Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699709 source statements · aliases may refer to the same vulnerability

CVE-2026-90707Published

Open5GS Old AMF Discovery Fallback nnrf-handler.c amf_nnrf_try_old_amf_discovery_fallback use after free

cve-program ·

Vendor product: Open5GS

CVSS 4.0 6.9 · CVSS 3.1 8.3 · CVSS 3.0 8.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90713Published

vllm-project vLLM tiktoken vocab File mod.rs new denial of service

cve-program ·

Vendor product: vLLM

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90855Published

SourceCodester/katojkalemba Online Food Ordering System order.php sql injection

cve-program ·

Vendor product: Online Food Ordering System · Vendor product: Online Food Ordering System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90785Published

Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion

cve-program ·

Vendor product: flatcc

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90790Published

a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

cve-program ·

Vendor product: a2a-python

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90795Published

itsourcecode Loan Management System navbar.php cross site scripting

cve-program ·

Vendor product: Loan Management System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90804Published

GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow

cve-program ·

Vendor product: Binutils

CVSS 4.0 2.4 · CVSS 3.1 4.8 · CVSS 3.0 4.8 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90809Published

HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection

cve-program ·

Vendor product: nanobot

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90814Published

cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery

cve-program ·

Vendor product: mercury-agent

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90849Published

SourceCodester College Notes Gallery Management System login.php sql injection

cve-program ·

Vendor product: College Notes Gallery Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-73497Published

MCP Atlassian is a Model Context Protocol (MCP): DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826): unauthenticated SSRF to cloud metadata

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54629Published

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

cve-program ·

Vendor product: anyquery

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-65838Published

Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

cve-program ·

Vendor product: skipper

CVSS 3.1 8.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-54333Published

UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

cve-program ·

Vendor product: uefi-firmware-parser

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53718Published

Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass

cve-program ·

Vendor product: gateway

CVSS 3.1 6.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90820Published

a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90844Published

PHPGurukul Daily Expense Tracker System Login index.php sql injection

cve-program ·

Vendor product: Daily Expense Tracker System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90828Published

GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90840Published

PHPGurukul Blood Donor Management System Admin Controllers Dashboard.php __construct improper authentication

cve-program ·

Vendor product: Blood Donor Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90845Published

PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting

cve-program ·

Vendor product: Daily Expense Tracker System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90857Published

SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload

cve-program ·

Vendor product: College Notes Gallery Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-85575Published

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter

cve-program ·

Vendor product: ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets

CVSS 3.1 6.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90850Published

PHPGurukul Hostel Management System manage-students.php cross site scripting

cve-program ·

Vendor product: Hostel Management System

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90856Published

SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management

cve-program ·

Vendor product: College Notes Gallery Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90878Published

vllm-project vLLM Jinja Template Rendering completions resource consumption

cve-program ·

Vendor product: vLLM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91002Published

stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication

cve-program ·

Vendor product: maltrail

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-89141Published

AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter

cve-program ·

Vendor product: AI Engine – The Chatbot, AI Framework & MCP for WordPress

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91087Published

GPAC Compositor media_object.c gf_mo_get_od_id use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91779Published

GNU Binutils Eh Frame elf-eh-frame.c _bfd_elf_eh_frame_section_offset null pointer dereference

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-44793Published

OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-62263Published

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

cve-program ·

Vendor product: OpenAM

CVSS 4.0 9.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-45051Published

OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage

cve-program ·

Vendor product: OpenAM

CVSS 4.0 9.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-48717Published

OpenAM OAuth Authorization Bypass via PKCE Challenge

cve-program ·

Vendor product: OpenAM

CVSS 4.0 9.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57141Published

PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 9.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90851Published

PHPGurukul Hostel Management System checklogin.php access control

cve-program ·

Vendor product: Hostel Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57140Published

PraisonAI AgentOS exposes unauthenticated agent listing and invocation

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 9.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-52823Published

Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-52822Published

Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90835Published

michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting

cve-program ·

Vendor product: itranswarp

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91846Published

MISP Collection Element Add Missing Authorization on Referenced Object UUID

cve-program ·

Vendor product: MISP

CVSS 4.0 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-75943Published

A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcem

cve-program ·

Vendor product: EOS

CVSS 3.1 2.6 · CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-81900Published

Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-14986Published

Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 6.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-9531Published

Portabilis i-Educar Agenda agenda.php sql injection

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-9606Published

Portabilis i-Educar agenda_preferencias.php sql injection

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-77191Published

All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an

cve-program ·

Vendor product: EOS

CVSS 3.1 2.6 · CVSS 4.0 2.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-18116Published

Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91781Published

GNU Binutils ELF Section elf64-x86-64.c elf_x86_64_common_section_index null pointer dereference

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-90827Published

GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free

cve-program ·

Vendor product: GPAC

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-76159Published

Duplicati for Windows - Incorrect Permission Assignment for Critical Resource

cve-program ·

Vendor product: Duplicati

CVSS 4.0 7.0Source modified 15 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.