Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699311 source statements · aliases may refer to the same vulnerability

CVE-2026-92611Published

In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny `LogRule` entries…

cve-program ·

Vendor product: Eclipse Ankaios

CVSS 4.0 4.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86801Published

To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

cve-program ·

https://wordpress.org/plugins: To Do List Member

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91017Published

Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback

cve-program ·

https://wordpress.org/plugins: Robokassa payment gateway for Woocommerce

CVSS 3.1 3.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87829Published

Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting

cve-program ·

https://wordpress.org/plugins: Checkout Field Manager (Checkout Manager) for WooCommerce

CVSS 3.1 4.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-87831Published

Checkout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field

cve-program ·

https://wordpress.org/plugins: Checkout Field Manager (Checkout Manager) for WooCommerce

CVSS 3.1 4.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92903Published

Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings

cve-program ·

https://pypi.org: snowflake-cli · https://pypi.org: snowflake-cli-labs

CVSS 3.1 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-53681Rejected

Red Hat Product Security has come to the conclusion that this CVE is not needed.

cve-program ·

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-53679Rejected

Red Hat Product Security has come to the conclusion that this CVE is not needed.

cve-program ·

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-11874Rejected

Red Hat Product Security has come to the conclusion that this CVE is not needed.

cve-program ·

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-34993Published

AIOHTTP Vulnerable to Deserialization of Untrusted Data

cve-program ·

Vendor product: aiohttp

CVSS 3.1 6.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-3039Published

BIND 9 server memory exhaustion during GSS-API TKEY negotiation

cve-program ·

Vendor product: BIND 9

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-5946Published

Invalid handling of CLASS != IN

cve-program ·

Vendor product: BIND 9

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-4926Published

path-to-regexp vulnerable to Denial of Service via sequential optional groups

cve-program ·

Vendor product: path-to-regexp

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-1519Published

Excessive NSEC3 iterations cause high CPU load during insecure delegation validation

cve-program ·

Vendor product: BIND 9

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-52860Published

Vim: Arbitrary Code Execution via Python Omni-Completion

cve-program ·

Vendor product: vim

CVSS 4.0 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-30922Published

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

cve-program ·

Vendor product: pyasn1

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-44172Published

MariaDB: mysql_real_escape_string() incorrectly handled big5

cve-program ·

Vendor product: server

CVSS 4.0 6.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2024-21626Published

runc container breakout through process.cwd trickery and leaked fds

cve-program ·

Vendor product: runc

CVSS 3.1 8.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-23490Published

pyasn1 has a DoS vulnerability in decoder

cve-program ·

Vendor product: pyasn1

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-32829Published

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

cve-program ·

Vendor product: lz4_flex

CVSS 4.0 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2025-56005Published

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.…

cve-program ·

Vendor product: n/a

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-29181Published

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

cve-program ·

Vendor product: opentelemetry-go

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-45292Published

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

cve-program ·

Vendor product: opentelemetry-java · Vendor product: opentelemetry-api · Vendor product: opentelemetry-extension-trace-propagators

CVSS 3.1 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-39821Published

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

cve-program ·

https://pkg.go.dev: net/http · https://pkg.go.dev: net/http/internal/http2 · https://pkg.go.dev: golang.org/x/net/idna

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-33815Published

CVE-2026-33815 in github.com/jackc/pgx

cve-program ·

https://pkg.go.dev: github.com/jackc/pgx/v5/pgproto3

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92913Published

AVideo Weak PRNG Activation Code Authentication Bypass

cve-program ·

Vendor product: AVideo

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81479Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.

cve-program ·

Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4

CVSS 3.1 5.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81440Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized a…

cve-program ·

CVSS 3.1 7.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-14275Published

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

cve-program ·

Vendor product: i Access Family

CVSS 3.1 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-14276Published

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

cve-program ·

Vendor product: i Access Family

CVSS 3.1 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-14277Published

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

cve-program ·

Vendor product: i Access Family

CVSS 3.1 6.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91948Published

FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-55770Published

OpenBao: LDAPi ldaputil (wrong escape func)

cve-program ·

Vendor product: openbao

CVSS 3.1 6.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-21586Published

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center.

cve-program ·

Vendor product: Confluence Data Center

CVSS 4.0 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-21587Published

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center.

cve-program ·

Vendor product: Jira Service Management Data Center

CVSS 4.0 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-81240Published

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Re…

cve-program ·

Vendor product: Wyse Management Suite

CVSS 3.1 8.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-73465Published

On affected platforms running Arista EOS, under certain circumstances plaintext private keys

cve-program ·

Vendor product: EOS

CVSS 3.1 6.3 · CVSS 4.0 6.0Source modified 17 Sep 2026Recorded 23 Oct 2026

GHSA-2x7j-588g-ccc2Published

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

osv · CVE-2026-92596

npm: nodemailer

HIGHSource modified 17 Sep 2026Recorded 24 Oct 2026

GHSA-cc9r-2j5m-2m83Published

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

osv · CVE-2026-92597

npm: nodemailer

MODERATESource modified 17 Sep 2026Recorded 24 Oct 2026

GHSA-8m3c-c648-2xjjPublished

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

osv · CVE-2026-92595

npm: nodemailer

MODERATESource modified 17 Sep 2026Recorded 24 Oct 2026

GHSA-wmmp-3585-3rmpPublished

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

osv · CVE-2026-92598

npm: nodemailer

MODERATESource modified 17 Sep 2026Recorded 24 Oct 2026

CVE-2026-91726Published

Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

cve-program ·

Vendor product: Chrome

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-73447Published

Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

cve-program ·

Vendor product: EOS

CVSS 3.1 9.1 · CVSS 4.0 9.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86358Published

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execut…

cve-program ·

Vendor product: Update Package Framework

CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91843Published

Stack overflow in login process to the Security Management and Log Servers

cve-program ·

Vendor product: Quantum Security Management

CVSS 3.1 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-71180Published

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

cve-program ·

Vendor product: Update Package Framework

CVSS 3.1 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-86359Published

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

cve-program ·

Vendor product: Repository Manager

CVSS 3.1 8.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-20307Published

Cisco Identity Services Engine Remote Code Execution Vulnerability

cve-program ·

Vendor product: Cisco Identity Services Engine Software

CVSS 3.1 9.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-76420Published

Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability

cve-program ·

Vendor product: Cisco Secure Firewall Management Center (FMC)

CVSS 3.1 9.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-20234Published

Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities

cve-program ·

Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector

CVSS 3.1 9.9Source modified 17 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.