Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699150 source statements · aliases may refer to the same vulnerability

CVE-2026-92475Published

GPAC downloader.c wait_for_header_and_parse out-of-bounds

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92880Published

vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write

cve-program ·

Vendor product: vgmstream

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92993Published

Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

cve-program ·

Vendor product: mayfly-go

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93311Published

Freedesktop Poppler SampledFunction Function.cc integer overflow

cve-program ·

Vendor product: Poppler

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93371Published

marcopiovanello yt-dlp-web-ui generic.go NewGenericDownload command injection

cve-program ·

Vendor product: yt-dlp-web-ui

CVSS 4.0 6.9 · CVSS 3.1 8.3 · CVSS 3.0 8.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-92240Published

Out-of-bounds read in IMAP response parser

cve-program ·

Vendor product: Thunderbird

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-39039Published

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93532Published

gedelumbung HospitalManagement Password Change password.php simpan improper authentication

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93738Published

Totolink A3002MU formSchedule buffer overflow

cve-program ·

Vendor product: A3002MU

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-61722Published

FluidSynth: DLS Articulation Chunk Integer Overflow

cve-program ·

Vendor product: fluidsynth

CVSS 3.1 6.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93954Published

grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization

cve-program ·

Vendor product: grimmory

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93964Published

NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication

cve-program ·

Vendor product: nginx-proxy-manager

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93969Published

aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentials

cve-program ·

Vendor product: SxDevOps

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93974Published

SourceCodester Online Reviewer Management System btn_functions.php remove sql injection

cve-program ·

Vendor product: Online Reviewer Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93979Published

code-projects Internship Management System login.php sql injection

cve-program ·

Vendor product: Internship Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94032Published

itsourcecode Leave Management System index.php sql injection

cve-program ·

Vendor product: Leave Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94037Published

00Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal

cve-program ·

Vendor product: mcp-file-analyzer

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76900Published

CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

cve-program ·

Vendor product: CordysCRM

CVSS 3.1 6.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94042Published

AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injection

cve-program ·

Vendor product: Restaurant Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-36470Published

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94047Published

samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management

cve-program ·

Vendor product: MCPHub

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94089Published

D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow

cve-program ·

Vendor product: DIR-868L

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94094Published

OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94099Published

Netcore NBR200V2 Backup Restore restore.cgi command injection

cve-program ·

Vendor product: NBR200V2

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94110Published

QCMS Content Detail Controllers.php self_Tmp sql injection

cve-program ·

Vendor product: QCMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94139Published

Chengdu Feiyuxing Technology Feiyu Star Router Cookie send_order.cgi command injection

cve-program ·

Vendor product: Feiyu Star Router

CVSS 4.0 5.3 · CVSS 3.1 7.4 · CVSS 3.0 7.4 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94146Published

BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where

cve-program ·

Vendor product: BIOS Update Utility

CVSS 4.0 9.3 · CVSS 3.1 8.8 · CVSS 3.0 8.8 · CVSS 2.0 6.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-77620Published

Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).

cve-program ·

Vendor product: vector

CVSS 4.0 8.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94152Published

Omega Solution FBP Fulfillment by People User Profile API user authorization

cve-program ·

Vendor product: FBP Fulfillment by People

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94403Published

ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference

cve-program ·

Vendor product: iGameCenter

CVSS 4.0 9.3 · CVSS 3.1 8.8 · CVSS 3.0 8.8 · CVSS 2.0 6.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-58491Published

Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

cve-program ·

Vendor product: warpgate

CVSS 3.1 9.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-63329Published

Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

cve-program ·

Vendor product: warpgate

CVSS 3.1 4.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-91167Published

Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

cve-program ·

Vendor product: warpgate

CVSS 4.0 6.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-62247Published

Supabase Realtime: Incorrect Authorization

cve-program ·

Vendor product: realtime

CVSS 3.1 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-81884Published

radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser

cve-program ·

Vendor product: radare2

CVSS 3.1 2.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-73552Published

Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

cve-program ·

Vendor product: envoy

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-73547Published

Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

cve-program ·

Vendor product: envoy

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-61820Published

pg_partman privilege escalation via SQL injection when inheriting template properties

cve-program ·

Vendor product: pg_partman

CVSS 3.1 8.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-73511Published

Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

cve-program ·

Vendor product: envoy

CVSS 3.1 5.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-77520Published

MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

cve-program ·

Vendor product: MaxKB

CVSS 3.1 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-79916Published

MaxKB AWS Bedrock model credential injection leads to remote code execution

cve-program ·

Vendor product: MaxKB

CVSS 3.1 9.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-79917Published

MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation

cve-program ·

Vendor product: MaxKB

CVSS 3.1 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-79919Published

MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

cve-program ·

Vendor product: MaxKB

CVSS 3.1 6.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-61647Published

@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

cve-program ·

Vendor product: notebooklm-mcp

CVSS 4.0 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-81879Published

radare2: Heap out-of-bounds read in radare2 ELF PN_XNUM handling

cve-program ·

Vendor product: radare2

CVSS 3.1 5.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-59830Published

Discourse: Stored XSS via unescaped actor name in post actions

cve-program ·

Vendor product: discourse

CVSS 3.1 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-61851Published

Chartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery Tool

cve-program ·

Vendor product: chartbrew

CVSS 4.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-85653Published

Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter

cve-program ·

Vendor product: Contextual Related Posts

CVSS 3.1 6.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-6922Published

WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter

cve-program ·

Vendor product: WP Table Builder – Drag & Drop Table Builder

CVSS 3.1 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95271Published

dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication

cve-program ·

Vendor product: changedetection.io

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.