Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699210 source statements · aliases may refer to the same vulnerability

CVE-2026-90546Published

WWBN AVideo Missing Authorization via like.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85272Published

Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path Validation

cve-program ·

Vendor product: openedx-platform

CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-90536Published

WWBN AVideo Missing Authorization via adsInfo API Endpoint

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-50236Published

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

cve-program ·

https://catalog.redhat.com/software/containers/: openshift4/ose-console · https://catalog.redhat.com/software/containers/: openshift4/ose-console · https://catalog.redhat.com/software/containers/: openshift4/ose-console-rhel9

CVSS 3.1 7.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-22223Published

Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1

cve-program ·

Vendor product: Archer BE230 v1.2 · Vendor product: Archer BE3600 v1

CVSS 4.0 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-12548Published

Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333

cve-program ·

https://catalog.redhat.com/software/containers/: devspaces/code-rhel9 · https://catalog.redhat.com/software/containers/: devspaces/code-rhel9 · https://catalog.redhat.com/software/containers/: devspaces/code-rhel9

CVSS 3.1 9.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-49332Published

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

cve-program ·

https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-proxy · https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-proxy · https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-proxy

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-2843Published

Observability-operator: observability operator privilege escalation

cve-program ·

https://github.com/rhobs/observability-operator: observability-operator · https://catalog.redhat.com/software/containers/: cluster-observability-operator/cluster-observability-rhel9-operator

CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-69904Published

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system o…

cve-program ·

Vendor product: n/a

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-79362Published

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. A…

cve-program ·

Vendor product: n/a

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94098Published

Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection

cve-program ·

Vendor product: NBR200V2

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93740Published

Totolink A3002MU formWlEncrypt buffer overflow

cve-program ·

Vendor product: A3002MU

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94103Published

RooCMS Frontend Rendering site_pagePHP.php eval code injection

cve-program ·

Vendor product: RooCMS

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94138Published

Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection

cve-program ·

Vendor product: Feiyu Star Router

CVSS 4.0 5.1 · CVSS 3.1 6.6 · CVSS 3.0 6.6 · CVSS 2.0 5.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-50237Published

Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

cve-program ·

CVSS 3.1 7.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-36467Published

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading …

cve-program ·

Vendor product: n/a

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92816Published

ComfyUI before 0.30.0 Path Traversal via dataset save nodes

cve-program ·

Vendor product: ComfyUI

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92781Published

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes

cve-program ·

Vendor product: @builder.io/sdk-react · Vendor product: @builder.io/sdk-vue · Vendor product: @builder.io/sdk-svelte

CVSS 4.0 5.3 · CVSS 3.1 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-71139Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastruct…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 4.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92775Published

Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch

cve-program ·

Vendor product: Wiki.js

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87267Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with network access via RDP …

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92752Published

metasfresh Unauthorized Access via Document Attachments and Comments Endpoints

cve-program ·

Vendor product: metasfresh

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-36472Published

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: …

cve-program ·

Vendor product: n/a

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92770Published

Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

cve-program ·

Vendor product: harbor

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92786Published

LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model

cve-program ·

Vendor product: LightGBM

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-55074Published

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

cve-program ·

Vendor product: ansible_jailexec

CVSS 4.0 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-52740Published

GoCD is vulnerable to pipeline template view API authorization bypass

cve-program ·

Vendor product: gocd

CVSS 4.0 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92796Published

Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass

cve-program ·

Vendor product: Manticore Search

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92791Published

Uber Kraken through 0.1.29 Path Traversal via tag parameter

cve-program ·

Vendor product: kraken

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92811Published

browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass

cve-program ·

Vendor product: browserless

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94145Published

xuxueli xxl-job Task Management JobInfoController.java cross site scripting

cve-program ·

Vendor product: xxl-job

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93923Published

SiYuan through 3.8.4 Stored XSS via Heading Style Attribute

cve-program ·

https://pkg.go.dev: github.com/siyuan-note/siyuan/kernel

CVSS 4.0 8.6 · CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94151Published

Omega Solution HRM OS Role Permission API permission missing authentication

cve-program ·

Vendor product: HRM OS

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-52742Published

GoCD is vulnerable to historical server configuration API authorization bypass

cve-program ·

Vendor product: gocd

CVSS 4.0 5.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-16652Published

Temporal Server Schedule exclusion search can cause excessive CPU consumption

cve-program ·

https://pkg.go.dev: go.temporal.io/server

CVSS 4.0 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-16651Published

temporalio/sqlparser malformed MySQL version comments can cause a panic

cve-program ·

https://pkg.go.dev: github.com/temporalio/sqlparser · https://pkg.go.dev: go.temporal.io/server

CVSS 4.0 8.7 · CVSS 4.0 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-65651Published

temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

cve-program ·

https://pkg.go.dev: github.com/temporalio/sqlparser · https://pkg.go.dev: go.temporal.io/server

CVSS 4.0 8.7 · CVSS 4.0 7.1 · CVSS 4.0 6.0Source modified 21 Sep 2026Recorded 23 Oct 2026

RUSTSEC-2026-0297Published

`unzip`: archive extraction is vulnerable to path traversal (zip-slip)

osv ·

crates.io: unzip

Source modified 21 Sep 2026Recorded 24 Oct 2026

RUSTSEC-2026-0296Published

`unzip` is unmaintained

osv ·

crates.io: unzip

Source modified 21 Sep 2026Recorded 24 Oct 2026

CVE-2026-65652Published

temporalio/tchannel-go malformed checksum type causes process termination

cve-program ·

https://pkg.go.dev: github.com/temporalio/tchannel-go

CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-65653Published

temporalio/tchannel-go zero-chunk call fragment causes process termination

cve-program ·

https://pkg.go.dev: github.com/temporalio/tchannel-go

CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-65654Published

temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

cve-program ·

https://pkg.go.dev: github.com/temporalio/ringpop-go

CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87858Published

Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

cve-program ·

https://pkg.go.dev: go.temporal.io/server · https://pkg.go.dev: go.temporal.io/server

CVSS 4.0 7.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-89139Published

Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

cve-program ·

https://pkg.go.dev: go.temporal.io/server

CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94372Published

Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index

cve-program ·

Vendor product: MISP

CVSS 4.0 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94373Published

MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu

cve-program ·

Vendor product: MISP

CVSS 4.0 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94374Published

MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports

cve-program ·

Vendor product: MISP

CVSS 4.0 8.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94379Published

MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection and Email OTP)

cve-program ·

Vendor product: MISP

CVSS 4.0 6.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94055Published

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

cve-program ·

Vendor product: Exim

CVSS 3.1 3.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94393Published

MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport

cve-program ·

Vendor product: MISP

CVSS 4.0 6.4Source modified 21 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.