Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700899 source statements · aliases may refer to the same vulnerability

CVE-2026-88069Published

Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

cve-program ·

Vendor product: pandora

CVSS 4.0 9.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-88001Published

Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

cve-program ·

Vendor product: open-webui

CVSS 3.1 5.0Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49879Published

In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49881Published

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49882Published

In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploi…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-18594Published

Advanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'

cve-program ·

Vendor product: Advanced Contact form 7 DB

CVSS 3.1 4.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-15019Published

Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment

cve-program ·

Vendor product: Direct Download for WooCommerce

CVSS 3.1 7.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49884Published

In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49887Published

In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. Use…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49918Published

In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49919Published

In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f…

cve-program ·

Vendor product: Android

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-17523Published

can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 7.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-9697Published

Impact:

nvd ·

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 7.4 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.4Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-7374Published

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.9Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-6734Published

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 8.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-4602Published

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7 · CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-4601Published

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 9.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.7Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-4600Published

Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.1 · CVSS 3.1 · [email protected] · Secondary 7.4 · CVSS 3.1 · [email protected] · Primary 9.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.2Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-4599Published

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.1Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-4598Published

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the p…

nvd ·

CVE-2026-41674Published

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-32286Published

The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow message with a negative field length, causing a slice bounds out of range panic.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-29074Published

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML wi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-27606Published

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure fil…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.1Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-27140Published

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

nvd ·

CVSS 3.1 · [email protected] · Primary 8.8 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 8.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 9.0Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-26278Published

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of enti…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-25896Published

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard du…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.3 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.1Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-25639Published

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-22029Published

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.0 · CVSS 3.1 · [email protected] · Primary 6.1 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.0Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-42808Published

An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.

cve-program ·

Vendor product: COINES_SDK

CVSS 3.1 6.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2025-69873Published

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 2.9 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-87803Published

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it throug…

cve-program ·

Vendor product: countly-server

CVSS 3.1 7.1 · CVSS 4.0 7.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2025-61732Published

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 8.6 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.4Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2025-61731Published

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to th…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.8 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 8.6Source modified 10 Sep 2026Recorded 25 Oct 2026

CVE-2026-19436Published

Ultimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted Purchase

cve-program ·

Vendor product: Ultimate Gift Cards for WooCommerce

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-19439Published

Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

cve-program ·

Vendor product: Ultimate Gift Cards for WooCommerce

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-19840Published

Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

cve-program ·

Vendor product: Notiqoo

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-77770Published

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

cve-program ·

Vendor product: miniOrange 2FA · Vendor product: miniOrange 2FA

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-76202Published

Adobe Commerce | Incorrect Authorization (CWE-863)

cve-program ·

Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source

CVSS 3.1 8.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-77771Published

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

cve-program ·

Vendor product: miniOrange 2FA · Vendor product: miniOrange 2FA

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-78361Published

zipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion

cve-program ·

Vendor product: zipMoney(Zip Co) Payments Plugin for WooCommerce

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-81431Published

Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

cve-program ·

Vendor product: Registration Form for WooCommerce

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-82925Published

Site Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form Signature

cve-program ·

Vendor product: Site Reviews

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-75993Published

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

cve-program ·

Vendor product: ColdFusion 2025 · Vendor product: ColdFusion 2023

CVSS 3.1 8.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-76190Published

ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

cve-program ·

Vendor product: ColdFusion 2025 · Vendor product: ColdFusion 2023

CVSS 3.1 8.6Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-81992Published

Acrobat Reader | Heap-based Buffer Overflow (CWE-122)

cve-program ·

Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024

CVSS 3.1 7.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-80161Published

Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)

cve-program ·

Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024

CVSS 3.1 7.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-81987Published

Acrobat Reader | Integer Overflow or Wraparound (CWE-190)

cve-program ·

Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024

CVSS 3.1 7.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-0306Published

Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows

cve-program ·

Vendor product: Prisma Access Agent · Vendor product: Prisma Access Agent

CVSS 4.0 5.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-0305Published

Prisma Access Agent: Information Disclosure Vulnerability on Linux

cve-program ·

Vendor product: Prisma Access Agent · Vendor product: Prisma Access Agent

CVSS 4.0 4.3Source modified 10 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.