Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695275 source statements · aliases may refer to the same vulnerability

CVE-2026-72895Published

A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test ke…

cve-program ·

Vendor product: SIMATIC IPC BX-21A · Vendor product: SIMATIC IPC RW-543A · Vendor product: SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G

CVSS 3.1 7.7 · CVSS 4.0 8.4Source modified 14 Oct 2026Recorded 23 Oct 2026

GHSA-m6wq-39m7-9xppPublished

Metalama allows local code execution through DLL planting in shared temporary directories

osv · CVE-2026-62847

NuGet: Metalama.Framework · NuGet: Metalama.Tool · NuGet: Metalama.Framework

MODERATESource modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102073Published

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BAC…

cve-program ·

Vendor product: APOGEE MBC (PPC) (BACnet) · Vendor product: APOGEE MBC (PPC) (P2 Ethernet) · Vendor product: APOGEE MEC (PPC) (BACnet)

CVSS 3.1 8.2 · CVSS 4.0 8.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108395Published

Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

cve-program ·

Vendor product: io.modelcontextprotocol.sdk:mcp · Vendor product: io.modelcontextprotocol.sdk:mcp-core

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100122Published

CAI Content Credentials | Improper Certificate Validation (CWE-295)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2023-0361Published

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To a…

cve-program ·

Vendor product: gnutls

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-89201Published

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an au…

cve-program ·

Vendor product: RUGGEDCOM CROSSBOW

CVSS 3.1 7.5 · CVSS 4.0 7.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-78628Published

Improper Input Validation in the Okta Credential Provider for Windows

cve-program ·

Vendor product: Okta Credential Provider for Windows

CVSS 3.1 6.0Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-89196Published

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticat…

cve-program ·

Vendor product: RUGGEDCOM CROSSBOW

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-65198Published

Huawei Default SNMPv3 USM key

cve-program ·

Vendor product: openUBMC

CVSS 3.1 8.6Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-16301Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 8.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-78802Published

An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2023-0286Published

X.400 address type confusion in X.509 GeneralName

cve-program ·

Vendor product: OpenSSL

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2024-34320Published

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-104585Published

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-95121Published

An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unc…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2023-0215Published

The public API function BIO_new_NDEF is a helper function used for streaming

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 14 Oct 2026Recorded 24 Oct 2026

CVE-2026-103658Published

GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int…

cve-program ·

Vendor product: Aspell

CVSS 3.1 5.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100104Published

Server-Side Request Forgery (SSRF) in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 3.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-92883Published

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-92528Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-85529Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-14552Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-14210Published

Insufficient Granularity of Access Control in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2025-14273Published

Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions <=4.4.0 fail to enforce authentication and issue-key path restrictions in the Ji…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 8.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-15284Published

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.

nvd ·

CVSS 4.0 · 7ffcee3d-2c14-4c3e-b844-86c6a321a158 · Secondary 6.3 · CVSS 3.1 · 7ffcee3d-2c14-4c3e-b844-86c6a321a158 · Secondary 3.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-24890Published

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elev…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-65110Published

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, applications meeting two conditions are at risk of arbitrary JavaScript code execu…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · [email protected] · Primary 9.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-66648Published

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could b…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.2 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-68705Published

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-69255Published

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metrics to unwrap() failed deserialization of metric_type/opts, panicking the handler …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Primary 4.0Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-69262Published

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 7.8Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2025-69413Published

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-50288Published

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function returned without throwing, silently allowing the request to proceed without HTTP…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-50290Published

SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, CSS value sanitization stripped `expression(` and `url(javascript:` using simple regex, but could be bypassed with CSS unicode escapes (`\65xpression(…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-53541Published

OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-63004Published

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-63462Published

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErro…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-63466Published

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.1Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-71493Published

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel che…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-71494Published

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a co…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9Source modified 14 Oct 2026Recorded 25 Oct 2026

CVE-2026-9268Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 2.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-7767Published

URL Redirection to Untrusted Site ('Open Redirect') in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 5.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-16275Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-102054Published