Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699981 source statements · aliases may refer to the same vulnerability

CVE-2026-86161Published

SourceCodester Online Voting System ajax.php delete_category sql injection

cve-program ·

Vendor product: Online Voting System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86166Published

Tenda HG10 Boa Web Server formWanRedirect buffer overflow

cve-program ·

Vendor product: HG10

CVSS 4.0 8.7 · CVSS 3.1 8.8 · CVSS 3.0 8.8 · CVSS 2.0 9.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86172Published

DefaultFuction CRM delete.php sql injection

cve-program ·

Vendor product: CRM

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86183Published

diem-project diem dmWidget BasedmWidgetActions.class.php authorization

cve-program ·

Vendor product: diem

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86212Published

Open5GS AMF/MME improper authorization

cve-program ·

Vendor product: Open5GS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86217Published

code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosure

cve-program ·

Vendor product: Hotel and Tourism Reservation in PHP

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86224Published

SourceCodester Class and Exam Timetabling System modal_add_product.php mysqli_query sql injection

cve-program ·

Vendor product: Class and Exam Timetabling System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86231Published

mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation

cve-program ·

Vendor product: jsch

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86236Published

itsourcecode Sales and Inventory System pro_transac.php add sql injection

cve-program ·

Vendor product: Sales and Inventory System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86241Published

liufee FeehiCMS Cookie Validation main-local.php hard-coded key

cve-program ·

Vendor product: FeehiCMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86262Published

sfturing hosp_order Order OrderController.java updateOrderdiseaseInfo authorization

cve-program ·

Vendor product: hosp_order

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86268Published

itsourcecode School Management System User_Login.php sql injection

cve-program ·

Vendor product: School Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86273Published

projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery

cve-program ·

Vendor product: siga

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-79698Published

Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection

cve-program ·

Vendor product: WISE-6610-NB · Vendor product: WISE-6610-EB · Vendor product: WISE-6610-TB

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86281Published

SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery

cve-program ·

Vendor product: Syllabus-Aligned Learning Management & Examination System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86289Published

Ollama GGUF Decoder gguf.go readGGUFV1String integer overflow

cve-program ·

Vendor product: Ollama

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86294Published

SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting

cve-program ·

Vendor product: Simple Traffic Offense System

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86299Published

Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection

cve-program ·

Vendor product: RE7000

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86305Published

light0011 cms Upload.class.php upload unrestricted upload

cve-program ·

Vendor product: cms

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86310Published

itsourcecode Sales and Inventory System cust_edit1.php sql injection

cve-program ·

Vendor product: Sales and Inventory System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86509Published

D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow

cve-program ·

Vendor product: DIR-895L

CVSS 4.0 9.4 · CVSS 3.1 9.6 · CVSS 3.0 9.6 · CVSS 2.0 8.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86514Published

vgmstream txth-txtp txth.c sscanf stack-based overflow

cve-program ·

Vendor product: vgmstream

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86519Published

code-projects Student Crud Operation Backup File card_activation.sql information disclosure

cve-program ·

Vendor product: Student Crud Operation

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86668Published

aircheng-org iWebShop-5 pic.php uploadFile cross site scripting

cve-program ·

Vendor product: iWebShop-5

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86674Published

ningzichun Student Management System login.php session_start session fixiation

cve-program ·

Vendor product: Student Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-86808Published

moltis-org moltis vault.rs vault_recovery_handler missing authentication

cve-program ·

Vendor product: moltis

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-79693Published

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this v…

cve-program ·

Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance

CVSS 3.1 3.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-40635Published

Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering…

cve-program ·

Vendor product: PowerScale OneFS

CVSS 3.1 5.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-87923Published

Rizwan17 inventory-management-system List DBOperation.php cross site scripting

cve-program ·

Vendor product: inventory-management-system

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88899Published

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

cve-program ·

Vendor product: knowns

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81052Published

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execu…

cve-program ·

Vendor product: ThinOS 10

CVSS 3.1 6.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88012Published

Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded

cve-program ·

Vendor product: traefik

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88017Published

rclone: FTP cross-session auth-proxy backend confusion

cve-program ·

Vendor product: rclone

CVSS 3.1 7.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88047Published

Tesseract: ReadNormProtos stack buffer overflow

cve-program ·

Vendor product: tesseract

CVSS 4.0 8.6Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88052Published

Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization

cve-program ·

Vendor product: tesseract

CVSS 3.1 7.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89042Published

passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

cve-program ·

https://www.npmjs.com/package/passport-saml-encrypted: passport-saml-encrypted

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88057Published

Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler

cve-program ·

Vendor product: angular

CVSS 4.0 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-88062Published

OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

cve-program ·

Vendor product: OmniRoute

CVSS 4.0 9.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-45762Published

Suricata defrag: missing address-family check can lead to remote crash

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-82099Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81213Published

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.6Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-80436Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-45768Published

Suricata ldap: unbounded responses per transaction can lead to resource exhaustion

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78573Published

IBM ContextForge MCP Gateway is affected by use of default credentials

cve-program ·

Vendor product: ContextForge MCP Gateway

CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-49838Published

GoBGP confederation validation panics on empty AS_PATH attribute

cve-program ·

Vendor product: gobgp

CVSS 3.1 5.9Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-2310Published

IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

cve-program ·

Vendor product: webMethods Integration Server

CVSS 3.1 7.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-77807Published

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter

cve-program ·

Vendor product: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81825Published

Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting

cve-program ·

Vendor product: Simple Ajax Chat – Add a Fast, Secure Chat Box

CVSS 3.1 7.2Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-18561Published

Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

cve-program ·

Vendor product: Unlimited Elements For Elementor

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-19991Published

UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

cve-program ·

Vendor product: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

CVSS 3.1 8.1Source modified 11 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.