Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699210 source statements · aliases may refer to the same vulnerability

CVE-2026-62987Published

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

cve-program ·

Vendor product: fabio

CVSS 3.1 5.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-63373Published

draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection

cve-program ·

Vendor product: drawio

CVSS 3.1 4.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-81531Published

Unauthenticated Account Information Disclosure in Multiple Omada Controllers

cve-program ·

Vendor product: Omada Software Controller · Vendor product: OC200 V1 · Vendor product: OC200 v2

CVSS 4.0 6.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92061Published

Incorrect boundary conditions in the Security: Process Sandboxing component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-76866Published

Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters

cve-program ·

Vendor product: NR255-V

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-62866Published

Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

cve-program ·

Vendor product: dasel

CVSS 3.1 6.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-63116Published

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

cve-program ·

Vendor product: deepstream.io

CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-55563Published

Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

cve-program ·

Vendor product: feast

CVSS 4.0 8.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92462Published

yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep

cve-program ·

Vendor product: yshop-crm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85751Published

Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

cve-program ·

Vendor product: Mailu · Vendor product: helm-charts

CVSS 3.1 9.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92257Published

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks

cve-program ·

Vendor product: NR255-V

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92059Published

Incorrect boundary conditions in the DOM: Editor component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-76871Published

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers

cve-program ·

Vendor product: NR255-V

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-68914Rejected

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-2026-14803. Notes: All CVE users should reference CVE-2026-14803 instead of this candidate.

cve-program ·

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-77568Rejected

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate.

cve-program ·

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94488Published

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. Howeve…

cve-program ·

Vendor product: Telegram Desktop

CVSS 4.0 8.3 · CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-48976Published

HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack

cve-program ·

Vendor product: homebox

CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92457Published

yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice

cve-program ·

Vendor product: yshop-crm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92761Published

WebVirtCloud Missing Authorization on Instance Control Actions

cve-program ·

Vendor product: webvirtcloud

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92057Published

Mitigation bypass in the Enterprise Policies component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92467Published

microservices-platform through 6.0.0 Unverified Password Change via /users/password

cve-program ·

Vendor product: microservices-platform

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2024-52270Published

PDF Document Spoofing in DropBox Sign(HelloSign)

cve-program ·

Vendor product: DropBox Sign

CVSS 4.0 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2024-11146Published

TrueFiling authorization bypass via user-controlled keys

cve-program ·

Vendor product: TrueFiling

CVSS 4.0 6.3 · CVSS 3.1 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92051Published

Spoofing issue due to invalid pointer in the Graphics component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92050Published

Sandbox escape due to race condition in the XPConnect component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92048Published

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92045Published

Sandbox escape due to incorrect boundary conditions in the WebRTC component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92044Published

Information disclosure in the Networking: HTTP component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

MAL-2026-3713Published

Malicious code in hardhat-core (npm)

osv ·

npm: hardhat-core

Source modified 21 Sep 2026Recorded 24 Oct 2026

CVE-2026-92041Published

Mitigation bypass in the DOM: Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92039Published

Mitigation bypass in the DOM: Notifications component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92038Published

Mitigation bypass in the Remote Settings Client component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92037Published

Incorrect boundary conditions in the DOM: Animation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92036Published

Incorrect boundary conditions in the Networking: HTTP component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-7195Published

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

cve-program ·

https://github.com/operator-framework/operator-sdk: operator-sdk · https://catalog.redhat.com/software/containers/: container-native-virtualization/cluster-network-addons-operator-rhel9 · https://catalog.redhat.com/software/containers/: container-native-virtualization/cluster-network-addons-operator-rhel9

CVSS 3.1 6.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92949Published

vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

cve-program ·

Vendor product: vm2

CVSS 4.0 6.3 · CVSS 3.1 4.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83265Published

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Agent). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthentica…

cve-program ·

Vendor product: Oracle Web Services Manager

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2024-45497Published

Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials

cve-program ·

https://github.com/openshift: openshift · https://catalog.redhat.com/software/containers/: openshift4/ose-cluster-openshift-apiserver-operator · https://catalog.redhat.com/software/containers/: openshift4/ose-cluster-openshift-apiserver-operator

CVSS 3.1 7.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83259Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83252Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthentic…

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 7.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83251Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthentic…

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83250Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthentic…

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92034Published

Site isolation issue in the Graphics component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83248Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticat…

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-24552Published

WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: mediavine-create

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83244Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthentic…

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83243Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows …

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 7.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83240Published

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-11371Published

Gladinet CentreStack and TrioFox Local File Inclusion Flaw

cve-program ·

Vendor product: CentreStack and TrioFox

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92032Published

Sandbox escape due to invalid pointer in the Graphics component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 21 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.