Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

692053 source statements · aliases may refer to the same vulnerability

CVE-2026-0993Published

SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser

cve-program ·

Vendor product: SL902-SWTGW124AS

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2023-54402Published

iDocView SSRF via /doc/upload Endpoint Hardcoded Token

cve-program ·

Vendor product: iDocView

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2023-54328Published

AimOne Video Converter 2.04 Build 103 Buffer Overflow in Registration Form

cve-program ·

Vendor product: AimOne Video Converter

CVSS 4.0 5.1 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2022-50926Published

WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

cve-program ·

Vendor product: WAGO 750-8212 PFC200

CVSS 4.0 8.7 · CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2021-47802Published

Tenda D151 & D301 - Configuration Download

cve-program ·

Vendor product: Tenda D151 & D301

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2020-37281Published

Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass

cve-program ·

Vendor product: Gravitee API Management

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2020-37202Published

NetworkSleuth 3.0.0.0 - 'Key' Denial of Service

cve-program ·

Vendor product: Nsauditor NetworkSleuth

CVSS 4.0 4.6 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2020-37201Published

NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service

cve-program ·

Vendor product: Nsauditor NetShareWatcher

CVSS 4.0 4.6 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2020-37200Published

NetShareWatcher 1.5.8.0 - 'Key' Denial of Service

cve-program ·

Vendor product: Nsauditor NetShareWatcher

CVSS 4.0 4.6 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25776Published

Weaver E-cology SQL Injection via SyncUserInfo.jsp

cve-program ·

Vendor product: E-cology

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25765Published

ASP-CMS SQL Injection via commentList.asp id Parameter

cve-program ·

Vendor product: ASP-CMS

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25733Published

NetShareWatcher 1.5.8.0 SEH Buffer Overflow

cve-program ·

Vendor product: NetShareWatcher

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25712Published

BlueAuditor 1.7.2.0 Buffer Overflow Denial of Service via Registration Key

cve-program ·

Vendor product: BlueAuditor

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25705Published

Echo Mirage 3.1 Stack Buffer Overflow via Rules Action Field

cve-program ·

Vendor product: Echo Mirage

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25654Published

Core FTP/SFTP Server 1.2 Denial of Service via Buffer Overflow

cve-program ·

Vendor product: Core FTP/SFTP Server

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25276Published

Studio 5000 Logix Designer 30.01.00 - 'FactoryTalk Activation Service' Unquoted Service Path

cve-program ·

Vendor product: Studio

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2019-25269Published

Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability

cve-program ·

Vendor product: Amiti Antivirus

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-97028Rejected

Maintainers determined it is not a vulnerability.

cve-program ·

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2018-25254Published

NICO-FTP 3.0.1.19 Buffer Overflow SEH

cve-program ·

Vendor product: NICO-FTP

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2017-20284Published

Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet

cve-program ·

Vendor product: Resin

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2017-20252Published

Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter

cve-program ·

Vendor product: NextGen Editor

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2016-20097Published

Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad

cve-program ·

Vendor product: E-cology 8.0

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2016-20058Published

Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation

cve-program ·

Vendor product: NETGATE AMITI Antivirus

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2016-20057Published

NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation

cve-program ·

Vendor product: NETGATE Registry Cleaner

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20120Published

RealtyScript 4.0.2 Multiple Time-based Blind SQL Injection

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20119Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20118Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via location_name Parameter

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20117Published

RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User Creation

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20116Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload Filename

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20115Published

RealtyScript 4.0.2 Stored Cross-Site Scripting via File Upload Parameter

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20114Published

RealtyScript 4.0.2 Cross-Site Scripting via Multiple Parameters

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2015-20113Published

RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting Vulnerabilities

cve-program ·

Vendor product: RealtyScript

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116841Published

DevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup

cve-program ·

Vendor product: DevilutionX

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-71439Published

llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-60467Published

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

cve-program ·

Vendor product: n/a

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112415Published

An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112646Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, visionOS 27.2. An app may be able to cause unexpected system termination or corrupt pro…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-84496Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel…

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113939Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113943Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113907Published

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112457Published

A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination …

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112708Published

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112544Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a malicious disk image may cause unexpected system termination.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113913Published

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processi…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86971Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Proces…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112614Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2. Processing a maliciously crafted image may …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112634Published

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112633Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciou…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112629Published

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.