CVSS 3.1 8.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-57227Published

Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-91854Published

code-projects Record Management System reg.php cross site scripting

cve-program ·

Vendor product: Record Management System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-25826Published

An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown whic…

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92214Published

a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting

cve-program ·

Vendor product: a2ui

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92221Published

gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-57226Published

Suricata swf: heap buffer overflow in SWF decompression depth handling

cve-program ·

Vendor product: suricata

CVSS 3.1 3.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92360Published

ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation

cve-program ·

Vendor product: ag-ui

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92365Published

vllm-project vllm thinking_budget_state.py algorithmic complexity

cve-program ·

Vendor product: vllm

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.