Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699309 source statements · aliases may refer to the same vulnerability

CVE-2026-14805Published

Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX

cve-program ·

Vendor product: Consulting - Business, Finance WordPress Theme

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92939Published

vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

cve-program ·

Vendor product: vm2

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92945Published

vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

cve-program ·

Vendor product: vm2

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92950Published

vm2 before 3.11.7 Sandbox Escape via CLI require

cve-program ·

Vendor product: vm2

CVSS 4.0 9.3 · CVSS 3.1 8.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92955Published

vm2 before 3.11.8 Sandbox Escape via NodeVM

cve-program ·

Vendor product: vm2

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92960Published

vm2 before 3.11.6 Process-wide State Exposure via os and dns

cve-program ·

Vendor product: vm2

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-52821Published

Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81441Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to …

cve-program ·

Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4

CVSS 3.1 4.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-67278Published

TLS server impersonation possible in Mikrotik RouterOS

cve-program ·

Vendor product: RouterOS

CVSS 4.0 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76413Published

Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Management Center (FMC)

CVSS 3.1 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-57147Published

praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

cve-program ·

Vendor product: PraisonAI · Vendor product: praisonai-platform

CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-57139Published

PraisonAI MCPServer exposes unauthenticated HTTP tools/call

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-57138Published

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function() inside with(sandbox) and relies on a small source-code blocklist…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-81869Published

OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

cve-program ·

Vendor product: opentelemetry-go

CVSS 4.0 5.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-90822Published

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management …

cve-program ·

Vendor product: MPVPN · Vendor product: WARP · Vendor product: IPVPN

CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-57138Published

PraisonAI codeMode sandbox escape via Function constructor

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 9.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92527Published

chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery

cve-program ·

Vendor product: chatwoot

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-47426Published

OpenAM OAuth Client Impersonation via JWKS Resolver Cache

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-90823Published

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management in…

cve-program ·

Vendor product: MPVPN · Vendor product: WARP · Vendor product: IPVPN

CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-46623Published

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76433Published

Cisco Identity Services Engine Information Disclosure Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-20309Published

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software

CVSS 3.1 6.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-78295Published

WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: xagio-seo

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-74000Published

WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: simple-membership

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66628Published

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-lister-for-ebay

CVSS 3.1 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66618Published

WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-google-map-plugin

CVSS 3.1 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-20071Published

ISE 802.1x Session Hijack Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software

CVSS 3.1 3.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66578Published

WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: propertyhive

CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-66573Published

WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

Vendor product: JetTabs

CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76446Published

Cisco Identity Services Engine External Entity Injection Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 4.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-62101Published

WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability

cve-program ·

https://wordpress.org/plugins: eduadmin-booking

CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-45048Published

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

cve-program ·

Vendor product: OpenAM

CVSS 3.1 8.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76447Published

Cisco Identity Services Engine Certificate Reload Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81876Published

HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service

cve-program ·

Vendor product: org.hl7.fhir.core

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-44203Published

OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

cve-program ·

Vendor product: OpenAM

CVSS 4.0 8.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91782Published

GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf_x86_allocate_dynrelocs null pointer dereference

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92749Published

SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

cve-program ·

Vendor product: SafeLine

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2025-10881Published

CATPRODUCT File Parsing Heap-Based Overflow Vulnerability

cve-program ·

Vendor product: Shared Components · Vendor product: AutoCAD

CVSS 3.1 7.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91090Published

GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow

cve-program ·

Vendor product: GPAC

CVSS 4.0 2.4 · CVSS 3.1 3.9 · CVSS 3.0 3.9 · CVSS 2.0 3.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91005Published

SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload

cve-program ·

Vendor product: Online Faculty Clearance System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92754Published

PatrowlManager through 1.8.4 Improper Access Control via users API

cve-program ·

Vendor product: PatrowlManager

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2021-20327Published

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.4 · CVSS 3.1 · [email protected] · Primary 6.8 · CVSS 2.0 · [email protected] · Primary 4.3Source modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-92763Published

Rundeck through 6.2.1 Authorization Bypass via Project Import

cve-program ·

Vendor product: rundeck

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92778Published

CMAK through 3.0.0.6 Feature Gate Bypass via HTML Form Routes

cve-program ·

Vendor product: CMAK

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-15758Published

3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter

cve-program ·

Vendor product: 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-90881Published

D-Link DIR-882 CGI Binary dllog.cgi main information disclosure

cve-program ·

Vendor product: DIR-882

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92783Published

Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion

cve-program ·

Vendor product: yeti

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92788Published

Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node

cve-program ·

Vendor product: coze-studio

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92793Published

GoAdmin through 1.2.26 Authorization Bypass via Query Parameter

cve-program ·

Vendor product: go-admin

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92801Published

cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cve-program ·

Vendor product: cc-connect

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.