Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699210 source statements · aliases may refer to the same vulnerability

CVE-2026-77165Published

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

cve-program ·

Vendor product: Server

CVSS 3.0 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-77972Published

safeurl validated address is not bound to the request, allowing DNS rebinding

cve-program ·

https://repo.hex.pm: safeurl · https://github.com: slab/safeurl-elixir

CVSS 4.0 9.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-19407Published

GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK

cve-program ·

Vendor product: Gemini Enterprise Agent Platform SDK for Python

CVSS 4.0 7.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-77166Published

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

cve-program ·

Vendor product: Collectives

CVSS 3.0 2.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-82560Published

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width

cve-program ·

https://cpan.org/modules: podlators · https://cpan.org/modules: perl

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94501Published

jshERP through 3.6 Privilege Escalation via userBusiness CRUD

cve-program ·

Vendor product: jshERP

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94414Published

jshERP through 3.6 Missing Authorization via updateBtnStr

cve-program ·

Vendor product: jshERP

CVSS 3.1 5.4 · CVSS 4.0 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-61745Published

InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

cve-program ·

Vendor product: InvenTree

CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94056Published

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

cve-program ·

Vendor product: Exim

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93992Published

Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal

cve-program ·

Vendor product: gopeed

CVSS 4.0 7.0 · CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-82672Published

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

cve-program ·

https://repo.hex.pm: mint · https://github.com: elixir-mint/mint

CVSS 4.0 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93987Published

rclone serve docker Path Traversal via Volume Name

cve-program ·

Vendor product: rclone

CVSS 4.0 4.6 · CVSS 3.1 3.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93742Published

Totolink A3002MU formWsc command injection

cve-program ·

Vendor product: A3002MU

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2021-48008Published

Chanjet CRM SQL Injection via get_usedspace.php

cve-program ·

Vendor product: CRM

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-68928Published

Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode

cve-program ·

Vendor product: Acode

CVSS 3.1 8.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-75894Published

Reachable assertion at ranap_handle_co_dt()

cve-program ·

Vendor product: osmo-iuh

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2024-58385Published

Yonyou U8 CRM SQL Injection via fillbacksettingedit.php

cve-program ·

Vendor product: U8 CRM

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-63447Published

Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-57225Published

Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

cve-program ·

Vendor product: suricata

CVSS 3.1 3.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-76856Published

Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints

cve-program ·

Vendor product: NR255-V

CVSS 4.0 7.0 · CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-63452Published

Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92729Published

SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints

cve-program ·

Vendor product: signoz

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-75892Published

Out of bounds write in PDP ctx GSN-Address decode

cve-program ·

Vendor product: osmo-ggsn

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93762Published

Data deletion and attribute disclosure via field-name method injection in in-memory queries

cve-program ·

Vendor product: Mongoid

CVSS 4.0 9.2 · CVSS 3.1 9.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92954Published

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2 · CVSS 3.1 · [email protected] · Secondary 8.6Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-92949Published

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescript…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 4.0Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2025-7195Published

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/pass…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.4Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-75893Published

Heap based buffer overflow at ipaccess_proxy_read_msg()

cve-program ·

Vendor product: osmo-bsc

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93763Published

Silent plaintext persistence via unresolved callable database name in encryption schema map

cve-program ·

Vendor product: Mongoid

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93759Published

Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

cve-program ·

Vendor product: Mongoid

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93760Published

NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

cve-program ·

Vendor product: Mongoid

CVSS 4.0 8.3 · CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-88259Published

CareCam CM2507 Missing Authentication for Critical Function

cve-program ·

Vendor product: HMT.CM2507 Firmware

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-76861Published

Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi

cve-program ·

Vendor product: NR255-V

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-67101Published

HCL BigFix Service Management is affected by multiple security vulnerabilities.

cve-program ·

Vendor product: HCL BigFix Service Management

CVSS 3.1 9.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93958Published

D-Link R95 DHMAPI ssi system os command injection

cve-program ·

Vendor product: R95

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92066Published

Sandbox escape in the Profile Backup component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92612Published

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 1.0Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-86551Published

Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product

cve-program ·

Vendor product: NX741J

CVSS 3.1 3.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-86552Published

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

cve-program ·

Vendor product: SmartLife

CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-86553Published

A password reset vulnerability in ZTE SmartLife APP

cve-program ·

Vendor product: SmartLife

CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93963Published

itsourcecode Leave Management System controller.php sql injection

cve-program ·

Vendor product: Leave Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-47321Published

Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.mina:mina-filter-compression

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93968Published

aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management

cve-program ·

Vendor product: SxDevOps

CVSS 4.0 5.1 · CVSS 3.1 3.8 · CVSS 3.0 3.8 · CVSS 2.0 4.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92065Published

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-86554Published

Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP

cve-program ·

Vendor product: SmartLife

CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93973Published

SourceCodester Online Reviewer Management System btn_functions.php remove sql injection

cve-program ·

Vendor product: Online Reviewer Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-86555Published

Hardcoded Key Vulnerability in ZTE SmartLife APP

cve-program ·

Vendor product: SmartLife

CVSS 3.1 6.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-66280Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93978Published

code-projects Internship Management System login.php sql injection

cve-program ·

Vendor product: Internship Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92064Published

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.