Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699691 source statements · aliases may refer to the same vulnerability

CVE-2026-76151Published

Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response header parsing impacts Qt Framework (QtNetwork module)

cve-program ·

Vendor product: qt

CVSS 4.0 4.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-39830Published

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connectio…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-39829Published

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This cou…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-27137Published

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-92359Published

ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy

cve-program ·

Vendor product: ag-ui

CVSS 4.0 2.3 · CVSS 3.1 3.1 · CVSS 3.0 3.1 · CVSS 2.0 2.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88817Published

Privilege escalation via legacy access group creation endpoint

cve-program ·

Vendor product: Curiosity Workspace

CVSS 4.0 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-28938Published

A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.

cve-program ·

Vendor product: iOS and iPadOS

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-43762Published

The issue was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6. An app may be able to access user-sensitive data.

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27896Published

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

cve-program ·

Vendor product: go-sdk

CVSS 4.0 7.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55225Published

Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

cve-program ·

Vendor product: strimzi-kafka-operator

CVSS 3.1 8.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-26007Published

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

cve-program ·

Vendor product: cryptography

CVSS 4.0 8.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0846Published

Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

cve-program ·

Vendor product: nltk/nltk

CVSS 3.0 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0847Published

Path Traversal in nltk/nltk

cve-program ·

Vendor product: nltk/nltk

CVSS 3.0 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-25990Published

Pillow has an out-of-bounds write when loading PSD images

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-25223Published

Fastify's Content-Type header tab character allows body validation bypass

cve-program ·

Vendor product: fastify

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-48746Published

vLLM: OpenAI auth bypass

cve-program ·

Vendor product: vllm

CVSS 3.1 9.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-24486Published

Python-Multipart has Arbitrary File Write via Non-Default Configuration

cve-program ·

Vendor product: python-multipart

CVSS 3.1 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-8643Published

pip can extract console_scripts and gui_scripts outside installation directory

cve-program ·

https://pypi.org/project/pip: pip

CVSS 4.0 4.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2025-15514Published

Ollama Multi-Modal Model Image Processing NULL Pointer Dereference

cve-program ·

Vendor product: Ollama

CVSS 4.0 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2025-67030Published

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

cve-program ·

Vendor product: n/a

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-24049Published

wheel Allows Arbitrary File Permission Modification via Path Traversal

cve-program ·

Vendor product: wheel

CVSS 3.1 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-59341Published

Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints

cve-program ·

Vendor product: sealed-secrets

CVSS 3.1 4.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-76707Published

Unauthenticated Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 4.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54196Published

WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability

cve-program ·

Vendor product: JetFormBuilder

CVSS 3.1 6.8Source modified 16 Sep 2026Recorded 23 Oct 2026

GO-2026-4970Published

Root escape via symlink plus trailing slash in os

osv · BIT-golang-2026-39822 · CVE-2026-39822

Go: stdlib

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16175Published

Malicious code in csa-mfa (npm)

osv ·

npm: csa-mfa

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16218Published

Malicious code in tol8t (npm)

osv ·

npm: tol8t

Source modified 16 Sep 2026Recorded 24 Oct 2026

CVE-2026-91714Published

Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-91725Published

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-91739Published

Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-91713Published

Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-91730Published

Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. (Chromium se…

cve-program ·

Vendor product: Chrome

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-85979Published

Command Injection in Puppet Enterprise

cve-program ·

Vendor product: Puppet Enterprise

CVSS 4.0 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

MAL-2026-16217Published

Malicious code in tetotest (npm)

osv ·

npm: tetotest

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16216Published

Malicious code in tetomood (npm)

osv ·

npm: tetomood

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16208Published

Malicious code in otel-span-adapter (npm)

osv ·

npm: otel-span-adapter

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16176Published

Malicious code in fulfillment-cuprum-auth-widget (npm)

osv ·

npm: fulfillment-cuprum-auth-widget

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16215Published

Malicious code in engin1 (npm)

osv ·

npm: engin1

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16205Published

Malicious code in @prime0/inimatch (npm)

osv ·

npm: @prime0/inimatch

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16210Published

Malicious code in strapi-plugin-pencc-meeb (npm)

osv ·

npm: strapi-plugin-pencc-meeb

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16206Published

Malicious code in @prime0/pcomatch (npm)

osv ·

npm: @prime0/pcomatch

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16207Published

Malicious code in chai-as-agile (npm)

osv ·

npm: chai-as-agile

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16211Published

Malicious code in swnwall (npm)

osv ·

npm: swnwall

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16209Published

Malicious code in strapi-plugin-ccsuc-meeb (npm)

osv ·

npm: strapi-plugin-ccsuc-meeb

Source modified 16 Sep 2026Recorded 24 Oct 2026

MAL-2026-16204Published

Malicious code in @prime0/alanced-match (npm)

osv ·

npm: @prime0/alanced-match

Source modified 16 Sep 2026Recorded 24 Oct 2026

CVE-2026-78081Published

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

cve-program ·

Vendor product: J2Store extension for Joomla

CVSS 4.0 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-81567Published

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

cve-program ·

Vendor product: J2Store extension for Joomla

CVSS 4.0 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82189Published

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

cve-program ·

Vendor product: J2Store extension for Joomla

CVSS 4.0 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-71269Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-61396Rejected

Did not need CVE ID

cve-program ·

Source modified 16 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.