Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700890 source statements · aliases may refer to the same vulnerability

CVE-2026-88050Published

Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values

cve-program ·

Vendor product: tesseract

CVSS 4.0 6.9Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88270Published

GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 6.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88271Published

GV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential Takeover

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 8.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88272Published

GV-LPC2011/LPC2211 - Stored Administrator-Username Command Injection

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 7.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28584Published

In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. Use…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88277Published

GV-LPCLPC2011/2211 - ONVIF Subscribe Address Command Injection

cve-program ·

Vendor product: GV-LPCLPC2011/2211

CVSS 3.1 8.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28652Published

In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed fo…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87482Published

Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87590Published

Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via crafted network traffic. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-0054Published

In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. …

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28582Published

In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permission check. This could lead to local information disclosure with no additional exe…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28596Published

In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction …

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88044Published

rclone: RC per-server auth-proxy bypass

cve-program ·

Vendor product: rclone

CVSS 3.1 9.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88049Published

Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch

cve-program ·

Vendor product: tesseract

CVSS 4.0 8.6Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2020-14498Published

HMS Industrial Networks AB eCatcher Stack-based Buffer Overflow

cve-program ·

Vendor product: eCatcher

CVSS 3.1 9.6Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28617Published

In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for explo…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28622Published

In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User intera…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2018-10624Published

Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Information

cve-program ·

Vendor product: Metasys System · Vendor product: BCPro (BCM)

CVSS 3.1 4.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28623Published

In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges need…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28627Published

In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed …

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88921Published

MISP: Unescaped HTML Injection in PDF Report Element Rendering

cve-program ·

Vendor product: MISP

CVSS 4.0 5.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-15461Published

Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 5.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88008Published

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

cve-program ·

Vendor product: traefik

CVSS 4.0 7.0Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87912Published

Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

cve-program ·

Vendor product: AWS Security Agent plugin

CVSS 3.1 5.9 · CVSS 4.0 5.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87913Published

Missing S3 bucket ownership verification in the AWS Security Agent MCP server

cve-program ·

Vendor product: AWS Security Agent MCP server

CVSS 3.1 5.9 · CVSS 4.0 5.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28630Published

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed f…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-45747Published

Suricata lua/tls: null dereference in TlsGetCertInfo

cve-program ·

Vendor product: suricata

CVSS 3.1 7.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28633Published

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User int…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28638Published

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction i…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87464Published

Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-86597Published

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be wr…

nvd ·

CVSS 3.1 · 412d305a-227d-44f9-a262-a31ba44f2aea · Secondary 6.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-86253Published

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e) are passed to decodeURI() and decoded t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Secondary 5.9Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-28660Published

In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for ex…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88018Published

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

cve-program ·

Vendor product: rclone

CVSS 3.1 9.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28671Published

In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed fo…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-45519Published

In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User intera…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88013Published

rclone: http backend forwards custom/auth headers to a different host on redirect

cve-program ·

Vendor product: rclone

CVSS 3.1 3.7Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88014Published

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

cve-program ·

Vendor product: rclone

CVSS 3.1 6.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-16481Published

Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool

cve-program ·

Vendor product: MCP Toolbox for Databases (googleapis/mcp-toolbox)

CVSS 4.0 6.0Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-54694Published

NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

cve-program ·

Vendor product: skills-service

CVSS 3.1 9.6Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88015Published

rclone local: crafted Range request against a translated symlink panics (DoS)

cve-program ·

Vendor product: rclone

CVSS 3.1 5.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-80354Published

Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace

cve-program ·

https://hub.docker.com: apache/camel-k

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-80351Published

Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod

cve-program ·

https://hub.docker.com: apache/camel-k

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87994Published

Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint

cve-program ·

Vendor product: open-webui

CVSS 3.1 4.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-80352Published

Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

cve-program ·

https://hub.docker.com: apache/camel-k

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-84939Published

Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks

cve-program ·

https://repo.maven.apache.org/maven2: org.freemarker:freemarker · https://repo.maven.apache.org/maven2: org.freemarker:freemarker-gae

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49362Published

Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-server · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-server

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49363Published

Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-server · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-server

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49364Published

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-core-client · https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-server · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-core-client

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-57822Published

Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-core-client · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-core-client

Source modified 10 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.