Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

700900 source statements · aliases may refer to the same vulnerability

CVE-2026-27140Published

Code execution vulnerability in SWIG code generation in cmd/go

cve-program ·

https://pkg.go.dev: cmd/go

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-42154Published

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

cve-program ·

Vendor product: prometheus

CVSS 3.1 7.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-40860Published

Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.camel:camel-jms

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-42043Published

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

cve-program ·

Vendor product: axios

CVSS 3.1 7.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-42041Published

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

cve-program ·

Vendor product: axios

CVSS 3.1 4.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-42945Published

NGINX ngx_http_rewrite_module vulnerability

cve-program ·

Vendor product: NGINX Plus · Vendor product: NGINX Open Source

CVSS 3.1 8.1 · CVSS 4.0 9.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-48526Published

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

cve-program ·

Vendor product: pyjwt

CVSS 3.1 7.4Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-25896Published

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

cve-program ·

Vendor product: fast-xml-parser

CVSS 3.1 9.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-42044Published

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

cve-program ·

Vendor product: axios

CVSS 3.1 6.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2025-61732Published

Potential code smuggling via doc comments in cmd/cgo

cve-program ·

https://pkg.go.dev: cmd/cgo

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-44432Published

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

cve-program ·

Vendor product: urllib3

CVSS 4.0 8.9Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2025-62718Published

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

cve-program ·

Vendor product: axios

CVSS 4.0 6.3Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-28498Published

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

cve-program ·

Vendor product: authlib

CVSS 4.0 8.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-6322Published

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

cve-program ·

Vendor product: fast-uri

CVSS 3.1 7.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-46579Published

Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend

cve-program ·

https://catalog.redhat.com/software/containers/: openshift4/ose-haproxy-router · https://catalog.redhat.com/software/containers/: openshift4/ose-haproxy-router · https://catalog.redhat.com/software/containers/: openshift4/ose-haproxy-router

CVSS 3.1 7.4Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-40192Published

Pillow is vulnerable to a FITS GZIP decompression bomb

cve-program ·

Vendor product: Pillow

CVSS 4.0 8.7Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-18351Published

Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter

cve-program ·

Vendor product: Drag and Drop File Upload for Elementor Forms

CVSS 3.1 9.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-18796Published

QSPI flash encryption side-channel leakage

cve-program ·

Vendor product: nRF5340

CVSS 4.0 6.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-15820Published

Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting

cve-program ·

Vendor product: Builderall for WordPress

CVSS 3.1 6.4Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-76562Published

Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter

cve-program ·

Vendor product: Sidebar Manager Light

CVSS 3.1 7.2Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-78071Published

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

cve-program ·

Vendor product: DP Calendar extension for Joomla

CVSS 4.0 7.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-85546Published

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests

cve-program ·

Vendor product: misp

CVSS 4.0 8.6Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87804Rejected

no security impact

cve-program ·

Source modified 10 Sep 2026Recorded 23 Oct 2026

MAL-2026-16089Published

Malicious code in raydium-clmm-sdk (npm)

osv · GHSA-cq4p-x9wg-m5wv

npm: raydium-clmm-sdk

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16087Published

Malicious code in polygon-toolkits-validator (npm)

osv · GHSA-cmwm-j5px-xrpf

npm: polygon-toolkits-validator

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16088Published

Malicious code in pumpswap-sdk-v1 (npm)

osv · GHSA-5qr5-f8q7-r844

npm: pumpswap-sdk-v1

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16085Published

Malicious code in crypto-validates (npm)

osv · GHSA-v5v6-h869-g34f

npm: crypto-validates

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16115Published

Malicious code in etoro-billing (npm)

osv ·

npm: etoro-billing

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16116Published

Malicious code in etoro-builders (npm)

osv ·

npm: etoro-builders

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16120Published

Malicious code in etoro-core (npm)

osv ·

npm: etoro-core

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16113Published

Malicious code in etoro-api (npm)

osv ·

npm: etoro-api

Source modified 10 Sep 2026Recorded 24 Oct 2026

MAL-2026-16119Published

Malicious code in etoro-client (npm)

osv ·

npm: etoro-client

Source modified 10 Sep 2026Recorded 24 Oct 2026

CVE-2024-22373Published

An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a …

cve-program ·

Vendor product: Grassroot DICOM

CVSS 3.1 8.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-85384Published

Authenticated Stack-Based Buffer Overflow in RE210 AC750 Configuration Import

cve-program ·

Vendor product: RE210 AC750

CVSS 4.0 8.5Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-49883Published

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges nee…

cve-program ·

Vendor product: Wear

CVSS 4.0 10.0Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-19232Published

Adobe Experience Manager | Incorrect Authorization (CWE-863)

cve-program ·

Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 9.9Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-82053Published

Improper Session Handling in MongoDB Server LDAP Authorization Integration Leads to Incorrect Role Assignment

cve-program ·

Vendor product: MongoDB Server

CVSS 4.0 7.6 · CVSS 3.1 8.1Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-67401Published

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component

cve-program ·

Vendor product: cPanel

CVSS 3.0 9.9Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-85103Published

Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding

cve-program ·

Vendor product: Quantum Security Gateway · Vendor product: Quantum Security Management

CVSS 3.1 9.8Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87613Published

Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87628Published

Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87578Published

Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87514Published

Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87467Published

Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87554Published

Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87633Published

Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87457Published

Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87530Published

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87533Published

Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

CVE-2026-87509Published

Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 10 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.