Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700870 source statements · aliases may refer to the same vulnerability

CVE-2026-78132Published

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

cve-program ·

Vendor product: strongSwan

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89156Published

PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.

cve-program ·

Vendor product: PCRE2

CVSS 3.1 2.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-89162Published

In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.

cve-program ·

Vendor product: PCRE2

CVSS 3.1 2.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-53952Published

GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

cve-program ·

Vendor product: GetSimpleCMS-CE · Vendor product: GetSimpleCMS

CVSS 3.1 9.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-49439Published

OpenRemote read-only asset users can write predicted datapoints

cve-program ·

Vendor product: openremote

CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54182Published

backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

cve-program ·

Vendor product: CRUD

CVSS 3.1 8.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-48054Published

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 14 Sep 2026Recorded 25 Oct 2026

CVE-2026-48490Published

ArduinoCore-AVR: Stack-Based Buffer Overflow in String float/double concatenation handler

cve-program ·

Vendor product: ArduinoCore-avr

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-45056Published

Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

cve-program ·

Vendor product: matrix-rust-sdk

CVSS 4.0 6.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-50013Published

Hoverfly: Process Crash via Concurrent Map Write Race Condition in Diff Mode

cve-program ·

Vendor product: hoverfly

CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90467Published

aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses

cve-program ·

Vendor product: aiosmtplib

CVSS 4.0 6.3 · CVSS 3.1 4.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90534Published

Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

cve-program ·

Vendor product: Flowise

CVSS 4.0 6.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2024-53922Published

An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service in the kernel.

cve-program ·

Vendor product: Exynos 8890 firmware

CVSS 3.1 5.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90539Published

WWBN AVideo Missing Authentication via menuItems.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90544Published

WWBN AVideo Missing Authorization via videoAddViewCount.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90549Published

WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint

cve-program ·

Vendor product: AVideo

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90554Published

vLLM before 0.28.0 Denial of Service via audio extraction

cve-program ·

Vendor product: vLLM

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90651Published

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the gen…

cve-program ·

https://hub.docker.com: socketdev/socket-registry-firewall

CVSS 3.1 8.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-45480Published

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.

cve-program ·

Vendor product: Floodlight

CVSS 3.1 3.0Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90490Published

lenve vhr MailReceiver deserialization

cve-program ·

Vendor product: vhr

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55866Published

SpiceDBChecks involving relations with caveats can result in unconditional permission when conditional permission is expected

cve-program ·

Vendor product: spicedb

CVSS 3.1 3.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-29811Published

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

cve-program ·

Vendor product: CyberPanel

CVSS 3.1 7.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-38332Published

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.

cve-program ·

Vendor product: TinyEXIF

CVSS 3.1 2.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2022-42917Published

In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownershi…

cve-program ·

Vendor product: FRRouting

CVSS 3.1 6.7Source modified 14 Sep 2026Recorded 23 Oct 2026

GHSA-5cph-wvm9-45gjPublished

Flowise OverrideConfig security vulnerability

osv · CVE-2024-58351

npm: flowise

HIGHSource modified 14 Sep 2026Recorded 24 Oct 2026

GHSA-5w6g-rc45-wvv9Withdrawn

Duplicate Advisory: Flowise OverrideConfig security vulnerability

osv ·

npm: flowise

CRITICALSource modified 14 Sep 2026Recorded 24 Oct 2026

CVE-2026-68006Published

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file

cve-program ·

Vendor product: n/a

Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-23786Published

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A TOCTOU race condition in the Exynos DRM HDR Driver leads to a heap overflow, causing a kernel crash.

cve-program ·

Vendor product: Exynos 1280 firmware

CVSS 3.1 2.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-44162Published

fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`

cve-program ·

Vendor product: fluent-plugin-s3

CVSS 3.1 2.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-23791Published

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode …

cve-program ·

Vendor product: Exynos 1280 firmware

CVSS 3.1 4.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-33957Published

An issue was discovered in CustOS Driver in Samsung Mobile Processor Exynos 1580. Requesting oversized shared memory from the custos_iwc device enables out-of-bounds read and write, potentially leading to memory corruption or information le…

cve-program ·

Vendor product: Exynos 1580 firmware

CVSS 3.1 4.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-33966Published

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code.

cve-program ·

Vendor product: Exynos 1330 firmware

CVSS 3.1 2.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90668Published

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with…

cve-program ·

Vendor product: UnrealIRCd

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2023-22631Published

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.

cve-program ·

Vendor product: PRTG Network Monitor

CVSS 3.1 2.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2023-24284Published

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function.

cve-program ·

Vendor product: Portable Puzzle Collection

CVSS 3.1 2.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2023-24291Published

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter.

cve-program ·

Vendor product: Portable Puzzle Collection

CVSS 3.1 2.9Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2023-34854Published

HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function.

cve-program ·

Vendor product: HotelDruid

CVSS 3.1 6.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2023-45023Published

The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.

cve-program ·

Vendor product: femanager

CVSS 3.1 4.2Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-55832Published

Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

cve-program ·

Vendor product: tract

CVSS 3.1 6.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2023-50460Published

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any fron…

cve-program ·

Vendor product: femanager

CVSS 3.1 5.4Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2025-26790Published

Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by the antivirus engine.

cve-program ·

Vendor product: Atlant

CVSS 3.1 3.7Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90929Published

File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

cve-program ·

Vendor product: filebrowser

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-54175Published

backpack/crud: Unverified password change in MyAccountController via mass assignment

cve-program ·

Vendor product: CRUD

CVSS 3.1 7.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-90934Published

EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

cve-program ·

Vendor product: espocrm

CVSS 4.0 8.7 · CVSS 3.1 4.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-7208Published

Yealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File Deletion

cve-program ·

Vendor product: SIP-T33G

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-57115Published

PraisonAI: SpiderTools redirect-target SSRF protection bypass

cve-program ·

Vendor product: PraisonAI · Vendor product: praisonaiagents

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-57123Published

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

cve-program ·

Vendor product: praisonaiagents

CVSS 3.1 9.8Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-57122Published

PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 8.6Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-57145Published

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 9.1Source modified 14 Sep 2026Recorded 23 Oct 2026

CVE-2026-57570Published

backpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

cve-program ·

Vendor product: CRUD

CVSS 3.1 6.5Source modified 14 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.