Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699698 source statements · aliases may refer to the same vulnerability

CVE-2026-76692Published

Unauthenticated Adjacent Information Disclosure and Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-75501Rejected

Vendor could not replicate the vul, and reporter is unavailable to comment.

cve-program ·

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53954Published

Bugsink: DOS using large numbers of event tags

cve-program ·

Vendor product: bugsink

CVSS 3.1 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55374Published

canto-saas-api: Authenticated API requests can be redirected via unencoded path variables

cve-program ·

Vendor product: canto-saas-api

CVSS 3.1 4.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76693Published

Unauthenticated Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-56830Published

Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

cve-program ·

Vendor product: shopper

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81238Published

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauth…

cve-program ·

Vendor product: Wyse Management Suite

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57441Published

MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

cve-program ·

Vendor product: mcpvault

CVSS 4.0 8.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76694Published

Authenticated Privilege Escalation Vulnerability in the Command Line Interface of HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 6.6Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18422Published

Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18423Published

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76695Published

Unauthenticated Buffer Overflow Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76696Published

Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76697Published

Authenticated Information Disclosure in HPE Networking EdgeConnect Enterprise Web-Based Management Interface

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81920Published

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18421Published

Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-68529Published

Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-68530Published

Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-69202Published

Http4s Ember HTTP/2: unbounded inbound body buffering

cve-program ·

Vendor product: http4s

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-68531Published

Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-73458Published

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou

cve-program ·

Vendor product: EOS

CVSS 3.1 8.2 · CVSS 4.0 9.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88616Published

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workf…

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-69203Published

Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

cve-program ·

Vendor product: http4s

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-66974Published

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet duri…

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-79410Published

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11934Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11929Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-82190Published

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

cve-program ·

Vendor product: J2Store extension for Joomla

CVSS 4.0 6.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-69205Published

Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

cve-program ·

Vendor product: http4s

CVSS 3.1 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-50006Published

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

cve-program ·

Vendor product: anyquery

CVSS 3.1 9.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81923Published

Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90816Published

FFmpeg Duration hlsproto.c parse_playlist denial of service

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81924Published

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-69212Published

Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect

cve-program ·

Vendor product: http4s

CVSS 3.1 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54559Published

PocketSphinx: Buffer overflows in language and acoustic model loading code

cve-program ·

Vendor product: pocketsphinx

CVSS 4.0 6.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53717Published

Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

cve-program ·

Vendor product: gateway

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81922Published

"In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81568Published

Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

cve-program ·

Vendor product: J2Store extension for Joomla

CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-82191Published

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

cve-program ·

Vendor product: J2Store extension for Joomla

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-13260Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53714Published

Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode

cve-program ·

Vendor product: gateway

CVSS 3.1 7.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81921Published

In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-68533Published

Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-68534Published

Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81919Published

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 2.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19641Published

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

cve-program ·

Vendor product: EOS

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-73451Published

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can

cve-program ·

Vendor product: EOS

CVSS 3.1 4.8 · CVSS 4.0 6.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19781Published

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

cve-program ·

Vendor product: Cobalt

CVSS 3.0 7.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76081Published

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

cve-program ·

Vendor product: zitadel

CVSS 3.1 5.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-69201Published

Http4s: ResourceService and Webjar Service path escape via percent-encoded separators

cve-program ·

Vendor product: http4s

CVSS 3.1 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.