Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699233 source statements · aliases may refer to the same vulnerability

CVE-2026-15815Published

CVE-2026-15815 CVE Record

cve-program ·

Vendor product: Grafana OSS · Vendor product: Grafana Enterprise

CVSS 3.1 8.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-93375Published

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-53266Published

netfilter: bridge: make ebt_snat ARP rewrite writable

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 8.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-93377Published

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-93381Published

Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security seve…

cve-program ·

Vendor product: Chrome

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-93372Published

Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

cve-program ·

Vendor product: Chrome

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-93373Published

Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-93382Published

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-93374Published

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

cve-program ·

Vendor product: Chrome

Source modified 19 Sep 2026Recorded 23 Oct 2026

GHSA-pwjx-qhcg-rvj4Published

webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic

osv · CVE-2026-93602 · RUSTSEC-2026-0049

crates.io: rustls-webpki · crates.io: rustls-webpki

MODERATESource modified 19 Sep 2026Recorded 24 Oct 2026

GHSA-xgp8-3hg3-c2mhPublished

webpki: Name constraints were accepted for certificates asserting a wildcard name

osv · CVE-2026-93601 · RUSTSEC-2026-0099

crates.io: rustls-webpki · crates.io: rustls-webpki

LOWSource modified 19 Sep 2026Recorded 24 Oct 2026

GHSA-82j2-j2ch-gfr8Published

rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

osv · CVE-2026-93599 · RUSTSEC-2026-0104

crates.io: rustls-webpki · crates.io: rustls-webpki

HIGHSource modified 19 Sep 2026Recorded 24 Oct 2026

GHSA-965h-392x-2mh5Published

webpki: Name constraints for URI names were incorrectly accepted

osv · CVE-2026-93600 · RUSTSEC-2026-0098

crates.io: rustls-webpki · crates.io: rustls-webpki

LOWSource modified 19 Sep 2026Recorded 24 Oct 2026

CVE-2026-92944Published

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.8Source modified 19 Sep 2026Recorded 25 Oct 2026

CVE-2026-92938Published

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(), which prevents prop…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Secondary 9.9Source modified 19 Sep 2026Recorded 25 Oct 2026

CVE-2026-92933Published

vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sy…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 19 Sep 2026Recorded 25 Oct 2026

CVE-2026-92944Published

vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector

cve-program ·

Vendor product: vm2

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92938Published

vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

cve-program ·

Vendor product: vm2

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92933Published

vm2 before 3.11.8 Information Disclosure via util.getCallSites

cve-program ·

Vendor product: vm2

CVSS 4.0 6.9 · CVSS 3.1 5.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92970Published

HUBzero CMS through 2.2.32 Path Traversal via File Upload

cve-program ·

Vendor product: hubzero-cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-78528Published

WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: searchpro

CVSS 3.1 5.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-74002Published

WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: booking

CVSS 3.1 5.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66630Published

WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: organize-series

CVSS 3.1 7.6Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66619Published

WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: newsletters-lite

CVSS 3.1 7.6Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66579Published

WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

Vendor product: JetElements For Elementor

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-66574Published

WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: bdthemes-element-pack-lite

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-27553Published

Information Disclosure via Schema Path Manipulation

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-62104Published

WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability

cve-program ·

https://wordpress.org/plugins: migratico-lite

CVSS 3.1 10.0Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92860Published

rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation

cve-program ·

Vendor product: Pulse

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-75513Published

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL l…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 19 Sep 2026Recorded 25 Oct 2026

CVE-2026-92917Published

Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92912Published

AVideo Cryptographically Weak PRNG via uniqid Stream Key

cve-program ·

Vendor product: AVideo

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-87796Published

Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

cve-program ·

Vendor product: Multi Uploader for Gravity Forms

CVSS 3.1 9.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-52483Published

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for t…

cve-program ·

Vendor product: n/a

Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-61588Published

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

cve-program ·

Vendor product: djust

CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92595Published

Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

cve-program ·

Vendor product: nodemailer

CVSS 4.0 6.0 · CVSS 3.1 5.9Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92590Published

Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

cve-program ·

Vendor product: cms

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92585Published

AVideo through 29.0 Missing Authorization Check via API Like Endpoint

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92580Published

AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

cve-program ·

Vendor product: AVideo

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-89034Published

TCH QRing R20_B006 Unauthenticated BLE Access

cve-program ·

Vendor product: QRing

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-64684Published

RMCP: Custom HTTP headers leak to cross-origin redirect targets

cve-program ·

Vendor product: rust-sdk

CVSS 3.1 6.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-75513Published

Marten: SQL injection in Marten's LINQ provider via unescaped string literals

cve-program ·

Vendor product: marten

CVSS 3.1 9.1Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92805Published

UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

cve-program ·

Vendor product: community-skeleton

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92800Published

Docs before 5.4.1 Stale Collaboration Session After Access Revocation

cve-program ·

Vendor product: Docs

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92792Published

OpenNHP through 1.0.2 Authentication Bypass via Fallback Verifier

cve-program ·

Vendor product: opennhp

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92787Published

Feast through 0.66.0 Authentication Bypass via Unverified Token

cve-program ·

Vendor product: feast

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 19 Sep 2026Recorded 23 Oct 2026

CVE-2026-92782Published

Chroma through 1.5.9 Authorization Bypass via Collection Identifier

cve-program ·

Vendor product: chroma

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 19 Sep 2026Recorded 23 Oct 2026

MAL-2026-16294Published

Malicious code in internallib_v949 (npm)

osv · GHSA-f863-m366-9cfm

npm: internallib_v949

Source modified 18 Sep 2026Recorded 24 Oct 2026

GHSA-pmpg-6pww-fg6qPublished

ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

osv · CVE-2026-56370

NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64

LOWSource modified 18 Sep 2026Recorded 23 Oct 2026

GHSA-9583-h5hc-x8cwPublished

React Router has Path Traversal in File Session Storage

osv · CVE-2025-61686

npm: @react-router/node · npm: @remix-run/node · npm: @remix-run/deno

CRITICALSource modified 18 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.