Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699311 source statements · aliases may refer to the same vulnerability

CVE-2026-86447Published

LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax

cve-program ·

Vendor product: LearnPress

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86448Published

LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order

cve-program ·

Vendor product: LearnPress

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86449Published

LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

cve-program ·

Vendor product: LearnPress

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86784Published

Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

cve-program ·

Vendor product: Visualizer

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86823Published

Newsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu Parameter

cve-program ·

Vendor product: Newsletter

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87828Published

Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

cve-program ·

Vendor product: Seraphinite Accelerator

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-90982Published

@fastify/static vulnerable to route guard bypass via path case-folding

cve-program ·

Vendor product: @fastify/static

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87854Published

Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass

cve-program ·

Vendor product: Subscriptions for WooCommerce

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87860Published

Subscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF

cve-program ·

Vendor product: Subscriptions for WooCommerce

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87896Published

Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

cve-program ·

Vendor product: Rox Appointment Booking

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87907Published

Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

cve-program ·

Vendor product: Rox Appointment Booking

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87959Published

WPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings Update

cve-program ·

Vendor product: WPBot

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-88910Published

KBoard < 6.7 - Unauthenticated Board Media Deletion via IDOR

cve-program ·

Vendor product: kboard

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-89327Published

FluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' Parameter

cve-program ·

Vendor product: FluentBoards

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-50605Published

Privilege Escalation Vulnerability in NitroSense and PredatorSense Software

cve-program ·

Vendor product: Agent Serivce

CVSS 4.0 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-89328Published

FluentBoards < 2.0.15 - Board Member+ Board Membership and Public Access Modification

cve-program ·

Vendor product: FluentBoards

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2025-15697Published

Dictionary <= 1.0 - Reflected XSS via Multiple Parameters

cve-program ·

Vendor product: Dictionary

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-85128Published

Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request

cve-program ·

Vendor product: Choose User Role at Registration

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-85130Published

WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs

cve-program ·

Vendor product: WPLP Cookie Consent

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86446Published

LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint

cve-program ·

Vendor product: LearnPress

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-50606Published

Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software

cve-program ·

Vendor product: System Monitoring

CVSS 4.0 1.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86707Published

Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter

cve-program ·

Vendor product: Private Feed Key

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86709Published

The Pressengine <= 1.0 - Unauthenticated Authentication Bypass

cve-program ·

Vendor product: The Pressengine

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86710Published

Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

cve-program ·

Vendor product: Login with QR

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86788Published

HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

cve-program ·

Vendor product: HT Mega Addons for Elementor

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86824Published

Newsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key

cve-program ·

Vendor product: Newsletter

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87786Published

Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates

cve-program ·

Vendor product: Dewa Kirim

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87836Published

Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export

cve-program ·

Vendor product: Comments Import & Export

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-88792Published

Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update

cve-program ·

Vendor product: Dictionary

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-88795Published

wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token

cve-program ·

Vendor product: wpShopGermany IT-RECHT KANZLEI

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-88904Published

PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

cve-program ·

Vendor product: PuppyFW

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81866Published

Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.nifi:nifi-web-api

CVSS 4.0 0.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-90922Published

Paid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch

cve-program ·

Vendor product: Paid Membership Subscriptions

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-90923Published

Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion

cve-program ·

Vendor product: Autopay

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91008Published

Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel

cve-program ·

Vendor product: Event Booking Manager for WooCommerce

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91009Published

Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment

cve-program ·

Vendor product: Active Woot Products Tables for WooCommerce. 100% FREE

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91010Published

Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion

cve-program ·

Vendor product: Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-50607Published

WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software

cve-program ·

Vendor product: System Monitoring

CVSS 4.0 2.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91011Published

EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion

cve-program ·

Vendor product: EWWW Image Optimizer

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91014Published

Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

cve-program ·

Vendor product: Realtyna Organic IDX plugin + WPL Real Estate

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-50608Published

Authentication Vulnerability in NitroSense and PredatorSense Software

cve-program ·

Vendor product: System Monitoring

CVSS 4.0 1.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91015Published

Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

cve-program ·

Vendor product: Master Addons for Elementor

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91016Published

Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure

cve-program ·

Vendor product: Motors

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91019Published

Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

cve-program ·

Vendor product: Event Booking Manager for WooCommerce

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-50609Published

Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software

cve-program ·

Vendor product: System Monitoring

CVSS 4.0 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-50610Published

Improper Access control Vulnerability in NitroSense and PredatorSense Software

cve-program ·

Vendor product: System Monitoring

CVSS 4.0 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-39821Published

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.2Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-32829Published

lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression opera…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2025-61726Published

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can par…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2024-21626Published

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc ex…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 8.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.6Source modified 17 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.