Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699171 source statements · aliases may refer to the same vulnerability

CVE-2026-54645Published

CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

cve-program ·

Vendor product: v6

CVSS 3.1 4.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-54519Published

AI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion

cve-program ·

Vendor product: ai-agent-automation

CVSS 3.1 8.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-54613Published

Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

cve-program ·

Vendor product: Vvveb

CVSS 3.1 5.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-53557Published

SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

cve-program ·

Vendor product: SQLBot

CVSS 4.0 7.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-54633Published

PoDoFo: Heap Out-of-Bounds Read in Indexed Color Space Image Decoding (FetchScanLine)

cve-program ·

Vendor product: podofo

CVSS 4.0 6.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-77615Published

Paella Player: Stored XSS via caption cue text

cve-program ·

Vendor product: opencast · Vendor product: paella-player

CVSS 3.1 8.7Source modified 22 Sep 2026Recorded 23 Oct 2026

MAL-2026-6512Published

Malicious code in react-context-form-tdsss (npm)

osv · GHSA-pg33-6m24-4p63

npm: react-context-form-tdsss

Source modified 22 Sep 2026Recorded 24 Oct 2026

MAL-2026-10526Published

Malicious code in @vite-pro/vite-ui (npm)

osv · GHSA-phpx-wpr2-26pv

npm: @vite-pro/vite-ui

Source modified 21 Sep 2026Recorded 24 Oct 2026

MAL-2026-6988Published

Malicious code in @vite-tab/tab (npm)

osv · GHSA-74pv-97c8-9hfp

npm: @vite-tab/tab

Source modified 21 Sep 2026Recorded 24 Oct 2026

MAL-2026-10525Published

Malicious code in @vite-mcp/vite-type (npm)

osv · GHSA-mqf9-3wx8-45cj

npm: @vite-mcp/vite-type

Source modified 21 Sep 2026Recorded 24 Oct 2026

MAL-2026-10527Published

Malicious code in @vite-ts/vite-ui (npm)

osv · GHSA-jm6h-xxm2-2mr3

npm: @vite-ts/vite-ui

Source modified 21 Sep 2026Recorded 24 Oct 2026

MAL-2026-10528Published

Malicious code in @vitets/vite-ts (npm)

osv · GHSA-733v-wc48-f65r

npm: @vitets/vite-ts

Source modified 21 Sep 2026Recorded 24 Oct 2026

MAL-2026-16061Published

Malicious code in @yongot/canary-mcp-isolation (npm)

osv ·

npm: @yongot/canary-mcp-isolation

Source modified 21 Sep 2026Recorded 24 Oct 2026

CVE-2024-53920Published

In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary c…

cve-program ·

Vendor product: n/a

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94143Published

drogonframework drogon ORM Mapper Mapper.h orderBy sql injection

cve-program ·

Vendor product: drogon

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93981Published

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root v…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 4.7Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-93605Published

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary comma…

nvd ·

CVSS 4.0 · [email protected] · Secondary 10.0 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-92961Published

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intri…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-92959Published

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, P…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 7.1Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-63459Published

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-68523Published

Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service

cve-program ·

Vendor product: fulgur

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54339Published

Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover

cve-program ·

Vendor product: glean

CVSS 3.1 7.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54565Published

rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

cve-program ·

Vendor product: rhwp

CVSS 3.1 4.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-50277Published

dd-trace-cpp: Improper parsing of W3C baggage headers may lead to DoS

cve-program ·

Vendor product: dd-trace-cpp

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54752Published

NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request

cve-program ·

Vendor product: devicetype-library

CVSS 3.1 9.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54692Published

SAIL: XBM X10 decoder writes 2 bytes per literal into a 1-byte-per-literal buffer (heap out-of-bounds write)

cve-program ·

Vendor product: sail

CVSS 3.1 7.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-45726Published

Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

cve-program ·

Vendor product: omni

CVSS 3.1 7.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-52852Published

Traccar: Uncontrolled Infinite Loop DoS via Group Parent Cycle

cve-program ·

Vendor product: traccar

CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54571Published

ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service

cve-program ·

Vendor product: ESPAsyncWebServer

CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54451Published

Elixir protobuf: Unbounded recursion depth in embedded-message decoding

cve-program ·

Vendor product: protobuf

CVSS 4.0 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54551Published

WireGuard Portal: Authenticated WebSocket /api/v0/ws broadcasts all peers' and interfaces' traffic stats to every user (missing per-user authorization)

cve-program ·

Vendor product: wg-portal

CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-44236Published

rabbitmq-c: Heap buffer overflow in AMQP login handshake via undersized connection.tune.frame_max

cve-program ·

Vendor product: rabbitmq-c

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54575Published

mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

cve-program ·

Vendor product: mport

CVSS 4.0 5.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-54586Published

mport permits repository and package mirror fetches over insecure transport

cve-program ·

Vendor product: mport

CVSS 4.0 6.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93292Published

SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders

cve-program ·

Vendor product: signoz

CVSS 4.0 8.4 · CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92255Published

Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter_arp_put_file.cgi via String API Misuse

cve-program ·

Vendor product: NR255-V

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92961Published

vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

cve-program ·

Vendor product: vm2

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85720Published

AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT request

cve-program ·

Vendor product: async-http-client

CVSS 3.1 5.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93590Published

ImageMagick before 7.1.2-31 Policy Bypass in UHDR encoder

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93595Published

ArcadeDB before 26.9.1 ACL Bypass via query_database Tool

cve-program ·

Vendor product: arcadedb

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93600Published

rustls webpki Name Constraints URI Validation Bypass

cve-program ·

Vendor product: webpki

CVSS 4.0 2.1 · CVSS 3.1 2.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93605Published

vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

cve-program ·

Vendor product: vm2

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93657Published

hickory-resolver before 0.26.2 DNSSEC Validation Bypass

cve-program ·

https://crates.io: hickory-resolver

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93685Published

Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via cmdfactory.newcontrollercommandconfig (confirmed exposed by engineering)

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: redhat-user-workloads/multicluster-observability-addon-acm-213 · https://access.redhat.com/downloads/content/package-browser/: rhacm2/acm-multicluster-observability-addon-rhel9

CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-61700Published

MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

cve-program ·

Vendor product: mariadb-connector-j

CVSS 3.1 3.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93688Published

SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room

cve-program ·

https://pypi.org/project/sglang: sglang

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-53837Published

org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

cve-program ·

Vendor product: xwiki-rendering

CVSS 3.1 9.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-81942Published

PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server

cve-program ·

Vendor product: PLANET IGS-5225-8P2T4S V1 · Vendor product: PLANET IGS-5225-8P2T4S V2

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-63422Published

OpenImageIO OpenEXR plugin partial edge tile heap out-of-bounds write

cve-program ·

Vendor product: OpenImageIO

CVSS 3.1 7.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-65969Published

OpenImageIO: TGA-to-GIF palette split signed overflow causes SIGSEGV

cve-program ·

Vendor product: OpenImageIO

CVSS 3.1 5.5Source modified 21 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.