Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699906 source statements · aliases may refer to the same vulnerability

CVE-2026-86674Published

ningzichun Student Management System login.php session_start session fixiation

cve-program ·

Vendor product: Student Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86808Published

moltis-org moltis vault.rs vault_recovery_handler missing authentication

cve-program ·

Vendor product: moltis

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-79693Published

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this v…

cve-program ·

Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance

CVSS 3.1 3.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-40635Published

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering…

cve-program ·

Vendor product: PowerScale OneFS

CVSS 3.1 5.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-87923Published

Rizwan17 inventory-management-system List DBOperation.php cross site scripting

cve-program ·

Vendor product: inventory-management-system

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88899Published

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

cve-program ·

Vendor product: knowns

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81052Published

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execu…

cve-program ·

Vendor product: ThinOS 10

CVSS 3.1 6.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88012Published

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

cve-program ·

Vendor product: traefik

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88017Published

rclone: FTP cross-session auth-proxy backend confusion

cve-program ·

Vendor product: rclone

CVSS 3.1 7.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88047Published

Tesseract: ReadNormProtos stack buffer overflow

cve-program ·

Vendor product: tesseract

CVSS 4.0 8.6Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88052Published

Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

cve-program ·

Vendor product: tesseract

CVSS 3.1 7.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89042Published

passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

cve-program ·

https://www.npmjs.com/package/passport-saml-encrypted: passport-saml-encrypted

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88057Published

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

cve-program ·

Vendor product: angular

CVSS 4.0 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88062Published

OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

cve-program ·

Vendor product: OmniRoute

CVSS 4.0 9.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-45762Published

Suricata defrag: missing address-family check can lead to remote crash

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-82099Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81213Published

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.6Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-80436Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-45768Published

Suricata ldap: unbounded responses per transaction can lead to resource exhaustion

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78573Published

IBM ContextForge MCP Gateway is affected by use of default credentials

cve-program ·

Vendor product: ContextForge MCP Gateway

CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-49838Published

GoBGP confederation validation panics on empty AS_PATH attribute

cve-program ·

Vendor product: gobgp

CVSS 3.1 5.9Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-2310Published

IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

cve-program ·

Vendor product: webMethods Integration Server

CVSS 3.1 7.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-77807Published

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter

cve-program ·

Vendor product: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81825Published

Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting

cve-program ·

Vendor product: Simple Ajax Chat – Add a Fast, Secure Chat Box

CVSS 3.1 7.2Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-18561Published

Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

cve-program ·

Vendor product: Unlimited Elements For Elementor

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-19991Published

UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

cve-program ·

Vendor product: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

CVSS 3.1 8.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-6642Published

Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

cve-program ·

Vendor product: Media Library Assistant

CVSS 3.1 6.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89239Published

WWBN AVideo Reflected XSS via Referer Header Comment Breakout

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89244Published

WWBN AVideo Reflected XSS via Gallery Category getBackURL

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89249Published

AVideo YPTWallet Stored XSS via CryptoWallet Configuration

cve-program ·

Vendor product: AVideo

CVSS 4.0 9.3 · CVSS 3.1 8.7Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89254Published

AVideo CustomizeUser Stored XSS via field_name Parameter

cve-program ·

Vendor product: AVideo

CVSS 4.0 9.3 · CVSS 3.1 8.7Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89259Published

Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS

cve-program ·

Vendor product: hugo

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62102Published

WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

cve-program ·

Vendor product: Gato GraphQL

CVSS 3.1 8.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62109Published

WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: sky-elementor-addons

CVSS 3.1 7.6Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62114Published

WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: content-protector

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62136Published

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: flexible-quantity-measurement-price-calculator-for-woocommerce

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62088Published

WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: elasticpress

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89090Published

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response fra…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.2 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 5.9Source modified 11 Sep 2026Recorded 25 Oct 2026

CVE-2026-15406Published

Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter

cve-program ·

Vendor product: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-77187Published

My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

cve-program ·

Vendor product: My Calendar – Accessible Event Manager

CVSS 3.1 6.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-19797Published

User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter

cve-program ·

Vendor product: User Access Manager

CVSS 3.1 6.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-19946Published

Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

cve-program ·

Vendor product: Awesome Support – WordPress HelpDesk & Support Plugin

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-8615Published

ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

cve-program ·

Vendor product: ilGhera Reviso Exporter for WooCommerce

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-75927Published

PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

cve-program ·

Vendor product: User Role Editor – PublishPress Capabilities: Access Control and User Roles

CVSS 3.1 7.2Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-87870Published

Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters

cve-program ·

Vendor product: Ninja Forms - Scheduled Exports

CVSS 3.1 6.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-15823Published

Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter

cve-program ·

Vendor product: Builderall for WordPress

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-85645Published

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting

cve-program ·

Vendor product: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

CVSS 3.1 6.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81275Published

WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

cve-program ·

https://wordpress.org/plugins: youzify

CVSS 3.1 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81786Published

WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woo-thank-you-page-customizer

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81800Published

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: netreviews

CVSS 3.1 9.3Source modified 11 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.