Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699261 source statements · aliases may refer to the same vulnerability

CVE-2026-88622Published

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

cve-program ·

Vendor product: n/a

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93599Published

rustls-webpki before 0.103.13 Panic via empty BIT STRING

cve-program ·

Vendor product: webpki

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93604Published

vm2 3.11.8 Sandbox Escape via crypto.setFips

cve-program ·

Vendor product: vm2

CVSS 4.0 6.9 · CVSS 3.1 7.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92025Published

Use-after-free in the DOM: Navigation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92026Published

Use-after-free in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92027Published

Use-after-free in the DOM: Streams component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20326Published

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function

cve-program ·

Vendor product: Cisco Nexus Dashboard

CVSS 3.1 9.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20322Published

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access Control

cve-program ·

Vendor product: Cisco Nexus Dashboard

CVSS 3.1 9.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20192Published

Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 10.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20130Published

Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 10.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20237Published

Cisco Identity Services Engine Hardening Release - Input Validation Vulnerabilities

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 9.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-76409Published

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Limitation of a Pathname

cve-program ·

Vendor product: Cisco Nexus Dashboard

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20344Published

Cisco Secure Firewall Management Center Software SQL Injection Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Management Center (FMC)

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-28326Published

SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

cve-program ·

Vendor product: Access Rights Manager

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-90999Published

Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

cve-program ·

Vendor product: Sentry Seer

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2021-3030Published

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim …

cve-program ·

Vendor product: n/a

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-91723Published

Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-91732Published

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium …

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-91742Published

Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium se…

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-91719Published

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93387Published

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92230Published

Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

cve-program ·

Vendor product: Apache Karaf

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93380Published

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. (Chromium…

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93384Published

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severi…

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93383Published

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54510Published

Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook

cve-program ·

Vendor product: speakr

CVSS 3.1 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93376Published

Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sandbox via a local program. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93378Published

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93385Published

Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93386Published

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 18 Sep 2026Recorded 23 Oct 2026

GHSA-m6c8-jcw2-5r25Published

Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

osv · CVE-2026-77615

Maven: org.opencastproject:opencast-engage-paella-player-7 · Maven: org.opencastproject:opencast-engage-paella-player-7 · npm: paella-core

HIGHSource modified 18 Sep 2026Recorded 24 Oct 2026

CVE-2026-54597Published

ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

cve-program ·

Vendor product: itflow

CVSS 3.1 8.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-16750Published

Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure

cve-program ·

Vendor product: Motors – Car Dealership & Classified Listings Plugin

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-39835Published

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these ca…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 5.3 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-33810Published

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certi…

nvd ·

CVSS 3.1 · [email protected] · Primary 8.2 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.8Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-33186Published

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.1Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-32283Published

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS …

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-32280Published

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct user…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-27145Published

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN l…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 6.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-25679Published

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 18 Sep 2026Recorded 25 Oct 2026

CVE-2026-53554Published

SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processing

cve-program ·

Vendor product: SQLBot

CVSS 4.0 7.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-53555Published

Stored XSS via SVG Upload

cve-program ·

Vendor product: SQLBot

CVSS 4.0 5.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54608Published

MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

cve-program ·

Vendor product: MythicalDash

CVSS 4.0 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54671Published

WeGIA: Authorization Bypass via Empty Resource Array in InternoControle

cve-program ·

Vendor product: WeGIA

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54648Published

CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion

cve-program ·

Vendor product: v6

CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-54643Published

CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php

cve-program ·

Vendor product: v6

CVSS 3.1 5.4Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93308Published

O-RAN-SC SMO OAM VES Collector allocation of resources

cve-program ·

Vendor product: SMO OAM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93450Published

go-openapi/swag jsonutils before 0.27.1 Uncontrolled Recursion in Ordered JSON Marshal and Unmarshal

cve-program ·

https://proxy.golang.org: swag

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93313Published

Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow

cve-program ·

Vendor product: Poppler

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92991Published

Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API

cve-program ·

Vendor product: Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator · Vendor product: Pixel Gallery Addons for Elementor · Vendor product: Smart Admin Assistant

CVSS 3.1 5.4Source modified 18 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.