Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699698 source statements · aliases may refer to the same vulnerability

CVE-2026-19504Published

Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

cve-program ·

Vendor product: Fabric.js

CVSS 3.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81899Published

Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18115Published

In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90896Published

Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

cve-program ·

Vendor product: Ecommerce Template

CVSS 4.0 8.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90825Published

GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18117Published

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-73449Published

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI

cve-program ·

Vendor product: EOS

CVSS 3.1 5.9 · CVSS 4.0 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90830Published

GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-mhc4-g3wh-cw7mPublished

Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

osv · CVE-2026-65959 · GO-2026-6356

Go: vitess.io/vitess · Go: vitess.io/vitess

MODERATESource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-79425Published

An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-6c5v-hqjr-5xxpPublished

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

osv · CVE-2026-79921 · GO-2026-6372

Go: github.com/rabbitmq/amqp091-go

HIGHSource modified 15 Sep 2026Recorded 24 Oct 2026

GHSA-vp52-pcj8-j9qcPublished

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

osv · CVE-2026-84304 · GO-2026-6348

Go: google.golang.org/grpc

HIGHSource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-90842Published

PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file

cve-program ·

Vendor product: Blood Donor Management System

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-qc2q-p7wx-3px3Published

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

osv · CVE-2026-84303 · GO-2026-6441

Go: google.golang.org/grpc

MODERATESource modified 15 Sep 2026Recorded 24 Oct 2026

GHSA-8q3c-rjr9-xxrpPublished

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

osv · CVE-2026-61625 · GO-2026-6366

Go: github.com/VictoriaMetrics/VictoriaMetrics · Go: github.com/VictoriaMetrics/VictoriaMetrics · Go: github.com/VictoriaMetrics/VictoriaMetrics

MODERATESource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-88619Published

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low…

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-79409Published

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85657Published

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

cve-program ·

Vendor product: Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88618Published

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-52484Published

An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11864Published

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

cve-program ·

Vendor product: Cloud Pak for Business Automation

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55375Published

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

cve-program ·

Vendor product: canto-saas-api

CVSS 3.1 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90847Published

EFM ipTIME C200E System Setup iux_set.cgi os command injection

cve-program ·

Vendor product: ipTIME C200E

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-56829Published

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

cve-program ·

Vendor product: shopper

CVSS 3.1 8.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55692Published

EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

cve-program ·

Vendor product: mediawiki-extensions-EmbedVideo

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54503Published

plone.app.textfield: Stored XSS by spoofing mime type

cve-program ·

Vendor product: plone.app.textfield

CVSS 3.1 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-58201Published

Lokka: Azure Resource Manager URL path validation issue

cve-program ·

Vendor product: lokka

CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54688Published

mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

cve-program ·

Vendor product: mcp-searxng

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12751Published

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

cve-program ·

Vendor product: Cloud Pak for Business Automation

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-69204Published

Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

cve-program ·

Vendor product: http4s

CVSS 4.0 9.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12667Published

IBM MQ .NET client is vulnerable to XML external entity injection

cve-program ·

Vendor product: MQ

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

GO-2026-6441Published

Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc

osv · CVE-2026-84303 · GHSA-qc2q-p7wx-3px3

Go: google.golang.org/grpc

Source modified 15 Sep 2026Recorded 24 Oct 2026

GO-2026-6372Published

Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload in github.com/rabbitmq/amqp091-go

osv · CVE-2026-79921 · GHSA-6c5v-hqjr-5xxp

Go: github.com/rabbitmq/amqp091-go

Source modified 15 Sep 2026Recorded 24 Oct 2026

GO-2026-6356Published

Missing authorization on vttablet /debug/vrlog in vitess.io/vitess

osv · CVE-2026-65959 · GHSA-mhc4-g3wh-cw7m

Go: vitess.io/vitess

Source modified 15 Sep 2026Recorded 24 Oct 2026

GO-2026-6348Published

Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc

osv · CVE-2026-84304 · GHSA-vp52-pcj8-j9qc

Go: google.golang.org/grpc

Source modified 15 Sep 2026Recorded 24 Oct 2026

GO-2026-6366Published

Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics

osv · CVE-2026-61625 · GHSA-8q3c-rjr9-xxrp

Go: github.com/VictoriaMetrics/VictoriaMetrics

Source modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-54050Published

Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image

cve-program ·

Vendor product: sakai

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-66790Rejected

This CVE ID was assigned in error as a duplicate of CVE-2026-70496, which describes the same vulnerability. Please use CVE-2026-70496 instead.

cve-program ·

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-66789Rejected

This CVE ID was assigned in error as a duplicate of CVE-2026-70495, which describes the same vulnerability. Please use CVE-2026-70495 instead.

cve-program ·

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-79418Published

EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to …

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-45579Published

DIRAC: RCE in RequestManager due to eval on untrusted input

cve-program ·

Vendor product: DIRAC

CVSS 3.1 9.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-61667Published

DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

cve-program ·

Vendor product: DIRAC

CVSS 3.1 9.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-56827Published

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

cve-program ·

Vendor product: shopper

CVSS 3.1 8.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-58485Published

mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

cve-program ·

Vendor product: mcp-searxng

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-58483Published

mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

cve-program ·

Vendor product: mcp-searxng

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85205Published

itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection

cve-program ·

Vendor product: Online Medicine Delivery System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-43808Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90852Published

luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free

cve-program ·

Vendor product: zstd-jni

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88262Published

Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.

cve-program ·

Vendor product: xClick

CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-64717Published

A race condition was addressed with improved state handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 15 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.