Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699250 source statements · aliases may refer to the same vulnerability

CVE-2025-61682Published

Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 3.1 8.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86184Published

Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route

cve-program ·

Vendor product: laradashboard

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86189Published

WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86194Published

Grav Form Plugin before 9.1.22 Cross-Page Form Execution

cve-program ·

Vendor product: grav-plugin-form

CVSS 4.0 6.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86250Published

h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie

cve-program ·

Vendor product: h3

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86255Published

wger before 2.5 Uncontrolled Resource Consumption via date_sequence

cve-program ·

Vendor product: wger

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86416Published

ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

cve-program ·

https://github.com/ILIAS-eLearning/ILIAS: ILIAS

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-87794Published

bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination

cve-program ·

https://www.npmjs.com/package/bestzip: bestzip

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-87809Published

Siyuan before v3.8.2 Information Disclosure via Export Preview

cve-program ·

Vendor product: siyuan

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-87814Published

SiYuan before v3.8.2 Stored XSS via Asset Preview

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.4 · CVSS 3.1 7.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-56711Published

VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability

cve-program ·

Vendor product: VLC media player

CVSS 4.0 7.3 · CVSS 3.1 7.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86739Published

Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence

cve-program ·

Vendor product: snipe-it

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86744Published

snipe-it before 8.7.0 Race Condition in Asset Checkout

cve-program ·

Vendor product: snipe-it

CVSS 4.0 2.1 · CVSS 3.1 2.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-88865Published

AVideo Missing Authorization via getRestream.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-88870Published

WWBN AVideo LoginControl PGP Key CSRF via GET Request

cve-program ·

Vendor product: AVideo

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-88875Published

AVideo Incomplete API Sanitization Information Disclosure

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-75584Published

ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion

cve-program ·

Vendor product: ION-DTN

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-89044Published

Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

cve-program ·

https://repo1.maven.org/maven2/io/netty/netty-codec-http/: netty

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-90556Published

Freeciv before 3.2.6 Heap Buffer Overflow via worklist_load

cve-program ·

Vendor product: freeciv

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-90489Published

Xuxueli xxl-job insert cross site scripting

cve-program ·

Vendor product: xxl-job

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-90775Published

PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

cve-program ·

Vendor product: address_standardizer

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-91956Published

FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-91961Published

FreeRDP before 3.31.0 Denial of Service via URBDRC

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93652Published

Integer Overflow or Wraparound in µD3TN

cve-program ·

Vendor product: µD3TN

CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77616Published

Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 3.1 6.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-44639Published

NanoMQ: O(N²) Denial of Service in MQTT v5 Property Parsing

cve-program ·

Vendor product: nanomq

CVSS 3.1 3.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81505Published

Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

cve-program ·

Vendor product: convoy

CVSS 4.0 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93534Published

spatie Scotty Self Update SelfUpdater.php update code download

cve-program ·

Vendor product: Scotty

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77301Published

adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)

cve-program ·

Vendor product: adm-zip

CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-63405Published

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

cve-program ·

Vendor product: anycable

CVSS 3.1 5.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-63406Published

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

cve-program ·

Vendor product: anycable

CVSS 3.1 5.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93578Published

Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: netty-handler-ssl-ocsp

CVSS 3.1 5.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2025-14754Published

IBM Cloud Pak for Data is vulnerable to OS command injection

cve-program ·

Vendor product: Cloud Pak for Data

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-59181Published

OpenImageIO: Stack buffer overflow in OpenImageIO Cineon reader via unchecked numberOfElements

cve-program ·

Vendor product: OpenImageIO

CVSS 3.1 6.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-58197Published

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

cve-program ·

Vendor product: toolhive · Vendor product: toolhive-studio

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77339Published

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

cve-program ·

Vendor product: process-compose

CVSS 4.0 5.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93658Published

uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid

cve-program ·

https://crates.io: coreutils

CVSS 4.0 7.3 · CVSS 3.1 7.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2025-36076Published

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

cve-program ·

Vendor product: Cognos Analytics

CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-65970Published

OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`

cve-program ·

Vendor product: OpenImageIO

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-16514Published

Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86520Published

Use of Hard-coded Credentials in Bransys ELD

cve-program ·

Vendor product: ELD · Vendor product: ELD

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-10030Published

IBM MQ Console is vulnerable to privilege escalation

cve-program ·

Vendor product: MQ

CVSS 3.1 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

MAL-2026-16287Published

Malicious code in openmct-heatmap (npm)

osv · GHSA-qx52-2xq4-3x3v

npm: openmct-heatmap

Source modified 18 Sep 2026Recorded 24 Oct 2026

CVE-2026-92972Published

SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint

cve-program ·

Vendor product: sglang

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86689Published

Cleartext Transmission of Sensitive Information in Bransys ELD

cve-program ·

Vendor product: ELD · Vendor product: ELD

CVSS 3.1 5.9 · CVSS 4.0 8.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83319Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 7.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2025-13882Published

Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

cve-program ·

Vendor product: Sterling Partner Engagement Manager Essentials Edition · Vendor product: Sterling Partner Engagement Manager Standard Edition

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77960Published

Use of Hard-coded Credentials in Bransys ELD

cve-program ·

Vendor product: ELD · Vendor product: ELD

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83320Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 7.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93531Published

gedelumbung HospitalManagement cross-site request forgery

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 18 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.