Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700869 source statements · aliases may refer to the same vulnerability

CVE-2026-75945Published

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

cve-program ·

Vendor product: EOS

CVSS 3.1 2.6 · CVSS 4.0 2.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-28960Published

A denial-of-service issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. A remote attacker may be able to cause a denial-of-service.

cve-program ·

Vendor product: iOS and iPadOS

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-65352Published

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Rela…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-65355Published

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a use…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-13146Published

Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution

cve-program ·

Vendor product: DTX – Dynamic Text Extension for Contact Form 7

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

MAL-2026-16163Published

Malicious code in @yggbrasil/api (npm)

osv · GHSA-cmxv-8vgc-m43c

npm: @yggbrasil/api

Source modified 14 Sep 2026Recorded 24 Oct 2026

CVE-2025-12821Published

NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation

cve-program ·

Vendor product: NewsBlogger

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16772Published

CVE-2026-16772

cve-program ·

Vendor product: Akaunting

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-67398Published

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHM…

cve-program ·

Vendor product: WHMCS

CVSS 4.0 8.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-43746Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lea…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-64705Published

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or write …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-64708Published

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may bypass Gatekeeper checks.

cve-program ·

Vendor product: macOS

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-43748Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 14 Sep 2026Recorded 23 Oct 2026

MAL-2026-14316Published

Malicious code in expect-dotenv (npm)

osv · GHSA-h7q6-7chv-cgh2

npm: expect-dotenv

Source modified 14 Sep 2026Recorded 24 Oct 2026

MAL-2026-14353Published

Malicious code in @gfe/lx-watcher (npm)

osv · GHSA-wg37-hw83-hqwf

npm: @gfe/lx-watcher

Source modified 14 Sep 2026Recorded 24 Oct 2026

MAL-2026-16157Published

Malicious code in @merazmz/project-tracker (npm)

osv · GHSA-x98w-cqq8-v3q2

npm: @merazmz/project-tracker

Source modified 14 Sep 2026Recorded 24 Oct 2026

CVE-2026-17628Published

Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 5.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-17467Published

Vulnerabilities exists in IBM Cloud Pak for Data System

cve-program ·

Vendor product: Cloud Pak for Data System (Yosemite 1.0)

CVSS 3.1 8.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-17463Published

IBM® Db2® could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption

cve-program ·

Vendor product: Db2

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-17047Published

IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []

cve-program ·

Vendor product: Db2 Mirror for i

CVSS 3.1 5.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16702Published

IBM® Db2® federated server could allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference

cve-program ·

Vendor product: Db2

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16428Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16432Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 7.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16338Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 9.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16188Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16187Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16185Published

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

cve-program ·

Vendor product: WebSphere Application Server

CVSS 3.1 6.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55209Published

resdata insufficiently validates untrusted GRDECL files

cve-program ·

Vendor product: resdata

CVSS 3.1 9.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54447Published

garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store

cve-program ·

Vendor product: python-garminconnect

CVSS 3.1 8.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-47253Published

Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion

cve-program ·

Vendor product: anyquery

CVSS 3.1 7.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-69251Published

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig in…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-55093Published

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

cve-program ·

Vendor product: tract

CVSS 3.1 6.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16335Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16466Published

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

cve-program ·

Vendor product: DataStage on Cloud Pak for Data

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-40476Published

graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation

cve-program ·

Vendor product: graphql-php

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-18251Published

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

cve-program ·

Vendor product: i

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54542Published

Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

cve-program ·

Vendor product: core-rs-albatross

CVSS 3.1 3.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-18119Published

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 7.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90943Published

parallax filament-comments through 3.0.0 Stored XSS via Comment Body

cve-program ·

https://packagist.org: parallax/filament-comments

CVSS 3.1 8.7 · CVSS 4.0 9.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55795Published

Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

cve-program ·

Vendor product: commerce

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-57497Published

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

cve-program ·

Vendor product: webtransport-go

CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55416Published

Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

cve-program ·

Vendor product: pimcore

CVSS 3.1 8.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-59960Published

Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

cve-program ·

Vendor product: argos-javascript

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-50157Published

Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

cve-program ·

Vendor product: symfony

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55253Published

LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

cve-program ·

Vendor product: langchain-mongodb · Vendor product: langgraph-checkpoint-mongodb · Vendor product: langgraph-store-mongodb

CVSS 3.1 7.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55847Published

Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering

cve-program ·

Vendor product: allure2 · Vendor product: allure-generator

CVSS 3.1 6.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55091Published

flat-to-nested: Prototype pollution in flat-to-nested convert() via proto parent/id key

cve-program ·

Vendor product: flat-to-nested-js

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-73494Published

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

cve-program ·

Vendor product: blaze · Vendor product: blaze-http_2.13 · Vendor product: blaze-http_3

CVSS 3.1 7.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54180Published

backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

cve-program ·

Vendor product: CRUD

CVSS 3.1 7.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54181Published

backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

cve-program ·

Vendor product: CRUD

CVSS 3.1 5.4Source modified 14 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.