Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699691 source statements · aliases may refer to the same vulnerability

CVE-2026-92007Published

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92006Published

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-23789Published

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encod…

cve-program ·

Vendor product: Exynos 850 firmware

CVSS 3.1 7.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2025-64031Published

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. This relates to bsdtar. Ex…

cve-program ·

Vendor product: libarchive

CVSS 3.1 2.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90603Published

Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

cve-program ·

Vendor product: Open-Generative-AI

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90598Published

jaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorization

cve-program ·

Vendor product: E-commerce-project-springBoot

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82717Published

CNAME synthesis could lead to heap corruption

cve-program ·

Vendor product: Unbound

CVSS 4.0 8.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90593Published

embedded-graphics image_raw.rs draw_sub_image integer overflow

cve-program ·

Vendor product: embedded-graphics

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90580Published

FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery

cve-program ·

Vendor product: Flowise

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82720Published

Use-after-free in DoH stream cleanup code path

cve-program ·

Vendor product: Unbound

CVSS 3.1 5.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90575Published

PHPGurukul Small CRM Login Success login.php unserialize deserialization

cve-program ·

Vendor product: Small CRM

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90570Published

linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting

cve-program ·

Vendor product: litemall

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-85501Published

Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC

cve-program ·

Vendor product: Unbound

CVSS 3.1 5.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90565Published

Rizwan17 inventory-management-system dashboard.php access control

cve-program ·

Vendor product: inventory-management-system

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90527Published

quequnlong shiyi-blog Add Message API index.vue cross site scripting

cve-program ·

Vendor product: shiyi-blog

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90522Published

jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery

cve-program ·

Vendor product: Tourism-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90781Published

alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()

cve-program ·

Vendor product: alsa-lib

CVSS 4.0 4.8 · CVSS 3.1 4.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-2380Published

Security Advisory 0168

cve-program ·

Vendor product: EOS

CVSS 3.1 7.4 · CVSS 4.0 5.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90517Published

PHPGurukul Bank Locker Management System view-assign-locker.php authorization

cve-program ·

Vendor product: Bank Locker Management System

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-57442Published

MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested

cve-program ·

Vendor product: mcpvault

CVSS 4.0 6.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92081Published

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

cve-program ·

Vendor product: fastify

CVSS 3.1 5.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90511Published

GongShengyue OnlineBooks listSplit BooksServlet.java sql injection

cve-program ·

Vendor product: OnlineBooks

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

GHSA-v8pv-4842-x354Published

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

osv · CVE-2026-81192

NuGet: OpenTelemetry.Resources.Host

HIGHSource modified 16 Sep 2026Recorded 23 Oct 2026

GHSA-cv3r-c5h8-f4g5Published

@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

osv · CVE-2026-61560

npm: @zereight/mcp-gitlab

CRITICALSource modified 16 Sep 2026Recorded 24 Oct 2026

CVE-2026-90506Published

vvbbnn00 WARP-Clash-API Save Account Job race condition

cve-program ·

Vendor product: WARP-Clash-API

CVSS 4.0 2.3 · CVSS 3.1 5.0 · CVSS 3.0 5.0 · CVSS 2.0 4.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-61560Published

@zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

cve-program ·

Vendor product: gitlab-mcp

CVSS 3.1 9.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73463Published

Security Advisory 0169

cve-program ·

Vendor product: EOS

CVSS 3.1 5.3 · CVSS 4.0 6.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88065Published

`tts-be` application has a Broken Access Control vulnerability

cve-program ·

Vendor product: tts-be

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90501Published

lenve vhr HrMapper.xml HrInfoController.updateHr privileges management

cve-program ·

Vendor product: vhr

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-19640Published

Security Advisory 0170

cve-program ·

Vendor product: EOS

CVSS 3.1 4.2 · CVSS 4.0 2.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90496Published

Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection

cve-program ·

Vendor product: Feng Office

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-69211Published

Http4s: Set-Cookie rendering does not escape attribute delimiters

cve-program ·

Vendor product: http4s

CVSS 3.1 4.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-69216Published

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

cve-program ·

Vendor product: http4s

CVSS 3.1 5.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-86443Published

Cleartext Storage of Sensitive Information Vulnerability

cve-program ·

Vendor product: com.fermax.blue.app

CVSS 4.0 6.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-69217Published

Http4s: Ember Server accepts duplicate Content-Length headers

cve-program ·

Vendor product: http4s

CVSS 3.1 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73436Published

Security Advisory 0171

cve-program ·

Vendor product: EOS

CVSS 3.1 6.5 · CVSS 4.0 6.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54246Published

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-plane data without application-layer authentication through /routes, /routes/{zone}, /swarm/redis/shar…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.7Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-76081Published

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue spec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-65838Published

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a d…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-49838Published

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-49837Published

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-73469Published

Security Advisory 0176

cve-program ·

Vendor product: EOS

CVSS 3.1 5.8 · CVSS 4.0 6.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73468Published

Security Advisory 0175

cve-program ·

Vendor product: EOS

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92466Published

microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking

cve-program ·

Vendor product: microservices-platform

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92461Published

yshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint

cve-program ·

Vendor product: yshop-crm

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92456Published

yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints

cve-program ·

Vendor product: yshop-crm

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-14916Published

Kong API Gateway Enterprise: JWT Algorithm-Confusion

cve-program ·

Vendor product: Kong Enteprise Gateway

CVSS 4.0 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-77190Published

Security Advisory 0177

cve-program ·

Vendor product: EOS

CVSS 3.1 6.5 · CVSS 4.0 6.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-14917Published

Kong API Gateway Enterprise: SAML Authentication bypass

cve-program ·

Vendor product: Kong Enterprise Gateway

CVSS 4.0 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-86474Published

Improper Certificate Validation in the Firmware Download vulnerability

cve-program ·

Vendor product: DUOX PLUS monitor firmware (VEO Wi-Fi range)

CVSS 4.0 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.