Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699709 source statements · aliases may refer to the same vulnerability

CVE-2026-16140Published

OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1

cve-program ·

Vendor product: phosphor-net-ipmid

CVSS 3.1 8.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90791Published

GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-16141Published

OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value

cve-program ·

Vendor product: phosphor-net-ipmid

CVSS 3.1 8.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-48987Published

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

cve-program ·

Vendor product: pyload

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-92082Published

Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts

cve-program ·

Vendor product: org.glassfish.admingui.common.security

CVSS 4.0 6.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88056Published

Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

cve-program ·

Vendor product: angular

CVSS 4.0 8.6Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-89045Published

zstd-jni 1.4.8-4 through 1.5.7-13 Denial of Service via Negative Length

cve-program ·

https://repo1.maven.org/maven2/com/github/luben/zstd-jni/: zstd-jni

CVSS 4.0 5.1 · CVSS 3.1 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90810Published

cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization

cve-program ·

Vendor product: mercury-agent

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88051Published

Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields

cve-program ·

Vendor product: tesseract

CVSS 4.0 8.6Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90796Published

itsourcecode Leave Management System index.php sql injection

cve-program ·

Vendor product: Leave Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91004Published

SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection

cve-program ·

Vendor product: Online Faculty Clearance System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-49446Published

Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

cve-program ·

Vendor product: Cosmos-Server

CVSS 3.1 6.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90829Published

GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54167Published

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

cve-program ·

Vendor product: pipelines-as-code

CVSS 3.1 8.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91835Published

OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict

cve-program ·

Vendor product: ClawScan

CVSS 4.0 2.4 · CVSS 3.1 2.8 · CVSS 3.0 2.8 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90711Published

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

cve-program ·

Vendor product: proxy-addr

CVSS 3.1 9.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-46495Published

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

cve-program ·

Vendor product: OpenDJ · Vendor product: opendj-server-legacy

CVSS 4.0 9.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88046Published

rclone: source object names can escape the configured root on upload

cve-program ·

Vendor product: rclone

CVSS 3.1 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90650Published

MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'

cve-program ·

Vendor product: MotoPress Hotel Booking

CVSS 3.1 7.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91088Published

GPAC URL url.c gf_url_concatenate_ex heap-based overflow

cve-program ·

Vendor product: GPAC

CVSS 4.0 2.4 · CVSS 3.1 4.8 · CVSS 3.0 4.8 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-12756Published

Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

cve-program ·

Vendor product: Business Automation Workflow containers and traditional

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81903Published

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18063Published

Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter

cve-program ·

Vendor product: Job Postings

CVSS 3.1 6.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57134Published

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth pol…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-57135Published

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-ts/src/cli/features/sandbox-executor.ts uses buildEnv() only to inject invalid http_proxy and https_proxy environment va…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.6Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-57136Published

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecuto…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-57137Published

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generateText() before invoking the onToolCall approval callback. Because the wrapped AI S…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-57140Published

PraisonAI is a multi-agent teams system. From 1.6.0 until 1.7.2, AgentOS in src/praisonai-ts/src/os/agentos.ts uses the 0.0.0.0 default from src/praisonai-ts/src/os/config.ts and registers GET /api/agents and POST /api/chat without authenti…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.4Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-57141Published

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function() and with(sandbox), while a regular-expression blocklist c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-16186Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 5.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90824Published

GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88016Published

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

cve-program ·

Vendor product: rclone

CVSS 3.1 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54632Published

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

cve-program ·

Vendor product: sipsorcery

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88011Published

Traefik: ForwardAuth identity spoofing via dot-form header alias

cve-program ·

Vendor product: traefik

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90815Published

FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91778Published

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the Octopus Server built-in worker). Incorrect permission validation during script execution would allo…

cve-program ·

Vendor product: Octopus Server

CVSS 4.0 7.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88939Published

knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption

cve-program ·

Vendor product: knowns

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90846Published

PHPGurukul Daily Expense Tracker System forgot-password.php sql injection

cve-program ·

Vendor product: Daily Expense Tracker System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-84933Published

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that ca…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 6.5 · CVSS 3.1 · [email protected] · Primary 8.2Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-90841Published

PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

cve-program ·

Vendor product: Blood Donor Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54246Published

Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication

cve-program ·

Vendor product: skipper

CVSS 3.1 5.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88897Published

Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

cve-program ·

Vendor product: flextype

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91819Published

MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

cve-program ·

Vendor product: MISP

CVSS 4.0 6.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-13276Published

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88005Published

Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchange

cve-program ·

Vendor product: open-webui

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53715Published

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

cve-program ·

Vendor product: gateway

CVSS 3.1 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-43761Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Mounting a malicious disk image may cause unexpected system termination.

cve-program ·

Vendor product: macOS

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-84947Published

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length an…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 3.7 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-84961Published

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supp…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 7.4 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-88896Published

EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

cve-program ·

Vendor product: espocrm

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.