Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699348 source statements · aliases may refer to the same vulnerability

CVE-2026-83045Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83046Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-4129Published

Improper Access Controls in NI SystemLink

cve-program ·

Vendor product: SystemLink · Vendor product: SystemLink Server

CVSS 3.1 8.1 · CVSS 4.0 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90826Published

GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds

cve-program ·

Vendor product: GPAC

CVSS 4.0 2.4 · CVSS 3.1 2.8 · CVSS 3.0 2.8 · CVSS 2.0 1.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-53716Published

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

cve-program ·

Vendor product: gateway

CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90818Published

netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery

cve-program ·

Vendor product: LobsterAI

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54247Published

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

cve-program ·

Vendor product: skipper

CVSS 3.1 4.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55244Published

ASTEVAL: Sandbox Escape via BaseException Subclasses

cve-program ·

Vendor product: asteval

CVSS 3.1 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88976Published

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an applic…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-54628Published

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

cve-program ·

Vendor product: anyquery

CVSS 3.1 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55301Published

In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73496Published

MCP Atlassian: Arbitrary server-side file read via attachment upload

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90812Published

cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment

cve-program ·

Vendor product: mercury-agent

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0128Published

In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploita…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0129Published

In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-52827Published

Kimai: Two-factor authentication bypass on the Kimai API

cve-program ·

Vendor product: kimai

CVSS 4.0 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0130Published

In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitatio…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0134Published

In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User inte…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0136Published

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0140Published

In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0141Published

In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploit…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0142Published

In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-59973Published

mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi

cve-program ·

Vendor product: frontmcp · Vendor product: mcp-from-openapi · Vendor product: adapters

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54177Published

backpack/crud: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserver

cve-program ·

Vendor product: CRUD

CVSS 3.1 6.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0144Published

In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for e…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0145Published

In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0155Published

In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitati…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0156Published

In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed fo…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0157Published

In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0158Published

In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitat…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0165Published

In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is need…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55306Published

In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-48737Published

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

cve-program ·

Vendor product: pyload

CVSS 3.1 4.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-56888Published

In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-56892Published

In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for …

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54178Published

backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

cve-program ·

Vendor product: CRUD

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54254Published

Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites

cve-program ·

Vendor product: cyberdrop-dl

CVSS 4.0 5.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-56958Published

In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not need…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-56975Published

In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for ex…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-44163Published

fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

cve-program ·

Vendor product: fluent-plugin-opentelemetry

CVSS 3.1 5.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-40855Published

Command Injection in T-Mobile 5G Box IDU router via ping functionality

cve-program ·

Vendor product: T-Mobile 5G Box IDU

CVSS 4.0 9.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-40856Published

Config disclosure in T-Mobile 5G Box IDU routers

cve-program ·

Vendor product: T-Mobile 5G Box IDU

CVSS 4.0 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-57008Published

In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-40857Published

CSRF token bypass in T-Mobile 5G Box IDU routers

cve-program ·

Vendor product: T-Mobile 5G Box IDU

CVSS 4.0 8.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-58731Published

In multiple functions of physmem_extmem_linux.c, there is a possible out-of-bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not neede…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90807Published

nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following

cve-program ·

Vendor product: NanoClaw

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-58146Published

Unauthorized remote code execution in T-Mobile 5G Box IDU routers

cve-program ·

Vendor product: T-Mobile 5G Box IDU

CVSS 4.0 9.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-58147Published

Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers

cve-program ·

Vendor product: T-Mobile 5G Box IDU

CVSS 4.0 9.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-57581Published

DotVVM: Unrestricted file upload

cve-program ·

Vendor product: dotvvm

CVSS 3.1 5.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-53752Published

docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service

cve-program ·

Vendor product: docx4j · Vendor product: docx4j-core

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.