Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694537 source statements · aliases may refer to the same vulnerability

CVE-2026-87837Published

Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

cve-program ·

Vendor product: Wava Payment Plugin

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-87838Published

Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

cve-program ·

Vendor product: Wava Payment Plugin

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-88784Published

Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting

cve-program ·

Vendor product: Translate WordPress with Weglot 2.0

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-92997Published

Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter

cve-program ·

Vendor product: Click n Chat (Chat Widget Integration)

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-92998Published

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters

cve-program ·

Vendor product: Click n Chat (Chat Widget Integration)

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-92999Published

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

cve-program ·

Vendor product: Click n Chat (Chat Widget Integration)

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-96901Published

Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token

cve-program ·

Vendor product: Cart Abandonment Recovery for WooCommerce

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-28318Published

SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

cve-program ·

Vendor product: Serv-U

CVSS 3.1 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-112834Published

WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: seriously-simple-podcasting

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-87689Published

Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints

cve-program ·

Vendor product: Metasploit Framework

CVSS 3.1 9.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-108496Published

WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-user-manager

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2025-26625Published

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outsid…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6Source modified 21 Oct 2026Recorded 25 Oct 2026

CVE-2026-101138Published

CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist

cve-program ·

https://wordpress.org/plugins: CMP – Coming Soon & Maintenance

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-103301Published

Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

cve-program ·

https://wordpress.org/plugins: Payment Gateway for Telcell

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-104641Published

Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient

cve-program ·

https://wordpress.org/plugins: Simple Shopping Cart

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-104642Published

Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass

cve-program ·

https://wordpress.org/plugins: Simple Shopping Cart

CVSS 3.1 2.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-105256Published

LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter

cve-program ·

https://wordpress.org/plugins: LatePoint

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-107447Published

Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity

cve-program ·

https://wordpress.org/plugins: Contest Gallery

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-14556Published

HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

cve-program ·

https://wordpress.org/plugins: HappyForms

CVSS 3.1 5.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-85683Published

Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL

cve-program ·

https://wordpress.org/plugins: Jane Menu

CVSS 3.1 8.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2025-26625Published

Git LFS may write to arbitrary files via crafted symlinks

cve-program ·

Vendor product: git-lfs

CVSS 4.0 8.6Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-6045Published

Heap buffer overflow in EMF+ gradient brush import

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 5.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2025-66178Published

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12,…

cve-program ·

Vendor product: FortiWeb

CVSS 3.1 6.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-14618Published

Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service

cve-program ·

Vendor product: Open5GS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-10157Published

Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication

cve-program ·

Vendor product: Open5GS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-8743Published

Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization

cve-program ·

Vendor product: Open5GS

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-10565Published

Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition

cve-program ·

Vendor product: Open5GS

CVSS 4.0 2.3 · CVSS 3.1 3.1 · CVSS 3.0 3.1 · CVSS 2.0 2.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-56449Published

Apache HTTP Server: mod_proxy_html: crash in dump_content

cve-program ·

Vendor product: Apache HTTP Server

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-110927Rejected

CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585.

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-110926Rejected

CVE-2026-110926 has been marked as a duplicate of CVE-2026-106582.

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-110925Rejected

CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583.

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-110924Rejected

CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553.

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-110923Rejected

CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552.

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2025-68045Published

WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: wp-event-solution

CVSS 3.1 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-101296Published

Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

cve-program ·

Vendor product: Apache Tomcat

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-16487Rejected

Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches images under /etc/containers/policy.json. The shipped default is insecureAcceptAnything for registries without an explicit…

cve-program ·

Source modified 21 Oct 2026Recorded 23 Oct 2026

MAL-2026-4565Published

Malicious code in fnd-stores (npm)

osv · GHSA-wx9h-pmqq-rcgg

npm: fnd-stores

Source modified 21 Oct 2026Recorded 24 Oct 2026

MAL-2026-13930Published

Malicious code in @dreamguyxeon/baileyx (npm)

osv · GHSA-94fw-5xp7-q2xq

npm: @dreamguyxeon/baileyx

Source modified 21 Oct 2026Recorded 24 Oct 2026

CVE-2026-106931Published

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

cve-program ·

Vendor product: SiteGuard Server Edition for Apache httpd · Vendor product: SiteGuard Server Edition for Nginx · Vendor product: SiteGuard Server Edition for IIS

CVSS 3.0 7.8 · CVSS 4.0 8.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-96652Published

Plex Media Server SSRF

cve-program ·

Vendor product: Media Server

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-96654Published

Plex Media Server URL injection

cve-program ·

Vendor product: Media Server

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-96655Published

Plex Media Server arbitrary-host SSRF

cve-program ·

Vendor product: Media Server

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-86471Published

Apache CouchDB: Admin credentials leading to code execution as operating system user

cve-program ·

Vendor product: Apache CouchDB

CVSS 4.0 9.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-76740Published

HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers, Remote Command Execution vulnerability

cve-program ·

Vendor product: HPE Compute Scale-up Server 3200 platform · Vendor product: HPE Compute Scale-up Server 3250 platform · Vendor product: HPE Superdome Flex server

CVSS 3.1 7.2Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-110936Published

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to pla…

cve-program ·

Vendor product: Siemens Software Center

CVSS 3.1 6.7 · CVSS 4.0 8.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-86949Published

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.

cve-program ·

Vendor product: Xcode

Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-107366Published

Langflow OSS Authorization Bypass Through User-Controlled Key

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 8.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-105453Published

IBM Sterling Connect:Direct for Unix Improper Privilege Management

cve-program ·

Vendor product: Sterling Connect Direct for Unix

CVSS 3.1 8.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-102438Published

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.

cve-program ·

Vendor product: Armoury Crate · Vendor product: Armoury Crate SE

CVSS 4.0 8.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-96656Published

Plex Media Server arbitrary file write

cve-program ·

Vendor product: Media Server

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 21 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.