Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699709 source statements · aliases may refer to the same vulnerability

CVE-2026-16593Published

WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings

cve-program ·

Vendor product: WP Directory Kit

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90819Published

a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting

cve-program ·

Vendor product: a2a-java

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-16592Published

WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes

cve-program ·

Vendor product: WP Directory Kit

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18232Published

WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow

cve-program ·

Vendor product: WP Directory Kit

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81902Published

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81901Published

Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-46619Published

OpenAM Authentication Bypass via MSISDN LDAP Injection

cve-program ·

Vendor product: OpenAM

CVSS 4.0 9.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-44202Published

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

cve-program ·

Vendor product: OpenAM

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88876Published

AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD

cve-program ·

Vendor product: AVideo

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-62379Published

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

cve-program ·

Vendor product: OpenAM

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88871Published

WWBN AVideo CustomizeUser setSubscribers CSRF via GET

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85008Published

undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is neve…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 3.7 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-91825Published

MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

cve-program ·

Vendor product: MISP

CVSS 4.0 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-88866Published

WWBN AVideo LoginControl Stored XSS via User-Agent Header

cve-program ·

Vendor product: AVideo

CVSS 4.0 9.3 · CVSS 3.1 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91091Published

GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91086Published

GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-79591Published

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation of a file-controlled font index.

cve-program ·

Vendor product: n/a

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-75983Published

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter

cve-program ·

Vendor product: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85014Published

undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake. On an unclean close the internal socket-close handler calls abort on the writab…

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-91003Published

D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow

cve-program ·

Vendor product: DI-8300

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-16482Published

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter

cve-program ·

Vendor product: rtMedia for WordPress, BuddyPress and bbPress

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-78175Published

Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

cve-program ·

Vendor product: Tutor LMS – eLearning and online course solution

CVSS 3.1 8.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90488Published

Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection

cve-program ·

Vendor product: xxl-job

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90493Published

Tonec Internet Download Manager Kernel Driver idmwfp.sys access control

cve-program ·

Vendor product: Internet Download Manager

CVSS 4.0 9.3 · CVSS 3.1 8.8 · CVSS 3.0 8.8 · CVSS 2.0 6.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90498Published

lenve vhr vhr.sql default credentials

cve-program ·

Vendor product: vhr

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90503Published

Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure

cve-program ·

Vendor product: Ludashi

CVSS 4.0 4.6 · CVSS 3.1 2.3 · CVSS 3.0 2.3 · CVSS 2.0 1.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90508Published

Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization

cve-program ·

Vendor product: Ludashi

CVSS 4.0 4.6 · CVSS 3.1 3.4 · CVSS 3.0 3.4 · CVSS 2.0 2.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90514Published

SourceCodester School Registration and Fee System save_stud.php sql injection

cve-program ·

Vendor product: School Registration and Fee System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90879Published

zyx0814 FilePress Publish search.php sql injection

cve-program ·

Vendor product: FilePress

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90519Published

PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload

cve-program ·

Vendor product: Bank Locker Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90524Published

jaychouchannel Tourism-Management-System Update Endpoint missing authentication

cve-program ·

Vendor product: Tourism-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90529Published

DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting

cve-program ·

Vendor product: DataEase

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90567Published

quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting

cve-program ·

Vendor product: shiyi-blog

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90572Published

davenardella snap7 s7_micro_client.cpp opUpload memory corruption

cve-program ·

Vendor product: snap7

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90577Published

GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91001Published

D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow

cve-program ·

Vendor product: DI-8400

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90582Published

evanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consumption

cve-program ·

Vendor product: serverless-todo

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90595Published

wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization

cve-program ·

Vendor product: Spring-Cloud-Platform

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90600Published

itsourcecode Sales and Inventory System inv_edit1.php sql injection

cve-program ·

Vendor product: Sales and Inventory System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90605Published

Totolink A3002MU boa formFilter buffer overflow

cve-program ·

Vendor product: A3002MU

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90610Published

GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90615Published

SourceCodester Class and Exam Timetabling System subject1.php cross site scripting

cve-program ·

Vendor product: Class and Exam Timetabling System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90877Published

SourceCodester Online Faculty Clearance System update_requirement_status.php sql injection

cve-program ·

Vendor product: Online Faculty Clearance System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90621Published

ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection

cve-program ·

Vendor product: HackingBuddyGPT

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90682Published

Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow

cve-program ·

Vendor product: jhead

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91780Published

GNU Binutils elflink.c elf_link_add_object_symbols null pointer dereference

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90687Published

GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90692Published

D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow

cve-program ·

Vendor product: DIR-878

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90697Published

SourceCodester Inventory Management System invoice.php authorization

cve-program ·

Vendor product: Inventory Management System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90702Published

D-Link DWR-M921 formDiskFormat system os command injection

cve-program ·

Vendor product: DWR-M921

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 15 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.