Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699906 source statements · aliases may refer to the same vulnerability

CVE-2026-11817Published

CVE-2026-11817 CVE Record

cve-program ·

Vendor product: Grafana OSS · Vendor product: Grafana Enterprise

CVSS 4.0 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90699Published

D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection

cve-program ·

Vendor product: DWR-M920

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 14 Sep 2026Recorded 23 Oct 2026

RUSTSEC-2026-0284Published

Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

osv ·

crates.io: lockfree

Source modified 14 Sep 2026Recorded 24 Oct 2026

GHSA-63gh-g2x5-x69vPublished

Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability

osv · BIT-dotnet-2026-71328 · BIT-dotnet-sdk-2026-71328 · CVE-2026-71328

NuGet: Microsoft.DiaSymReader.Native

HIGHSource modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-86452Published

MISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request Flooding

cve-program ·

Vendor product: MISP

CVSS 4.0 8.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-86418Published

MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users

cve-program ·

Vendor product: MISP

CVSS 4.0 2.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-10420Published

Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.

cve-program ·

Vendor product: mTower

CVSS 3.1 5.5Source modified 14 Sep 2026Recorded 23 Oct 2026

MAL-2026-16114Published

Malicious code in etoro-auth (npm)

osv ·

npm: etoro-auth

Source modified 14 Sep 2026Recorded 24 Oct 2026

CVE-2026-82078Published

PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector

cve-program ·

Vendor product: PaperCut MF/NG

CVSS 4.0 9.4Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-81578Published

PaperCut MF/NG: Authentication Bypass

cve-program ·

Vendor product: PaperCut MF/NG

CVSS 4.0 8.8Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-52295Published

FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-based access in libavformat/iamf_writer.c.

cve-program ·

Vendor product: FFmpeg

CVSS 3.1 2.9Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-49030Rejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cve-program ·

Source modified 13 Sep 2026Recorded 23 Oct 2026

RUSTSEC-2026-0283Published

clear_on_drop is unmaintained

osv ·

crates.io: clear_on_drop

Source modified 13 Sep 2026Recorded 24 Oct 2026

GHSA-pgjj-866w-fc5cPublished

Risk of code injection

osv · CVE-2021-21278

npm: rsshub

HIGHSource modified 13 Sep 2026Recorded 24 Oct 2026

CVE-2026-77773Published

Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry

cve-program ·

Vendor product: Contact Form to Chat Apps | Click to Chat to Order

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-80071Published

User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

cve-program ·

Vendor product: User Registration & Membership

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-80072Published

User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect Parameters

cve-program ·

Vendor product: User Registration & Membership

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-86406Published

User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

cve-program ·

Vendor product: User Registration & Membership

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-86407Published

User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page

cve-program ·

Vendor product: User Registration & Membership

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-88764Published

Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref

cve-program ·

Vendor product: Simple Membership

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-88912Published

rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR

cve-program ·

Vendor product: rtMedia for WordPress, BuddyPress and bbPress

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-88995Published

Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check

cve-program ·

Vendor product: Bookit — Booking & Appointment Calendar

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-89080Published

Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State Demotion

cve-program ·

Vendor product: Really Simple Security

Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2025-25252Published

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose acco…

cve-program ·

Vendor product: FortiOS

CVSS 3.1 4.3Source modified 13 Sep 2026Recorded 23 Oct 2026

CVE-2026-24332Published

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array (with "status": "of…

cve-program ·

Vendor product: WebSocket API service

CVSS 3.1 4.3Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-83532Published

Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

cve-program ·

Vendor product: Custom Menu Wizard Widget

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-75800Published

Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

cve-program ·

Vendor product: Frontegg SAML SSO

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-77005Published

Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

cve-program ·

Vendor product: CODE MONKEYS PROPOSALS

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-84889Published

A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.8Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-79724Published

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 9.8Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-78569Published

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.8Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-77689Published

Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass

cve-program ·

Vendor product: Booking for Appointments and Events Calendar

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-77705Published

Amelia < 2.4.10 - Amelia Manager+ WordPress Account Takeover

cve-program ·

Vendor product: Booking for Appointments and Events Calendar

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-77752Published

Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation

cve-program ·

Vendor product: Temporary Login Without Password

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-77753Published

Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords

cve-program ·

Vendor product: Temporary Login Without Password

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-78152Published

SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

cve-program ·

Vendor product: SureRank SEO

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-80491Published

SAMO Forms <= 1.0.0 - Unauthenticated SQLi

cve-program ·

Vendor product: SAMO Forms

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-80494Published

Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download

cve-program ·

Vendor product: Yogeta WP Cloud

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-81090Published

Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF

cve-program ·

Vendor product: Gpx2Graphics

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-81402Published

DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload

cve-program ·

Vendor product: DS Ad Rotator

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-81429Published

Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRF

cve-program ·

Vendor product: Export & Import WPBakery Page Builder

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-81742Published

BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

cve-program ·

Vendor product: BE REST Endpoints

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-82845Published

Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

cve-program ·

Vendor product: Masteriyo LMS

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-82847Published

Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights

cve-program ·

Vendor product: Masteriyo LMS

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-82851Published

Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

cve-program ·

Vendor product: Masteriyo LMS

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-84023Published

BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF

cve-program ·

Vendor product: BEAR

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-84024Published

BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF

cve-program ·

Vendor product: BEAR

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-84025Published

BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR

cve-program ·

Vendor product: BEAR

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-84047Published

Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action

cve-program ·

Vendor product: Album Cover Finder

Source modified 12 Sep 2026Recorded 23 Oct 2026

CVE-2026-84099Published

IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

cve-program ·

Vendor product: wpstorecart

Source modified 12 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.