Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699754 source statements · aliases may refer to the same vulnerability

CVE-2026-91851Published

MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

cve-program ·

Vendor product: MISP

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19290Published

IBM Sterling File Gateway is Vulnerable to Improper Access Control

cve-program ·

Vendor product: Sterling File Gateway

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-68489Published

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

cve-program ·

Vendor product: Plesk extension "Ruby" · Vendor product: Plesk extension "Node.js Toolkit"

CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-67399Published

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

cve-program ·

Vendor product: WHMCS

CVSS 4.0 9.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-80217Published

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands.

cve-program ·

Vendor product: FF-RFI079I4 · Vendor product: FF-RFI078I4

CVSS 3.0 8.8 · CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91857Published

MISP: State-changing actions accessible via GET request enabling CSRF

cve-program ·

Vendor product: MISP

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-91859Published

MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass

cve-program ·

Vendor product: MISP

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-53660Published

OpenAM Insecure SSO Cookie Initialization

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-46498Published

OpenAM Arbitrary OAuth Token Minting via Push Registration

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.6Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-19515Published

OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution

cve-program ·

Vendor product: WSO2 Integrator: MI for Visual Studio Code

CVSS 3.1 7.0Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-5802Published

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

cve-program ·

Vendor product: WSO2 API Manager · Vendor product: WSO2 API Control Plane · Vendor product: WSO2 Universal Gateway

CVSS 3.1 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-47424Published

OpenAM Authenticated RCE via Groovy Sandbox Escape

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-87730Rejected

this is rejected

cve-program ·

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57137Published

PraisonAI AgentLoop onToolCall approval runs after tool execution

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 8.8Source modified 15 Sep 2026Recorded 23 Oct 2026

GHSA-vgwf-h737-ff37Published

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

osv · CVE-2026-39830 · GO-2026-5017

Go: golang.org/x/crypto

CRITICALSource modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-57135Published

PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 7.6Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-52820Published

Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-41573Published

OpenAM LDAP Injection via `_queryId` Parameter

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-52826Published

Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57136Published

PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 8.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-57134Published

PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 8.2Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-86472Published

fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets

cve-program ·

Vendor product: fast-uri

CVSS 3.1 4.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-52825Published

Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-92003Published

MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion

cve-program ·

Vendor product: MISP

CVSS 4.0 6.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-86818Published

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

cve-program ·

Vendor product: fast-uri

CVSS 3.1 4.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-89308Published

Arbitrary command execution in TrxTimeATTENDANCE

cve-program ·

Vendor product: TrxTimeATTENDANCE

CVSS 4.0 9.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-52828Published

Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-77117Published

SHIFT_JISX0213 decoding may hang on crafted input

cve-program ·

Vendor product: glibc

CVSS 3.1 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-1758Published

Session Fixation

cve-program ·

Vendor product: GateManager

CVSS 3.1 8.3Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-80489Published

EUC_JISX0213 decoding may hang on crafted input

cve-program ·

Vendor product: glibc

CVSS 3.1 5.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-1759Published

Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation.

cve-program ·

Vendor product: GateManager

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-42508Published

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.4Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-39832Published

When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of th…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 9.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.7Source modified 15 Sep 2026Recorded 25 Oct 2026

CVE-2026-92002Published

MISP: Authentication failure logging suppressed during Redis unavailability

cve-program ·

Vendor product: MISP

CVSS 4.0 5.1Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-42508Published

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

cve-program ·

https://pkg.go.dev: golang.org/x/crypto/ssh/knownhosts

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-33870Published

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

cve-program ·

Vendor product: netty

CVSS 3.1 7.5Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-33871Published

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

cve-program ·

Vendor product: netty

CVSS 4.0 8.7Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-39832Published

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

cve-program ·

https://pkg.go.dev: golang.org/x/crypto/ssh/agent

Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-27830Published

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

cve-program ·

Vendor product: c3p0

CVSS 4.0 8.9Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-27727Published

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

cve-program ·

Vendor product: mchange-commons-java

CVSS 4.0 8.9Source modified 15 Sep 2026Recorded 23 Oct 2026

GO-2026-6019Published

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper

osv · CVE-2026-65838 · GHSA-8qqm-fp2q-v734

Go: github.com/zalando/skipper

Source modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-9796Published

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

cve-program ·

https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator

CVSS 3.1 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

GO-2026-5018Published

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

osv · CVE-2026-39829 · GHSA-w879-237q-wc7r

Go: golang.org/x/crypto

Source modified 15 Sep 2026Recorded 24 Oct 2026

GO-2026-5006Published

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

osv · CVE-2026-39832 · GHSA-f5wc-c3c7-36mc

Go: golang.org/x/crypto

Source modified 15 Sep 2026Recorded 24 Oct 2026

GO-2026-5021Published

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

osv · CVE-2026-42508 · GHSA-5cgq-3rg8-m6cv

Go: golang.org/x/crypto

Source modified 15 Sep 2026Recorded 24 Oct 2026

CVE-2026-90894Published

Parallels Desktop local privilege escalation via appliance extract argument injection

cve-program ·

Vendor product: Parallels Desktop

CVSS 3.1 7.8Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2026-86836Published

In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a direct…

cve-program ·

Vendor product: Eclipse Ankaios

CVSS 4.0 8.4Source modified 15 Sep 2026Recorded 23 Oct 2026

CVE-2025-10012Published

Portabilis i-Educar educar_historico_escolar_lst.php sql injection

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 15 Sep 2026Recorded 23 Oct 2026

MAL-2026-16168Published

Malicious code in @biz44/id79-client (npm)

osv ·

npm: @biz44/id79-client

Source modified 15 Sep 2026Recorded 24 Oct 2026

MAL-2026-16171Published

Malicious code in @biz44/process-runtime-utils (npm)

osv ·

npm: @biz44/process-runtime-utils

Source modified 15 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.