Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700870 source statements · aliases may refer to the same vulnerability

CVE-2026-54181Published

backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

cve-program ·

Vendor product: CRUD

CVSS 3.1 5.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89023Published

ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

cve-program ·

Vendor product: Domain For Sale

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-16147Published

it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 6.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-15924Published

Use-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr sockets

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 5.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82432Published

Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82433Published

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server · https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82431Published

Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-client

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88018Published

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any cli…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88017Published

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the serve…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-82430Published

Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-core

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-50025Published

Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

cve-program ·

Vendor product: mousehole

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82429Published

Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-core

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88012Published

Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12, HTTP/3 entrypoints do not apply entryPoints..transport.respondingTimeouts.readTimeout because the timeout is enforced on a TCP connection a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88009Published

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Primary 8.2Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-82428Published

Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-client

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-88008Published

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88007Published

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport ins…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.1 · CVSS 3.1 · [email protected] · Primary 9.1Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-88004Published

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0 · CVSS 3.1 · [email protected] · Primary 7.4Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-49865Published

Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLs

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-11003Published

UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

cve-program ·

Vendor product: UiPress lite | Effortless custom dashboards, admin themes and pages

CVSS 3.1 6.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82427Published

Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-48496Published

opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent

cve-program ·

Vendor product: opentelemetry-ebpf-profiler

CVSS 3.1 6.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82435Published

Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-client

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82437Published

Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82426Published

Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location

cve-program ·

https://repo.maven.apache.org/maven2/: org.apache.storm:storm-server

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82438Published

Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-10938Published

UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

cve-program ·

Vendor product: UiPress lite | Effortless custom dashboards, admin themes and pages

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82439Published

Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82434Published

Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server · https://repo.maven.apache.org/maven2: org.apache.storm:storm-client

CVSS 4.0 10.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-84179Published

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server · https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82232Published

Apache Syncope: SQL injection via sort parameter in Task search

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-jpa

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-86460Published

Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-neo4j

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-87779Published

Apache Syncope: AES Secret Key disclosure via log output

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-spring

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-87785Published

Apache Syncope: JWT subject spoofing

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-spring

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82441Published

Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.storm:storm-server

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-19624Published

NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

cve-program ·

https://github.com/nm-l2tp/NetworkManager-l2tp: NetworkManager-l2tp · https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp: NetworkManager-l2tp · https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp: NetworkManager-l2tp

CVSS 3.1 7.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-19542Published

Stack-based out-of-bounds write in tdelete during tree rebalancing

cve-program ·

Vendor product: glibc

CVSS 3.1 5.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-91021Published

CVE-2026-91021

cve-program ·

Vendor product: Trillium Notes

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-19499Published

Buffer overflow in strfmon and strfmon_l right-justification padding

cve-program ·

Vendor product: glibc

CVSS 3.1 7.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-87802Published

Apache Syncope: SRA OAuth2 JWT signature verification bypass

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.syncope:syncope-sra

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-68570Published

Apache Doris: Authorization bypass leading to unauthorized data access

cve-program ·

Vendor product: Apache Doris

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-72524Published

Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables

cve-program ·

Vendor product: Apache Doris

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-11993Published

Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion

cve-program ·

Vendor product: Mattermost

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-14259Published

Board archive import bypasses team board creation permissions

cve-program ·

Vendor product: Mattermost

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-85125Published

The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites…

cve-program ·

Vendor product: YAMAP -Social Trekking GPS App

CVSS 3.0 5.4 · CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-82796Published

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

cve-program ·

Vendor product: SV-CPT-MC310 · Vendor product: SV-CPT-MC310F

CVSS 3.1 5.4 · CVSS 4.0 5.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90813Published

cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

cve-program ·

Vendor product: mercury-agent

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-85583Published

SiYuan before v3.8.2 Path Traversal via symlink in file API

cve-program ·

Vendor product: siyuan

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-85598Published

Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages

cve-program ·

Vendor product: grav

CVSS 4.0 5.1 · CVSS 3.1 6.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-85603Published

Grav Admin Plugin Path Traversal via Save As Language Code

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.