Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699691 source statements · aliases may refer to the same vulnerability

CVE-2026-58065Published

Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification

cve-program ·

https://pypi.python.org: apache-airflow-providers-git

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90788Published

magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

cve-program ·

Vendor product: MacCMS10

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-77412Published

RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

cve-program ·

Vendor product: amqp091-go

CVSS 4.0 8.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92383Published

PbootCMS User Management UserController.php mod cross-site request forgery

cve-program ·

Vendor product: PbootCMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-25550Published

Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service

cve-program ·

Vendor product: BarTender 2010 · Vendor product: BarTender 2016 · Vendor product: BarTender 2019

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-19248Published

Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt

cve-program ·

Vendor product: qt

CVSS 4.0 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55226Published

Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator

cve-program ·

Vendor product: strimzi-kafka-operator

CVSS 3.1 5.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88263Published

XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to e…

cve-program ·

Vendor product: SKS8310-8X · Vendor product: SKS8300-8T · Vendor product: SKS8300-12E2T2X

CVSS 3.0 7.5 · CVSS 4.0 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-77408Published

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

cve-program ·

Vendor product: amqp091-go

CVSS 4.0 9.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90937Published

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

cve-program ·

Vendor product: froxlor

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-77407Published

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

cve-program ·

Vendor product: amqp091-go

CVSS 4.0 7.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90927Published

filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message

cve-program ·

Vendor product: filebrowser

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92355Published

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code exec…

cve-program ·

Vendor product: Octopus Server

CVSS 4.0 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-81326Published

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password.

cve-program ·

Vendor product: QND Premium · Vendor product: QND Standard · Vendor product: QND Advance

CVSS 3.0 5.5 · CVSS 4.0 6.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-75156Published

Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass

cve-program ·

https://pypi.python.org: apache-airflow-providers-fab

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55863Published

motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution

cve-program ·

Vendor product: motioneye

CVSS 3.1 5.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-68872Published

Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

cve-program ·

https://pypi.python.org: apache-airflow-providers-amazon

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-68871Published

Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

cve-program ·

https://pypi.python.org: apache-airflow-providers-yandex

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-68870Published

Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

cve-program ·

https://pypi.python.org: apache-airflow-providers-microsoft-azure

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-68868Published

Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables

cve-program ·

https://pypi.python.org: apache-airflow-providers-google

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-84408Published

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges.

cve-program ·

Vendor product: QND Premium · Vendor product: QND Standard · Vendor product: QND Advance

CVSS 3.0 8.8 · CVSS 4.0 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-59243Published

Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

cve-program ·

https://pypi.python.org: apache-airflow-providers-fab

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-59245Published

Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision)

cve-program ·

https://pypi.python.org: apache-airflow-providers-fab

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90716Published

marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds

cve-program ·

Vendor product: Gravity

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-49486Published

Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

cve-program ·

https://pypi.python.org: apache-airflow-providers-ftp

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90710Published

taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery

cve-program ·

Vendor product: tarzan-cms

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27547Published

Command Injection in /index.php/ajax/get_iodd_menu_info

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27552Published

Unauthorized IODD File Upload due to Improper Authorization

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27562Published

Command Injection via PUT in /api/iodd/config

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 7.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-86341Published

Access Control Check Implemented After Asset is Accessed in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90705Published

D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection

cve-program ·

Vendor product: DWR-M921

CVSS 4.0 5.1 · CVSS 3.1 6.6 · CVSS 3.0 6.6 · CVSS 2.0 5.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90700Published

itsourcecode Sales and Inventory System pro_edit1.php sql injection

cve-program ·

Vendor product: Sales and Inventory System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-89186Published

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

cve-program ·

https://repo.hex.pm: mpp · https://github.com: zenhive/mpp

CVSS 4.0 6.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88255Published

mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

cve-program ·

https://repo.hex.pm: mpp · https://github.com: zenhive/mpp

CVSS 4.0 6.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90695Published

SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting

cve-program ·

Vendor product: Inventory Management System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-86338Published

Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

cve-program ·

https://repo.hex.pm: ash · https://github.com: ash-project/ash

CVSS 4.0 6.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-84997Published

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

cve-program ·

Vendor product: http

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90690Published

0x4m4 HexStrike AI API Tools Endpoint hexstrike_server.py subprocess.Popen os command injection

cve-program ·

Vendor product: HexStrike AI

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-77860Published

'serve-expired' can bypass Unbound 'wait-limit'

cve-program ·

Vendor product: Unbound

CVSS 3.1 3.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-74259Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54549Published

Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

cve-program ·

Vendor product: meta-ads-mcp

CVSS 3.1 8.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90685Published

GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion

cve-program ·

Vendor product: GPAC

CVSS 4.0 2.4 · CVSS 3.1 2.8 · CVSS 3.0 2.8 · CVSS 2.0 1.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90680Published

D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow

cve-program ·

Vendor product: DIR-823G

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88975Published

Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZE

cve-program ·

Vendor product: http4s

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90619Published

0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection

cve-program ·

Vendor product: HexStrike AI

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-56831Published

Shopper: Negative discount values accepted and propagated through order calculation pipeline

cve-program ·

Vendor product: shopper

CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-56825Published

Shopper: Missing authorization on product removal actions in CollectionProducts component

cve-program ·

Vendor product: shopper

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90613Published

GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-89774Published

Bluetooth: SCO: hold sk properly in sco_conn_ready

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90608Published

Totolink A3002MU boa formPortFw buffer overflow

cve-program ·

Vendor product: A3002MU

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 16 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.