Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700872 source statements · aliases may refer to the same vulnerability

CVE-2026-62102Published

WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

cve-program ·

Vendor product: Gato GraphQL

CVSS 3.1 8.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62109Published

WordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: sky-elementor-addons

CVSS 3.1 7.6Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62114Published

WordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: content-protector

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62136Published

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: flexible-quantity-measurement-price-calculator-for-woocommerce

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62088Published

WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: elasticpress

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89090Published

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response fra…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.2 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 5.9Source modified 11 Sep 2026Recorded 25 Oct 2026

CVE-2026-15406Published

Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter

cve-program ·

Vendor product: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-77187Published

My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

cve-program ·

Vendor product: My Calendar – Accessible Event Manager

CVSS 3.1 6.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-19797Published

User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter

cve-program ·

Vendor product: User Access Manager

CVSS 3.1 6.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-19946Published

Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

cve-program ·

Vendor product: Awesome Support – WordPress HelpDesk & Support Plugin

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-8615Published

ilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function

cve-program ·

Vendor product: ilGhera Reviso Exporter for WooCommerce

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-75927Published

PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

cve-program ·

Vendor product: User Role Editor – PublishPress Capabilities: Access Control and User Roles

CVSS 3.1 7.2Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-87870Published

Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters

cve-program ·

Vendor product: Ninja Forms - Scheduled Exports

CVSS 3.1 6.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-15823Published

Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter

cve-program ·

Vendor product: Builderall for WordPress

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-85645Published

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting

cve-program ·

Vendor product: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

CVSS 3.1 6.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81275Published

WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

cve-program ·

https://wordpress.org/plugins: youzify

CVSS 3.1 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81786Published

WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woo-thank-you-page-customizer

CVSS 3.1 7.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81800Published

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: netreviews

CVSS 3.1 9.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-84816Published

WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: currency-switcher

CVSS 3.1 7.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-18579Published

WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting

cve-program ·

Vendor product: WP Photo Album Plus

CVSS 3.1 7.2Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-11496Published

Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure

cve-program ·

Vendor product: PDF Builder for WooCommerce. Create invoices,packing slips and more

CVSS 3.1 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-8778Published

MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload

cve-program ·

Vendor product: MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields.

CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78172Published

Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting

cve-program ·

Vendor product: Themify – WooCommerce Product Filter

CVSS 3.1 6.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2024-12145Published

BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion

cve-program ·

Vendor product: BuddyPress

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62140Published

WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: quiz-master-next

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62103Published

WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: everest-forms

CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62110Published

WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: bold-page-builder

CVSS 3.1 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62113Published

WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: slim-seo

CVSS 3.1 4.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62132Published

WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: learning-management-system

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62135Published

WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: booktics

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62137Published

WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: bbpress

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62089Published

WordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: master-addons

CVSS 3.1 7.1Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78807Published

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

cve-program ·

Vendor product: n/a

Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-79395Published

An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass aut…

cve-program ·

Vendor product: n/a

Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78124Published

strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.

cve-program ·

Vendor product: strongSwan

CVSS 3.1 3.7Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78131Published

strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.

cve-program ·

Vendor product: strongSwan

CVSS 3.1 3.7Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89151Published

Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.

cve-program ·

Vendor product: Forgejo

CVSS 3.1 3.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89161Published

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

cve-program ·

Vendor product: PCRE2

CVSS 3.1 7.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-49463Published

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

cve-program ·

Vendor product: nl.nl-portal:besluiten · Vendor product: nl.nl-portal:documenten-api

CVSS 3.1 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-89332Published

Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

cve-program ·

Vendor product: Kiro IDE

CVSS 3.1 5.5 · CVSS 4.0 6.7Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62105Published

WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

cve-program ·

Vendor product: ThemeREX Addons

CVSS 3.1 9.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62111Published

WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: simple-payment

CVSS 3.1 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62133Published

WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: rometheme-for-elementor

CVSS 3.1 5.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-62138Published

WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: visualcomposer

CVSS 3.1 6.5Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81912Published

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 5.7Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81913Published

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78547Published

Out-of-Bounds Write

cve-program ·

Vendor product: Citrix Workspace app for Windows

CVSS 4.0 4.4Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-78546Published

Out-of-Bounds Read

cve-program ·

Vendor product: Workspace app for Windows

CVSS 4.0 4.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-81911Published

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot save_template via Unescaped Summary Description

cve-program ·

https://github.com/concretecms/concretecms: Concrete CMS

CVSS 4.0 5.8Source modified 11 Sep 2026Recorded 23 Oct 2026

CVE-2026-27378Published

WordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: advanced-partial-payment-or-deposit-for-woocommerce

CVSS 3.1 5.3Source modified 11 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.