Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699210 source statements · aliases may refer to the same vulnerability

CVE-2026-55567Published

BleachBit: Exploit File Delete to Escalate Privilege

cve-program ·

Vendor product: bleachbit

CVSS 3.1 7.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-61628Published

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

cve-program ·

Vendor product: nginx-ignition

CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94108Published

getID3 through 1.9.26 XML External Entity Injection via XML2array

cve-program ·

Vendor product: getid3

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93956Published

olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting

cve-program ·

Vendor product: PHP-FTS

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93961Published

Dromara UJCMS UserController UserController.java usernameExist improper authorization

cve-program ·

Vendor product: UJCMS

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93966Published

aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection

cve-program ·

Vendor product: SxDevOps

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93971Published

aiyiyi121 SxDevOps settings.py information disclosure

cve-program ·

Vendor product: SxDevOps

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-55071Published

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

cve-program ·

Vendor product: mcp-for-stata

CVSS 3.1 8.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92584Published

AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92804Published

Nango through 0.70.4 Server-Side Request Forgery via Configuration

cve-program ·

Vendor product: Nango

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87279Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 6.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94381Published

MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

cve-program ·

Vendor product: MISP

CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94383Published

MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

cve-program ·

Vendor product: MISP

CVSS 4.0 8.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85220Published

Denial-of-Service in the Thinkst Canary Redis service

cve-program ·

Vendor product: Canary

CVSS 3.1 3.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94394Published

MISP ObjectReferencesController: Granular Distribution and Sharing Group Restrictions Bypassed When Adding Object References

cve-program ·

Vendor product: MISP

CVSS 4.0 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94401Published

MISP Arbitrary Local File Read and SSRF via MISP Export Upload

cve-program ·

Vendor product: MISP

CVSS 4.0 8.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94404Published

MISP CSRF vulnerability allows unauthorized attribute modification

cve-program ·

Vendor product: MISP

CVSS 4.0 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93976Published

code-projects Assessment Management add-user.php cross site scripting

cve-program ·

Vendor product: Assessment Management

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94105Published

NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller

cve-program ·

Vendor product: nivocart

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85010Published

RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons

cve-program ·

https://wordpress.org/plugins: RestroPress

CVSS 3.1 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92400Published

Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion

cve-program ·

https://wordpress.org/plugins: Payment Gateway for PayPal on WooCommerce

CVSS 3.1 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-86802Published

To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

cve-program ·

https://wordpress.org/plugins: To Do List Member

CVSS 3.1 3.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85113Published

GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

cve-program ·

https://wordpress.org/plugins: GiveWP

CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-82187Published

WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload

cve-program ·

Vendor product: Web to Print Online Designer

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-65492Published

WordPress Dokan Pro plugin < 5.0.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

Vendor product: Dokan Pro

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94111Published

Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

cve-program ·

https://registry.npmjs.org: BrowserSkill

CVSS 4.0 6.9 · CVSS 3.1 6.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92254Published

WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL

cve-program ·

Vendor product: Anti-Virus

CVSS 4.0 6.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-90817Published

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintende…

cve-program ·

Vendor product: REDCap

CVSS 3.1 9.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94211Published

Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

cve-program ·

Vendor product: Leantime

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92252Published

Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory

cve-program ·

Vendor product: Anti-Virus

CVSS 4.0 5.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87285Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastruct…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 6.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94382Published

Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

cve-program ·

Vendor product: beszel

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-92253Published

Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine Restoration

cve-program ·

Vendor product: Anti-Virus

CVSS 4.0 5.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87283Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastruct…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 6.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87282Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastruct…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 6.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94028Published

mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

cve-program ·

Vendor product: Mealie

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93921Published

SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint

cve-program ·

https://pkg.go.dev: github.com/siyuan-note/siyuan/kernel

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93993Published

Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout

cve-program ·

Vendor product: mistral-vibe

CVSS 4.0 8.6 · CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94039Published

vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery

cve-program ·

Vendor product: TaxHacker

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-33147Published

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

cve-program ·

Vendor product: Cognos Analytics

CVSS 3.1 5.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94044Published

03-lovepreetSingh MCP route.ts create_file path traversal

cve-program ·

Vendor product: MCP

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91863Published

Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.neethi:neethi

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91864Published

Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.neethi:neethi

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93884Rejected

REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

cve-program ·

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91866Published

Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.neethi:neethi

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91865Published

Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.neethi:neethi

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91867Published

Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.neethi:neethi

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-80685Published

mm/util: don't read __page_2 for order-1 folios in snapshot_page()

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-72355Published

netfs: Fix barriering when walking subrequest list

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 9.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-68337Published

bpf: Reject redirect helpers without a bpf_net_context

cve-program ·

Vendor product: Linux · Vendor product: Linux

Source modified 21 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.