Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699150 source statements · aliases may refer to the same vulnerability

CVE-2026-77521Published

MaxKB: Prompt-injectable agent can lead to command execution

cve-program ·

Vendor product: MaxKB

CVSS 3.1 10.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-49453Published

Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

cve-program ·

Vendor product: joplin

CVSS 3.1 7.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-50572Published

Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfault

cve-program ·

Vendor product: envoy

CVSS 3.1 5.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-59816Published

Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash

cve-program ·

Vendor product: joplin

CVSS 3.1 4.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-59814Published

Joplin: Stored XSS via inline-served note attachment on published shares

cve-program ·

Vendor product: joplin

CVSS 3.1 7.6Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-73549Published

Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clusters

cve-program ·

Vendor product: envoy

CVSS 3.1 5.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94535Published

lamp-cloud through 5.10.0 Unauthorized Notification Deletion

cve-program ·

Vendor product: lamp-cloud

CVSS 3.1 7.1 · CVSS 4.0 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-73512Published

Envoy: use-after-free in QUIC on internal redirects

cve-program ·

Vendor product: envoy

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-61743Published

Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

cve-program ·

Vendor product: chartbrew

CVSS 3.1 6.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94624Published

vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-12470Published

CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action

cve-program ·

Vendor product: CMP – Coming Soon & Maintenance Plugin by NiteoThemes

CVSS 3.1 7.2Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-73553Published

Envoy: RBAC Authorization Bypass via Path Parameters

cve-program ·

Vendor product: envoy

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-77518Published

MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows

cve-program ·

Vendor product: MaxKB

CVSS 3.1 5.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-77517Published

MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base

cve-program ·

Vendor product: MaxKB

CVSS 3.1 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-49450Published

Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName

cve-program ·

Vendor product: joplin

CVSS 3.1 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93928Published

WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability

cve-program ·

https://wordpress.org/plugins: ecab-taxi-booking-manager

CVSS 3.1 7.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-55179Published

Joplin: Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID

cve-program ·

Vendor product: joplin

CVSS 3.1 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-89422Published

TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension

cve-program ·

Vendor product: otp · Vendor product: ssl · https://github.com: erlang/otp

CVSS 4.0 9.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-55210Published

Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)

cve-program ·

Vendor product: joplin

CVSS 3.1 7.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-90882Published

Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

cve-program ·

Vendor product: open-vsx.org

CVSS 4.0 8.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-90990Published

Livestatus injection via monitoring filter values

cve-program ·

Vendor product: Checkmk

CVSS 4.0 5.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95270Published

dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy

cve-program ·

Vendor product: changedetection.io

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94533Published

lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file

cve-program ·

Vendor product: lamp-cloud

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-49811Published

Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to El…

cve-program ·

Vendor product: Command | Monitor (DCM)

CVSS 3.1 8.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94622Published

vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-75791Published

Authentication bypass vulnerability

cve-program ·

Vendor product: ManageEngine ADSelfService Plus

CVSS 3.1 8.6Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94627Published

vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94425Published

Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management

cve-program ·

Vendor product: MTT S80 Driver Package

CVSS 4.0 9.3 · CVSS 3.1 8.8 · CVSS 3.0 8.8 · CVSS 2.0 6.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94492Published

Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection

cve-program ·

Vendor product: U8cloud

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93655Published

Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter

cve-program ·

Vendor product: Booking Calendar

CVSS 3.1 6.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-74766Published

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode

cve-program ·

https://cpan.org/modules: Net-IDN-Encode

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-63272Published

Heap buffer overflow in WMF text record import

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-63275Published

Stack buffer overflow in CFF font hint handling

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-63276Published

Stack buffer overflow in CFF to Type 1 font conversion

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-63278Published

Package URLs can be used to exfiltrate arbitrary INI file values and environment variables

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 6.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-63279Published

Out of bounds read in PICT image import

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-89420Published

Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

cve-program ·

https://repo.hex.pm: mpp · https://github.com: zenhive/mpp

CVSS 4.0 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-87119Published

mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

cve-program ·

https://repo.hex.pm: mpp · https://github.com: zenhive/mpp

CVSS 4.0 8.2Source modified 22 Sep 2026Recorded 23 Oct 2026

GO-2026-5015Published

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

osv · CVE-2026-39835 · GHSA-78mq-xcr3-xm33

Go: golang.org/x/crypto

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-5033Published

Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

osv · CVE-2026-46598 · GHSA-9m57-25v3-79x9

Go: golang.org/x/crypto

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-5020Published

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

osv · CVE-2026-39834 · GHSA-rm3j-f69w-wqmq

Go: golang.org/x/crypto

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-5027Published

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

osv · CVE-2026-42502

Go: golang.org/x/net

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-5031Published

Panic when reading out of bound palette index in golang.org/x/image/bmp

osv · CVE-2026-42500

Go: golang.org/x/image

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-5029Published

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

osv · CVE-2026-25681

Go: golang.org/x/net

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-4979Published

Invoking "go tool pack" does not sanitize output paths in cmd/go

osv · BIT-golang-2026-39817 · CVE-2026-39817

Go: toolchain

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-4978Published

Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

osv · BIT-golang-2026-39819 · CVE-2026-39819

Go: toolchain

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-5030Published

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

osv · CVE-2026-27136

Go: golang.org/x/net

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-4962Published

Excessive memory allocation when decoding malicious SFNT in golang.org/x/image

osv · CVE-2026-33812

Go: golang.org/x/image

Source modified 22 Sep 2026Recorded 24 Oct 2026

GO-2026-5016Published

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

osv · CVE-2026-39827 · GHSA-qpw4-5x99-6vjp

Go: golang.org/x/crypto

Source modified 22 Sep 2026Recorded 24 Oct 2026

CVE-2026-7891Rejected

This CVE has been retracted. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.

cve-program ·

Source modified 22 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.