Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699698 source statements · aliases may refer to the same vulnerability

CVE-2026-90606Published

Totolink A3002MU boa formIpv6Setup buffer overflow

cve-program ·

Vendor product: A3002MU

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18065Published

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

cve-program ·

Vendor product: i

CVSS 3.1 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-16435Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-16189Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 4.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-16190Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 3.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-15955Published

IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

cve-program ·

Vendor product: Db2

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-40058Published

Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows

cve-program ·

Vendor product: Falcon sensor for Windows · Vendor product: Falcon sensor for Windows · Vendor product: Laroux Cleanup Tool

CVSS 3.1 8.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19816Published

PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

cve-program ·

https://github.com/PackageKit/PackageKit: PackageKit · https://bodhi.fedoraproject.org/updates/?packages=PackageKit: PackageKit · https://access.redhat.com/downloads/content/package-browser/: PackageKit

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12765Published

Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19280Published

IBM i is Affected By Multiple Vulnerabilities in PASE [, ]

cve-program ·

Vendor product: i

CVSS 3.1 5.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-13275Published

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

cve-program ·

Vendor product: MQ

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90578Published

GPAC MP4Box list.c gf_list_count use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-49254Published

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

cve-program ·

Vendor product: dragonfly

CVSS 4.0 2.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57586Published

CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

cve-program ·

Vendor product: agent-coderag

CVSS 3.1 8.6Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53966Published

XWiki Platform: Privilege escalation from edit to script right through Live Data editing

cve-program ·

Vendor product: xwiki-platform

CVSS 4.0 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55617Published

Hydro: Insufficient session expiration when recreating sessions

cve-program ·

Vendor product: Hydro

CVSS 4.0 6.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-47215Published

Singularity: Incorrect path matching for 'limit container paths' directive

cve-program ·

Vendor product: singularity · Vendor product: SingularityPRO

CVSS 3.1 4.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55828Published

qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

cve-program ·

Vendor product: transport

CVSS 4.0 6.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55636Published

Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected

cve-program ·

Vendor product: capsule

CVSS 3.1 5.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55775Published

OpenBao's System Backend allows Unauthorized Management of the containing Namespace

cve-program ·

Vendor product: openbao

CVSS 4.0 2.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90601Published

getzep graphiti REST API main.py improper authentication

cve-program ·

Vendor product: graphiti

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-55887Published

MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

cve-program ·

Vendor product: mcp-gateway

CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90611Published

GPAC MP4Box loader_xmt.c xmt_parse_element assertion

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90583Published

kagisearch smallweb Query String Rendering sw.py index cross site scripting

cve-program ·

Vendor product: smallweb

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90858Published

subhajitkhan online-clinic-management-system adminappview.php session_start authorization

cve-program ·

Vendor product: online-clinic-management-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90880Published

D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection

cve-program ·

Vendor product: DSL-3782

CVSS 4.0 5.3 · CVSS 3.1 7.4 · CVSS 3.0 7.4 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81303Published

Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: rhbac-4/hawtio-operator-bundle · https://access.redhat.com/downloads/content/package-browser/: rhbac-4/hawtio-rhel9

CVSS 3.1 6.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-17495Published

moment vulnerable to Path Traversal via crafted non-string locale name

cve-program ·

Vendor product: moment

CVSS 3.1 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90596Published

embedded-graphics image_raw.rs new/bytes_per_row integer overflow

cve-program ·

Vendor product: embedded-graphics

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90714Published

marcobambini Gravity JSON parser gravity_json.c memory corruption

cve-program ·

Vendor product: Gravity

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91855Published

Open5GS PFCP Message handler.c denial of service

cve-program ·

Vendor product: Open5GS

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-86701Published

Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, pote…

cve-program ·

Vendor product: ManabiPocket for Parents

CVSS 3.0 2.5 · CVSS 4.0 1.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-48785Published

Apptainer: Incorrect path matching for 'limit container paths' directive

cve-program ·

Vendor product: apptainer

CVSS 3.1 4.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-11926Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54251Published

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

cve-program ·

Vendor product: netty-incubator-codec-ohttp · Vendor product: netty-incubator-codec-ohttp

CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91089Published

GPAC base_scenegraph.c gf_node_get_name_and_id use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12742Published

Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

cve-program ·

Vendor product: Business Automation Workflow containers and traditional

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-63443Published

Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write

cve-program ·

Vendor product: coder

CVSS 3.1 8.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-15887Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-13107Published

Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

cve-program ·

Vendor product: Business Automation Workflow containers and traditional

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12767Published

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12766Published

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12763Published

Langflow is vulnerable to authentication bypass and insufficient session expiration

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 4.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-7884Published

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

cve-program ·

Vendor product: Cognos Analytics

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-78415Published

IBM Sterling Secure Proxy is vulnerable to multiple issues

cve-program ·

Vendor product: Sterling Secure Proxy

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-75792Published

IBM Sterling Secure Proxy is vulnerable to multiple issues

cve-program ·

Vendor product: Sterling Secure Proxy

CVSS 3.1 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19086Published

IBM i is Affected By Multiple Vulnerabilities in PASE [, ]

cve-program ·

Vendor product: i

CVSS 3.1 3.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19273Published

The Dashboard of IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Improper Access Control

cve-program ·

Vendor product: Sterling B2B Integrator · Vendor product: Sterling File Gateway

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18069Published

IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine []

cve-program ·

Vendor product: i

CVSS 3.1 6.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-13287Published

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

cve-program ·

Vendor product: MQ

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.