Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699236 source statements · aliases may refer to the same vulnerability

CVE-2026-50275Published

Datadog PHP Tracer: Improper parsing of W3C baggage headers may lead to DoS

cve-program ·

Vendor product: dd-trace-php

CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54521Published

FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)

cve-program ·

Vendor product: FairEmail

CVSS 3.1 6.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92594Published

Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL

cve-program ·

Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-67071Published

HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer

cve-program ·

Vendor product: HCL DevOps Deploy / HCL Launch

CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-48977Published

OpenSlide: Arbitrary memory write with crafted Ventana BIF file

cve-program ·

Vendor product: openslide

CVSS 4.0 7.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92599Published

Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

cve-program ·

Vendor product: joi · Vendor product: joi

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54604Published

OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1

cve-program ·

Vendor product: openslide

CVSS 4.0 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54907Published

Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission

cve-program ·

Vendor product: caddy-proxy-manager

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-49826Published

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a …

nvd ·

CVSS 4.0 · [email protected] · Secondary 0.0Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-69146Published

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any auth…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-69148Published

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in ml…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-72925Published

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlle…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73420Published

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalizat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73421Published

NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js …

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73646Published

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(d…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-73651Published

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.7Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-93426Published

SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names

cve-program ·

Vendor product: signoz

CVSS 4.0 8.4 · CVSS 3.1 8.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54612Published

Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

cve-program ·

Vendor product: Vvveb

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54767Published

WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php

cve-program ·

Vendor product: WeGIA

CVSS 3.1 9.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54734Published

Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction

cve-program ·

Vendor product: prebid-server-java

CVSS 3.1 10.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54644Published

CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

cve-program ·

Vendor product: v6

CVSS 3.1 6.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-53556Published

SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

cve-program ·

Vendor product: SQLBot

CVSS 4.0 6.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93310Published

O-RAN-SC SMO OAM VES Collector allocation of resources

cve-program ·

Vendor product: SMO OAM

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-79954Published

NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID

cve-program ·

Vendor product: CryptoLib

CVSS 4.0 8.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-13471Published

LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

cve-program ·

Vendor product: Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-6205Published

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and cond…

cve-program ·

Vendor product: DiskStation Manager (DSM)

CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77239Published

WACRM: Service-role routes missing a role check

cve-program ·

Vendor product: wacrm

CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93591Published

SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go

cve-program ·

Vendor product: siyuan

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77607Published

Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 3.1 6.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2025-66455Published

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

cve-program ·

Vendor product: lmdeploy

CVSS 3.1 9.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77385Published

Kyoo: Transcoder serves uncataloged files from the media directory

cve-program ·

Vendor product: Kyoo

CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-69186Published

c-ares: Memory-amplification denial of service via unvalidated DNS header record counts

cve-program ·

Vendor product: c-ares

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-63458Published

Perses project query parameter authorization bypass exposes cross-project resources

cve-program ·

Vendor product: perses

CVSS 4.0 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81179Published

SysReptor: Host header injection might allow account takeover

cve-program ·

Vendor product: sysreptor

CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92953Published

vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

cve-program ·

Vendor product: vm2

CVSS 4.0 9.3 · CVSS 3.1 10.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93650Published

Saleor throttling.py get_client_ip excessive authentication

cve-program ·

Vendor product: Saleor

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93852Published

In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API…

cve-program ·

Vendor product: Blazar

CVSS 4.0 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-11538Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 3.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-18869Published

IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]

cve-program ·

Vendor product: i

CVSS 3.1 6.4Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81626Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 8.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-82980Published

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated…

cve-program ·

Vendor product: Files Lock

CVSS 3.0 6.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77169Published

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organiz…

cve-program ·

Vendor product: Team Folders

CVSS 3.0 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-82982Published

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced …

cve-program ·

Vendor product: Approval

CVSS 3.0 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77170Published

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

cve-program ·

Vendor product: Deck

CVSS 3.0 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77164Published

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF prot…

cve-program ·

Vendor product: Server

CVSS 3.0 6.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-82985Published

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album …

cve-program ·

Vendor product: Server

CVSS 3.0 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-68493Published

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

cve-program ·

Vendor product: Server

CVSS 3.0 3.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93331Published

GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds

cve-program ·

Vendor product: GPAC

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-18911Published

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

cve-program ·

Vendor product: ManageEngine DataSecurity Plus

CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92622Published

Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute

cve-program ·

Vendor product: Strong Testimonials

CVSS 3.1 6.4Source modified 18 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.