Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699906 source statements · aliases may refer to the same vulnerability

CVE-2026-68955Published

The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the priv…

cve-program ·

Vendor product: The installer for Rakuten Kobo Desktop Application (Windows version)

CVSS 3.0 7.8 · CVSS 4.0 8.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82762Published

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed b…

cve-program ·

Vendor product: FXA5000 · Vendor product: FXA5020 · Vendor product: FXA5020-[][]

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82764Published

Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.

cve-program ·

Vendor product: FXA5000 · Vendor product: FXA5020 · Vendor product: FXA5020-[][]

CVSS 3.0 4.3 · CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82766Published

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

cve-program ·

Vendor product: SGA1000

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82767Published

Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: SGA1000

CVSS 3.1 5.2 · CVSS 4.0 4.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82769Published

Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: RP-WAH-SR1 · Vendor product: RP-WAH-SR2 · Vendor product: RP-WAH-SR12

CVSS 3.1 5.4 · CVSS 4.0 4.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82770Published

Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed.

cve-program ·

Vendor product: RP-WAH-SR1 · Vendor product: RP-WAH-SR2 · Vendor product: RP-WAH-SR12

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82771Published

Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: ECE1000 · Vendor product: ECE1020 · Vendor product: ECS1020

CVSS 3.1 5.4 · CVSS 4.0 4.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82772Published

Buffer overflow vulnerability exists in Contec EC1000 series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed.

cve-program ·

Vendor product: ECE1000 · Vendor product: ECE1020 · Vendor product: ECS1020

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82773Published

Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: M2M Gateway Integrated Type CPS-MG341* · Vendor product: M2M Gateway Configurable type CPS-MGS341* · Vendor product: M2M Controller Integrated Type CPS-MC341

CVSS 3.1 6.1 · CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82774Published

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be …

cve-program ·

Vendor product: M2M Gateway Integrated Type CPS-MG341* · Vendor product: M2M Gateway Configurable type CPS-MGS341* · Vendor product: M2M Controller Integrated Type CPS-MC341

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82775Published

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the direct…

cve-program ·

Vendor product: M2M Gateway Integrated Type CPS-MG341* · Vendor product: M2M Gateway Configurable type CPS-MGS341* · Vendor product: M2M Controller Integrated Type CPS-MC341

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82776Published

Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: Integrated Type CPS-PC341[][]-*-9201 · Vendor product: Configurable type CPS-PCS341[][]-DS1-1201

CVSS 3.1 6.1 · CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82777Published

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to th…

cve-program ·

Vendor product: Integrated Type CPS-PC341[][]-*-9201 · Vendor product: Configurable type CPS-PCS341[][]-DS1-1201

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82778Published

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication.

cve-program ·

Vendor product: Integrated Type CPS-PC341[][]-*-9201 · Vendor product: Configurable type CPS-PCS341[][]-DS1-1201

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82779Published

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the…

cve-program ·

Vendor product: CPS-TM341G5MB-ADSC1-931 · Vendor product: CPS-TM341MB-ADSC1-931 · Vendor product: CPS-TM341GMB-ADSC1-931

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82780Published

Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uploaded by a remote authenticated attacker, an arbitrary command may be executed on the product.

cve-program ·

Vendor product: CPS-TM341G5MB-ADSC1-931 · Vendor product: CPS-TM341MB-ADSC1-931 · Vendor product: CPS-TM341GMB-ADSC1-931

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82781Published

Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* · Vendor product: Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1 · Vendor product: Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041

CVSS 3.1 5.4 · CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82782Published

Out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.

cve-program ·

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82783Published

Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials.

cve-program ·

CVSS 3.1 4.2 · CVSS 4.0 4.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82784Published

Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/o…

cve-program ·

Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*

CVSS 3.1 6.5 · CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82785Published

Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.

cve-program ·

Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82786Published

Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive information may be restored from a backup file.

cve-program ·

Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*

CVSS 3.1 6.3 · CVSS 4.0 8.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82788Published

Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: CPSL-08P1EN

CVSS 3.1 6.1 · CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82787Published

Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication.

cve-program ·

Vendor product: CPSL-08P1EN

CVSS 3.1 9.8 · CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82763Published

Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

cve-program ·

Vendor product: FXA5000 · Vendor product: FXA5020 · Vendor product: FXA5020-[][]

CVSS 3.1 5.4 · CVSS 4.0 4.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90898Published

Bifrost unauthenticated remote code execution via MCP stdio client registration

cve-program ·

https://github.com/maximhq/bifrost: github.com/maximhq/bifrost/transports

CVSS 3.1 9.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89180Published

Thinking Software Technology｜EFence - SQL Injection

cve-program ·

Vendor product: EFence

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-12882Published

Mattermost Markdown autolink parsing denial of service

cve-program ·

Vendor product: Mattermost

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-14344Published

Inconsistent authorization checks in Mattermost Boards endpoints

cve-program ·

Vendor product: Mattermost

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90890Published

ASRock｜ASRock Polychrome SYNC/RGB software utility - Untrusted Pointer Dereference

cve-program ·

Vendor product: ASRock Polychrome SYNC/RGB for MB · Vendor product: ASRock Polychrome SYNC/RGB for VGA

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-10542Published

Playbooks channel action update validation issue

cve-program ·

Vendor product: Mattermost

CVSS 3.1 5.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90891Published

ASRock｜ASRock Polychrome SYNC/RGB software utility - Improper Access Control

cve-program ·

Vendor product: ASRock Polychrome SYNC/RGB for MB · Vendor product: ASRock Polychrome SYNC/RGB for VGA

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-15814Published

Uploading a crafted image causes excessive memory allocation in the Mattermost Server

cve-program ·

Vendor product: Mattermost

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-5132Published

Unbounded zlib decompression in Calls SDP WebSocket messages

cve-program ·

Vendor product: Mattermost

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-8821Published

Playbooks run owner channel membership permission bypass

cve-program ·

Vendor product: Mattermost

CVSS 3.1 7.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-20773Published

Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

cve-program ·

Vendor product: PingFederate

CVSS 4.0 8.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-9812Published

Missing property field ownership validation in Playbooks run property update endpoint

cve-program ·

Vendor product: Mattermost

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-13417Published

Boards plugin denial of service via unvalidated block fields.properties

cve-program ·

Vendor product: Mattermost

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-10556Published

Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

cve-program ·

Vendor product: Mattermost

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90689Published

Tenda W20E formDelWebAuthWhiteUser stack-based overflow

cve-program ·

Vendor product: W20E

CVSS 4.0 8.7 · CVSS 3.1 8.8 · CVSS 3.0 8.8 · CVSS 2.0 9.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-12518Published

Local privilege escalation in the Logi Options+ updater service on Windows

cve-program ·

Vendor product: Logi Options+

CVSS 4.0 8.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90694Published

SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting

cve-program ·

Vendor product: Inventory Management System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-14298Published

Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost

cve-program ·

Vendor product: Mattermost

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89321Published

Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened.

cve-program ·

Vendor product: Eclipse OpenVSX

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88932Published

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

cve-program ·

Vendor product: multer

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90893Published

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

cve-program ·

Vendor product: MISP

CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90895Published

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

cve-program ·

Vendor product: MISP

CVSS 4.0 8.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-69130Published

WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability

cve-program ·

Vendor product: Entrepreneur - Booking for Small Businesses WordPress Theme

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-53341Published

WordPress Stratus theme <= 4.2.5 - Broken Access Control vulnerability

cve-program ·

Vendor product: App, SaaS & Software Startup Tech Theme - Stratus

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.