Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699276 source statements · aliases may refer to the same vulnerability

CVE-2026-91969Published

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-68536Published

Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.myfaces.core:myfaces-impl

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92756Published

Combining encryption settings may disable encryption

cve-program ·

Vendor product: MongoDB Entity Framework Core Provider

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92943Published

Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

cve-program ·

Vendor product: AWSIoTPythonSDK

CVSS 3.1 8.1 · CVSS 4.0 9.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92758Published

Logs may collect sensitive information

cve-program ·

Vendor product: MongoDB Entity Framework Core Provider

CVSS 4.0 5.7 · CVSS 3.1 5.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92757Published

Malformed connection string may disable field level encryption

cve-program ·

Vendor product: MongoDB Entity Framework Core Provider

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-57846Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91039Published

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 9.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86792Published

Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

cve-program ·

https://pypi.python.org: apache-airflow-providers-apache-kafka

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-89418Published

Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)

cve-program ·

Vendor product: protobuf-javascript (aka google-protobuf npm package)

CVSS 4.0 8.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-70469Published

Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.nifi:nifi-jetty

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-88592Published

kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter …

cve-program ·

Vendor product: n/a

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-71568Published

BMCtest exposes Ironic without authentication and TLS during the test

cve-program ·

Vendor product: bmctest

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-88952Published

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 9.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86465Published

Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key

cve-program ·

https://pypi.python.org: apache-airflow-providers-akeyless

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-88743Published

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.

cve-program ·

Vendor product: n/a

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2024-58384Published

Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

cve-program ·

Vendor product: tornado

CVSS 4.0 6.3 · CVSS 3.1 5.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91933Published

Flowise before 3.1.4 Authorization Bypass via openai-realtime

cve-program ·

Vendor product: Flowise

CVSS 3.1 7.1 · CVSS 4.0 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91938Published

Flowise before 3.1.4 Server-Side Request Forgery via document loaders

cve-program ·

Vendor product: Flowise · Vendor product: Flowise

CVSS 3.1 7.1 · CVSS 4.0 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91944Published

crawl4ai before 0.9.3 DOM-based XSS via Playground UI

cve-program ·

Vendor product: crawl4ai

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91949Published

FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 9.2 · CVSS 3.1 9.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91954Published

FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91969Published

vikunja before 2.6.0 Resource Exhaustion via CSV Migration

cve-program ·

Vendor product: vikunja

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91979Published

Vikunja before 2.6.0 Denial of Service via Decompression Bomb

cve-program ·

Vendor product: vikunja

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91984Published

Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

cve-program ·

Vendor product: vikunja

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91989Published

atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py

cve-program ·

Vendor product: atomic-agents-stack

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-89026Published

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

cve-program ·

Vendor product: Issabel Framework

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82311Published

Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

cve-program ·

https://pypi.python.org: apache-airflow-providers-fab

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76854Published

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi

cve-program ·

Vendor product: NR255-V

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76859Published

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi

cve-program ·

Vendor product: NR255-V

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76864Published

Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names

cve-program ·

Vendor product: NR255-V

CVSS 4.0 4.8 · CVSS 3.1 4.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76869Published

Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgi

cve-program ·

Vendor product: NR255-V

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92455Published

yshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints

cve-program ·

Vendor product: yshop-crm

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2023-4622Published

Use-after-free in Linux kernel's af_unix component

cve-program ·

Vendor product: kernel

CVSS 3.1 7.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92460Published

yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing

cve-program ·

Vendor product: yshop-crm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81176Published

Svelte devalue: DoS via malformed input

cve-program ·

Vendor product: devalue

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86003Published

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

cve-program ·

Vendor product: coredns

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86071Published

Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

cve-program ·

Vendor product: junrar

CVSS 3.1 3.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92750Published

Harness through 3.3.0 Missing Access Control via infraproviders endpoint

cve-program ·

Vendor product: harness

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92759Published

SecObserve before 1.59.1 Information Disclosure via API Configuration

cve-program ·

Vendor product: SecObserve

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92773Published

Trigger.dev before 4.6.0 GitHub App Installation Takeover

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92779Published

Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via Bindings

cve-program ·

Vendor product: @builder.io/sdk-react · Vendor product: @builder.io/sdk-vue · Vendor product: @builder.io/sdk-svelte

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92784Published

@refinedev/inferencer through 7.0.0 Code Injection via API Field Names

cve-program ·

Vendor product: @refinedev/inferencer

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86462Published

Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions

cve-program ·

https://pypi.python.org: apache-airflow-providers-fab

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92789Published

Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect

cve-program ·

Vendor product: graylog2-server

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92794Published

OpenSign through 2.41.3 Information Disclosure via getDocument

cve-program ·

Vendor product: OpenSign

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92802Published

kan through 0.6.0 Authorization Bypass via GitHub Project Import

cve-program ·

Vendor product: kan

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92814Published

changedetection.io through 0.60.6 Cross-Site Scripting via watch_title

cve-program ·

Vendor product: changedetection.io

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81871Published

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

cve-program ·

Vendor product: opentelemetry-go

CVSS 4.0 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92577Published

AVideo through 29.0 API get_api_video Broken Access Control via clean_title

cve-program ·

Vendor product: AVideo

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.