Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690463 source statements · aliases may refer to the same vulnerability

CVE-2019-25733Published

NetShareWatcher 1.5.8.0 SEH Buffer Overflow

cve-program ·

Vendor product: NetShareWatcher

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25712Published

BlueAuditor 1.7.2.0 Buffer Overflow Denial of Service via Registration Key

cve-program ·

Vendor product: BlueAuditor

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25705Published

Echo Mirage 3.1 Stack Buffer Overflow via Rules Action Field

cve-program ·

Vendor product: Echo Mirage

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25654Published

Core FTP/SFTP Server 1.2 Denial of Service via Buffer Overflow

cve-program ·

Vendor product: Core FTP/SFTP Server

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25276Published

Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path

cve-program ·

Vendor product: Studio

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25269Published

Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability

cve-program ·

Vendor product: Amiti Antivirus

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-97028Rejected

Maintainers determined it is not a vulnerability.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116838Published

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.

cve-program ·

Vendor product: airMAX M

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116837Published

A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.

cve-program ·

Vendor product: airMAX M · Vendor product: LTU PTMP · Vendor product: LTU PTP

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2018-25254Published

NICO-FTP 3.0.1.19 Buffer Overflow SEH

cve-program ·

Vendor product: NICO-FTP

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2017-20284Published

Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet

cve-program ·

Vendor product: Resin

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2017-20252Published

Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter

cve-program ·

Vendor product: NextGen Editor

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2016-20097Published

Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad

cve-program ·

Vendor product: E-cology 8.0

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2016-20058Published

Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation

cve-program ·

Vendor product: NETGATE AMITI Antivirus

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2016-20057Published

NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation

cve-program ·

Vendor product: NETGATE Registry Cleaner

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20120Published

RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20119Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20118Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via location_name Parameter

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20117Published

RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20116Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20115Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload Parameter

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20114Published

RealtyScript 4.0.2 Cross-Site Scripting via Multiple Parameters

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20113Published

RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-114583Published

tar filter allows writing outside destination via empty-named symlink

cve-program ·

Vendor product: CPython

CVSS 4.0 6.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-115557Published

Distrust compromised intermediate certificates in ssl module

cve-program ·

Vendor product: CPython

CVSS 4.0 9.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116843Published

Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode

cve-program ·

Vendor product: mistral-vibe

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116841Published

DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup

cve-program ·

Vendor product: DevilutionX

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116829Published

llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 6.9 · CVSS 3.1 6.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-71439Published

llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2024-58399Published

llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116836Published

A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.

cve-program ·

Vendor product: airMAX M

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-60467Published

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

cve-program ·

Vendor product: n/a

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116608Published

DAMO Academy VideoLLaMA2 Model Loading init.py load_pretrained_model integrity check

cve-program ·

Vendor product: VideoLLaMA2

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112415Published

An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112646Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt pro…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-84496Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel…

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113939Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113943Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113907Published

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112457Published

A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination …

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112708Published

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112544Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a malicious disk image may cause unexpected system termination.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113913Published

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processi…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86971Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Proces…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112614Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112634Published

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112633Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciou…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112629Published

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112471Published

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may lead to unexpected process termination.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116603Published

SourceCodester Online Food Ordering System add_food.php unrestricted upload

cve-program ·

Vendor product: Online Food Ordering System

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.