Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699291 source statements · aliases may refer to the same vulnerability

CVE-2026-35159Published

Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.

cve-program ·

Vendor product: Inspiron 15 3520 · Vendor product: G15 5530 · Vendor product: Alienware 16 Area-51 AA16250

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-26986Published

FreeRDP has heap-use-after-free in rail_window_free

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 5.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-21715Published

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.

cve-program ·

Vendor product: node

CVSS 3.0 3.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-13117Published

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

cve-program ·

Vendor product: OpenVPN

CVSS 4.0 6.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-13062Published

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

cve-program ·

Vendor product: MongoDB Server

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-13060Published

$graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access

cve-program ·

Vendor product: MongoDB Server

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-12932Published

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

cve-program ·

Vendor product: OpenVPN

CVSS 4.0 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-75025Published

Mattermost Desktop local network access from server-rendered content

cve-program ·

Vendor product: Mattermost

CVSS 3.1 4.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-3203Published

Buffer Over-read in Wireshark

cve-program ·

Vendor product: Wireshark

CVSS 3.1 5.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-73443Published

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef

cve-program ·

Vendor product: EOS

CVSS 3.1 4.7 · CVSS 4.0 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-73442Published

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for

cve-program ·

Vendor product: EOS

CVSS 3.1 3.0 · CVSS 4.0 2.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-73457Published

Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.

cve-program ·

Vendor product: EOS

CVSS 3.1 5.3 · CVSS 4.0 6.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-73462Published

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I

cve-program ·

Vendor product: EOS

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92932Published

MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled

cve-program ·

Vendor product: sachertortephp

CVSS 4.0 5.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81632Published

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

cve-program ·

https://repo.hex.pm: ash_authentication_phoenix · https://github.com: team-alembic/ash_authentication_phoenix · https://repo.hex.pm: ash_authentication

CVSS 4.0 7.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-80218Published

Sign-in token minted for one resource accepted by another in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81320Published

Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: rhbac-4/hawtio-rhel9

CVSS 3.1 5.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-78223Published

Token revocation record built from unverified JWT claims in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 6.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86522Published

Log injection via an unescaped password reset identity in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81637Published

Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 2.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82761Published

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 9.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82685Published

Confirmation token accepted on any record in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82760Published

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82759Published

Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 1.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86533Published

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication · https://repo.hex.pm: ash_authentication_phoenix

CVSS 4.0 9.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-32896Published

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 4.8 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-28474Published

OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist validation, allowing attackers to bypass DM and room allowlists. An attacker can change their Ne…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.8Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-28465Published

OpenClaw's voice-call plugin versions before 2026.2.3 contain an improper authentication vulnerability in webhook verification that allows remote attackers to bypass verification by supplying untrusted forwarded headers. Attackers can spoof…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 17 Sep 2026Recorded 25 Oct 2026

GHSA-8phw-xrj9-cpqpPublished

Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

osv · CVE-2026-75523

NuGet: Steeltoe.Management.Endpoint

MODERATESource modified 17 Sep 2026Recorded 23 Oct 2026

GHSA-vrf4-mx87-p53wPublished

libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

osv · CVE-2026-86039

npm: @libp2p/peer-store

HIGHSource modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-85500Published

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

cve-program ·

https://repo.hex.pm: ash_authentication · https://github.com: team-alembic/ash_authentication

CVSS 4.0 9.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-14850Published

Weak password recovery mechanism for forgotten password in MobiAPParc

cve-program ·

Vendor product: MobiAPParc

CVSS 4.0 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-8674Published

Assertion failure in the DNS stub resolver with a long search domain

cve-program ·

Vendor product: glibc

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82875Published

ToolJet before v3.16.208 Authorization Bypass via organizationId

cve-program ·

Vendor product: ToolJet

CVSS 4.0 5.1 · CVSS 3.1 5.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82872Published

ToolJet before v3.16.208 Cross-Workspace Authorization Bypass

cve-program ·

Vendor product: ToolJet

CVSS 4.0 7.1 · CVSS 3.1 9.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82871Published

ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes

cve-program ·

Vendor product: ToolJet

CVSS 4.0 8.2 · CVSS 3.1 7.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82870Published

ToolJet before v3.16.208 Cross-Tenant Database Manipulation

cve-program ·

Vendor product: ToolJet

CVSS 4.0 7.0 · CVSS 3.1 9.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-82472Published

Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

cve-program ·

Vendor product: documenso

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66396Published

SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.3 · CVSS 3.1 8.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66395Published

SiYuan Desktop before v3.7.2 Reflected XSS to RCE via siyuan Protocol

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.4 · CVSS 3.1 9.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66012Published

SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

cve-program ·

Vendor product: siyuan

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66010Published

DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66005Published

Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

cve-program ·

Vendor product: jan

CVSS 4.0 5.3 · CVSS 3.1 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-65918Published

PyTorch torchvision GIF Decoder Out-of-bounds Heap Read

cve-program ·

Vendor product: vision

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-65606Published

SiYuan before v3.7.2 Cross-Site Scripting to RCE

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.4 · CVSS 3.1 9.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-65605Published

SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.4 · CVSS 3.1 9.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-65013Published

Onlook tRPC Insecure Direct Object Reference via multiple procedures

cve-program ·

Vendor product: repo

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-63768Published

cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cve-program ·

Vendor product: cal.diy

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-63765Published

Chatwoot < 4.16.0 Unauthenticated ActiveStorage Direct Upload Arbitrary Blob Creation

cve-program ·

Vendor product: chatwoot

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-62240Published

CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

cve-program ·

Vendor product: crewAI

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.