Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700896 source statements · aliases may refer to the same vulnerability

CVE-2026-80352Published

Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

cve-program ·

https://hub.docker.com: apache/camel-k

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-84939Published

Apache FreeMarker, Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks

cve-program ·

https://repo.maven.apache.org/maven2: org.freemarker:freemarker · https://repo.maven.apache.org/maven2: org.freemarker:freemarker-gae

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49362Published

Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-server · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-server

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49363Published

Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-server · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-server

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49364Published

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-core-client · https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-server · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-core-client

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-57822Published

Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-core-client · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-core-client

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-53956Published

Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package m…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-88273Published

GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 7.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-67593Published

Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-openwire-protocol · https://repo.maven.apache.org/maven2: org.apache.artemis:artemis-jakarta-openwire-protocol · https://repo.maven.apache.org/maven2: org.apache.activemq:artemis-openwire-protocol

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-85528Published

Snowflake JDBC Driver auto-configuration account validation permits credential redirection

cve-program ·

https://repo.maven.apache.org/maven2: net.snowflake:snowflake-jdbc · https://repo.maven.apache.org/maven2: net.snowflake:snowflake-jdbc-fips · https://repo.maven.apache.org/maven2: net.snowflake:snowflake-jdbc-thin

CVSS 3.1 5.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88274Published

GV-LPC2011/LPC2211 - Wireless SSID Command Injection

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 7.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-82659Published

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href prope…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 7.1Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-82660Published

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-82661Published

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF seque…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 5.4Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-82662Published

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth cl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-82853Published

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 4.9Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-85525Published

Improper OCSP response validation in Snowflake drivers

cve-program ·

https://pypi.org: snowflake-connector-python · https://pkg.go.dev: github.com/snowflakedb/gosnowflake · https://pkg.go.dev: github.com/snowflakedb/gosnowflake/v2

CVSS 3.1 7.4Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-45521Published

In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed …

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-84195Published

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall r…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 7.7Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-84196Published

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers ca…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 7.7Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-84200Published

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the polic…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Secondary 9.0Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-45525Published

In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for explo…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-45527Published

In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. U…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88275Published

GV-LPC2011/LPC2211 - Wireless WPA-PSK Command Injection

cve-program ·

Vendor product: GV-LPC2011/LPC2211

CVSS 3.1 7.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49895Published

In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-55290Published

In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exp…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87013Published

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

cve-program ·

Vendor product: open-webui

CVSS 3.1 4.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-55256Published

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not ne…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88009Published

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

cve-program ·

Vendor product: traefik

CVSS 4.0 8.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88276Published

GV-LPCLPC2011/2211 - Wireless WEP Key1-Key4 Command Injection

cve-program ·

Vendor product: GV-LPCLPC2011/2211

CVSS 3.1 7.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87649Published

UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88007Published

Traefik HTTP/3 Backend NTLM Connection Reuse

cve-program ·

Vendor product: traefik

CVSS 4.0 9.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87548Published

Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-86597Published

Sensitive information written to logs by Snowflake drivers

cve-program ·

https://pypi.org: snowflake-connector-python · https://pkg.go.dev: github.com/snowflakedb/gosnowflake · https://pkg.go.dev: github.com/snowflakedb/gosnowflake/v2

CVSS 3.1 6.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87503Published

Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severit…

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87557Published

Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity…

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87999Published

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

cve-program ·

Vendor product: open-webui

CVSS 3.1 7.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87433Published

Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87606Published

Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87446Published

Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87515Published

Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87640Published

Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: …

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88278Published

GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay

cve-program ·

Vendor product: GV-LPCLPC2011/2211

CVSS 3.1 9.8Source modified 10 Sep 2026Recorded 23 Oct 2026

GHSA-34ff-336r-5q23Published

n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node

osv · CVE-2026-86082

npm: n8n · npm: n8n · npm: n8n

HIGHSource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-j535-v25q-vx3qPublished

n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

osv · CVE-2026-86081

npm: n8n · npm: n8n · npm: n8n

HIGHSource modified 10 Sep 2026Recorded 24 Oct 2026

CVE-2026-87499Published

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87552Published

Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87569Published

Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

GHSA-v7ph-r5r6-4jcjPublished

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

osv · CVE-2026-72808 · GO-2026-6406

Go: github.com/siyuan-note/siyuan/kernel

MODERATESource modified 10 Sep 2026Recorded 24 Oct 2026

GHSA-2v6v-25fm-p4fgPublished

SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control

osv · BIT-seaweedfs-2026-72920 · CVE-2026-72920 · GO-2026-6351

Go: github.com/seaweedfs/seaweedfs

CRITICALSource modified 10 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.