Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699754 source statements · aliases may refer to the same vulnerability

CVE-2026-55451Published

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

cve-program ·

Vendor product: gettext-converter

CVSS 4.0 8.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-53496Published

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

cve-program ·

Vendor product: ExifReader

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-86793Published

CVE-2026-86793

cve-program ·

Vendor product: SGLang

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2013-1446Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Was assigned for an old issue in the brltty daemon and never published completely.

cve-program ·

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-67211Published

Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.opennlp:opennlp-symspell

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-61701Published

Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution

cve-program ·

Vendor product: laravel-magiclink

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54135Published

AirSane has a Remote Denial of Service (OOM) via Unvalidated Content-Length in HTTP Server

cve-program ·

Vendor product: AirSane

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54165Published

Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

cve-program ·

Vendor product: dobase

CVSS 4.0 6.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-87926Published

Rizwan17 inventory-management-system Login Page index.php cross site scripting

cve-program ·

Vendor product: inventory-management-system

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88002Published

Open WebUI: Any authenticated user can hang the server via a cyclic chat message history

cve-program ·

Vendor product: open-webui

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54166Published

Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass

cve-program ·

Vendor product: shelf.nu

CVSS 3.1 7.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54240Published

libde265: Pixel accessor signed integer overflow causes heap OOB read/write

cve-program ·

Vendor product: libde265

CVSS 3.1 7.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54248Published

Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration

cve-program ·

Vendor product: doco-cd

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-17585Published

Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter

cve-program ·

Vendor product: Royal Addons for Elementor – Addons and Templates Kit for Elementor

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-85198Published

MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path

cve-program ·

Vendor product: MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90533Published

Flowise before 3.1.4 Broken Access Control via organizationuser

cve-program ·

Vendor product: Flowise

CVSS 4.0 6.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90538Published

WWBN AVideo Missing Authorization via playlistsFromUser.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

GHSA-24r3-p3x6-cqvxWithdrawn

Duplicate Advisory: SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

osv ·

Go: github.com/siyuan-note/siyuan/kernel

CRITICALSource modified 14 Sep 2026Recorded 24 Oct 2026

CVE-2026-90543Published

WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

GHSA-v3mg-9v85-fcm7Published

SiYuan Vulnerable to Remote Code Execution via Malicious Bazaar Package — Marketplace XSS

osv · CVE-2026-56395 · CVE-2026-56397 · GO-2026-4720

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 14 Sep 2026Recorded 24 Oct 2026

CVE-2026-90548Published

WWBN AVideo Missing Authorization in ImageGallery list.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90553Published

vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor

cve-program ·

Vendor product: vLLM

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90558Published

sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers

cve-program ·

Vendor product: sngrep

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90616Published

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak crea…

cve-program ·

Vendor product: Flatpak

CVSS 3.1 7.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54723Published

devpi: Database contents leak

cve-program ·

Vendor product: devpi

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90485Published

IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereference

cve-program ·

Vendor product: Uninstaller

CVSS 4.0 6.8 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 4.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-71645Published

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the exploration state machine

cve-program ·

Vendor product: n/a

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-64059Published

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

cve-program ·

Vendor product: Grav

CVSS 3.1 1.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-29812Published

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

cve-program ·

Vendor product: CyberPanel

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-78126Published

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.

cve-program ·

Vendor product: strongSwan

CVSS 3.1 5.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-78132Published

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

cve-program ·

Vendor product: strongSwan

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89156Published

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

cve-program ·

Vendor product: PCRE2

CVSS 3.1 2.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89162Published

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

cve-program ·

Vendor product: PCRE2

CVSS 3.1 2.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-53952Published

GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

cve-program ·

Vendor product: GetSimpleCMS-CE · Vendor product: GetSimpleCMS

CVSS 3.1 9.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-49439Published

OpenRemote read-only asset users can write predicted datapoints

cve-program ·

Vendor product: openremote

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54182Published

backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

cve-program ·

Vendor product: CRUD

CVSS 3.1 8.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-48054Published

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-48490Published

ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler

cve-program ·

Vendor product: ArduinoCore-avr

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-45056Published

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

cve-program ·

Vendor product: matrix-rust-sdk

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-50013Published

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

cve-program ·

Vendor product: hoverfly

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90467Published

aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

cve-program ·

Vendor product: aiosmtplib

CVSS 4.0 6.3 · CVSS 3.1 4.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90534Published

Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

cve-program ·

Vendor product: Flowise

CVSS 4.0 6.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2024-53922Published

An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service in the kernel.

cve-program ·

Vendor product: Exynos 8890 firmware

CVSS 3.1 5.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90539Published

WWBN AVideo Missing Authentication via menuItems.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90544Published

WWBN AVideo Missing Authorization via videoAddViewCount.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90549Published

WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90554Published

vLLM before 0.28.0 Denial of Service via audio extraction

cve-program ·

Vendor product: vLLM

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90651Published

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the gen…

cve-program ·

https://hub.docker.com: socketdev/socket-registry-firewall

CVSS 3.1 8.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-45480Published

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.

cve-program ·

Vendor product: Floodlight

CVSS 3.1 3.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90490Published

lenve vhr MailReceiver deserialization

cve-program ·

Vendor product: vhr

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.