Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699276 source statements · aliases may refer to the same vulnerability

CVE-2026-20340Published

Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Management Center (FMC)

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

GHSA-v836-6xw4-9cx3Published

vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

osv · CVE-2026-92961

npm: vm2

HIGHSource modified 18 Sep 2026Recorded 24 Oct 2026

GHSA-q3fm-4wcw-g57xPublished

vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter

osv · CVE-2026-92962

npm: vm2

LOWSource modified 18 Sep 2026Recorded 24 Oct 2026

CVE-2026-81447Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to I…

cve-program ·

Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4

CVSS 3.1 6.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-65357Published

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memo…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20341Published

Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Management Center (FMC)

CVSS 3.1 9.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20242Published

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Management Center (FMC)

CVSS 3.1 9.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20361Published

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection

cve-program ·

Vendor product: Cisco Nexus Dashboard

CVSS 3.1 8.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20324Published

Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Management Center (FMC)

CVSS 3.1 9.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81445Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of p…

cve-program ·

CVSS 3.1 7.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20194Published

Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 9.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81477Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

cve-program ·

CVSS 3.1 7.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81478Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthor…

cve-program ·

CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81480Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

cve-program ·

CVSS 3.1 7.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81474Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privile…

cve-program ·

CVSS 3.1 7.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81475Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to…

cve-program ·

CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81476Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could pot…

cve-program ·

CVSS 3.1 8.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20284Published

Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software

CVSS 3.1 9.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-56960Published

In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-91102Published

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

cve-program ·

Vendor product: HP Linux Imaging and Printing Software (HPLIP)

CVSS 4.0 8.4Source modified 18 Sep 2026Recorded 23 Oct 2026

MAL-2026-16277Published

Malicious code in xa424234657567 (npm)

osv ·

npm: xa424234657567

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16279Published

Malicious code in xzvbailsx (npm)

osv ·

npm: xzvbailsx

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16278Published

Malicious code in xzvbailey (npm)

osv ·

npm: xzvbailey

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-10041Published

Malicious code in chai-as-buffered (npm)

osv · GHSA-jvvq-ph8p-7cc9

npm: chai-as-buffered

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2022-250Published

Malicious code in @epic-mod-market/ui (npm)

osv · GHSA-6p4m-66w3-6qpp

npm: @epic-mod-market/ui

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16253Published

Malicious code in laycot (npm)

osv ·

npm: laycot

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16273Published

Malicious code in blue-string-formatter-utils (npm)

osv ·

npm: blue-string-formatter-utils

Source modified 18 Sep 2026Recorded 24 Oct 2026

MAL-2026-16272Published

Malicious code in kartykgithub-multiversion-a (npm)

osv · GHSA-p957-4pc7-x6hp

npm: kartykgithub-multiversion-a

Source modified 17 Sep 2026Recorded 24 Oct 2026

MAL-2026-16271Published

Malicious code in test89078-auth (npm)

osv ·

npm: test89078-auth

Source modified 17 Sep 2026Recorded 24 Oct 2026

MAL-2026-16270Published

Malicious code in @tink/tink-link-core (npm)

osv ·

npm: @tink/tink-link-core

Source modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-79276Published

Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79264Published

Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79259Published

Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79251Published

Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79248Published

Incorrect authorization in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79238Published

Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79217Published

Incorrect authorization in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79213Published

Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79211Published

Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79205Published

Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79201Published

Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79199Published

Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79192Published

Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79190Published

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79151Published

Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79143Published

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79137Published

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79136Published

Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79116Published

Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-79087Published

Injection in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.