Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699754 source statements · aliases may refer to the same vulnerability

CVE-2026-17047Published

IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []

cve-program ·

Vendor product: Db2 Mirror for i

CVSS 3.1 5.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16702Published

IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference

cve-program ·

Vendor product: Db2

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16428Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16432Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 7.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16338Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 9.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16188Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16187Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16185Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 6.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55209Published

resdata insufficiently validates untrusted GRDECL files

cve-program ·

Vendor product: resdata

CVSS 3.1 9.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54447Published

garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

cve-program ·

Vendor product: python-garminconnect

CVSS 3.1 8.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-47253Published

Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

cve-program ·

Vendor product: anyquery

CVSS 3.1 7.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-69251Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig in…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-55093Published

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

cve-program ·

Vendor product: tract

CVSS 3.1 6.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16335Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16466Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-40476Published

graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

cve-program ·

Vendor product: graphql-php

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-18251Published

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

cve-program ·

Vendor product: i

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54542Published

Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

cve-program ·

Vendor product: core-rs-albatross

CVSS 3.1 3.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-18119Published

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90943Published

parallax filament-comments through 3.0.0 Stored XSS via Comment Body

cve-program ·

https://packagist.org: parallax/filament-comments

CVSS 3.1 8.7 · CVSS 4.0 9.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55795Published

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

cve-program ·

Vendor product: commerce

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-57497Published

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

cve-program ·

Vendor product: webtransport-go

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55416Published

Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

cve-program ·

Vendor product: pimcore

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-59960Published

Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

cve-program ·

Vendor product: argos-javascript

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-50157Published

Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

cve-program ·

Vendor product: symfony

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55253Published

LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

cve-program ·

Vendor product: langchain-mongodb · Vendor product: langgraph-checkpoint-mongodb · Vendor product: langgraph-store-mongodb

CVSS 3.1 7.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55847Published

Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

cve-program ·

Vendor product: allure2 · Vendor product: allure-generator

CVSS 3.1 6.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55091Published

flat-to-nested: Prototype pollution in flat-to-nested convert() via proto parent/id key

cve-program ·

Vendor product: flat-to-nested-js

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-73494Published

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

cve-program ·

Vendor product: blaze · Vendor product: blaze-http_2.13 · Vendor product: blaze-http_3

CVSS 3.1 7.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54180Published

backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

cve-program ·

Vendor product: CRUD

CVSS 3.1 7.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54181Published

backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

cve-program ·

Vendor product: CRUD

CVSS 3.1 5.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89023Published

ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

cve-program ·

Vendor product: Domain For Sale

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16147Published

it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 6.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-15924Published

Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 5.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82432Published

Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82433Published

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server · https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82431Published

Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-client

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88018Published

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any cli…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88017Published

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the serve…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-82430Published

Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-core

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-50025Published

Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

cve-program ·

Vendor product: mousehole

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82429Published

Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-core

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88012Published

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88009Published

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Primary 8.2Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-82428Published

Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-client

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88008Published

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88007Published

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport ins…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88004Published

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0 · CVSS 3.1 · [email protected] · Primary 7.4Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-49865Published

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-11003Published

UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

cve-program ·

Vendor product: UiPress lite | Effortless custom dashboards, admin themes and pages

CVSS 3.1 6.4Source modified 14 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.