Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695613 source statements · aliases may refer to the same vulnerability

CVE-2026-75826Published

Teltonika Command Injection in Backup function

cve-program ·

Vendor product: RUT · Vendor product: RUTX · Vendor product: RUTM

CVSS 4.0 8.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-67165Published

HCL Connections is vulnerable to cross-site scripting (XSS)

cve-program ·

Vendor product: Connections

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-65197Published

H3C G3/G5 HDM Firmware Verification Key Replacement

cve-program ·

Vendor product: HDM Family-A G5

CVSS 3.1 3.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-65199Published

Huawei openUBMC low-privilege SNMP to administrator privilege escalation

cve-program ·

Vendor product: openBMC

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-91013Published

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source

CVSS 3.1 9.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-65200Published

Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short MCTP responses

cve-program ·

Vendor product: openBMC

CVSS 3.1 3.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-18228Published

Hyperscale Path Traversal

cve-program ·

Vendor product: Commvault Cloud

CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110075Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-77090Published

CVFS Information Disclosure

cve-program ·

Vendor product: Commvault Cloud · Vendor product: Grid(HSX) CVFS

CVSS 4.0 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-92911Published

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source

CVSS 3.1 8.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110080Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-77093Published

CvFWD Denial of Service

cve-program ·

Vendor product: Commvault Cloud

CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-77094Published

CvFWD Out-of-Bounds Write

cve-program ·

Vendor product: Commvault Cloud

CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-106631Published

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-77095Published

CvFWD Null Pointer Dereference

cve-program ·

Vendor product: Commvault Cloud

CVSS 4.0 7.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-77096Published

CVFS Missing Authentication

cve-program ·

Vendor product: Commvault Cloud · Vendor product: Grid(HSX) CVFS

CVSS 4.0 7.7Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-109412Published

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

cve-program ·

Vendor product: Neurons Patch for Intune

CVSS 3.1 9.9Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107606Published

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

cve-program ·

Vendor product: SWIFI-SE2KIC

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107607Published

Missing authentication for critical function in Swann Communications SWIFI-SE2KIC

cve-program ·

Vendor product: SWIFI-SE2KIC

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107682Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-59725Published

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

cve-program ·

Vendor product: engine.io

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100125Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 5.9Source modified 14 Oct 2026Recorded 23 Oct 2026

MAL-2026-17876Published

Malicious code in @xxxfnbs21/hello-demo (npm)

osv · GHSA-hf57-6wg3-343x

npm: @xxxfnbs21/hello-demo

Source modified 14 Oct 2026Recorded 24 Oct 2026

CVE-2022-48829Published

NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 9.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-48828Published

NFSD: Fix ia_size underflow

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 9.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-48827Published

NFSD: Fix the behavior of READ near OFFSET_MAX

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-48522Published

In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-48303Published

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-83958Published

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

cve-program ·

Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-19810Published

Cross-Site Scripting (XSS) in Symantec Endpoint Detection and Response Console

cve-program ·

Vendor product: Symantec Endpoint Detection and Response

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107369Published

Improper Validation of Post-Login Redirect URL in nextjs-auth0

cve-program ·

Vendor product: nextjs-auth0

CVSS 3.1 6.1Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107370Published

Improper Request Handling for Active Directory Logins in auth0-lock

cve-program ·

Vendor product: auth0-lock

CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-107371Published

Missing Verification of auth_time Claim in auth0.js

cve-program ·

Vendor product: auth0.js

CVSS 3.1 5.4Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-78632Published

Insecure Default File Permissions in Okta RADIUS Agent Windows Installer

cve-program ·

Vendor product: Okta RADIUS Agent

CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-47946Published

An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occ…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-47929Published

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc …

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-14532Published

IBM WebSphere Application Server Liberty Integer Overflow

cve-program ·

Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 4.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100120Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-47520Published

An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-47518Published

An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copy…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-46908Published

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-45873Published

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object in shared/elf-util.c. The exploitation methodology is to crash a binary calling t…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2022-45061Published

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder co…

cve-program ·

Vendor product: n/a

Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100115Published

CAI Content Credentials | Improper Access Control (CWE-284)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-93905Published

IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data

cve-program ·

Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 8.2Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-69227Published

BUG-000187331 Portal for ArcGIS has a security vulnerability

cve-program ·

Vendor product: Portal for ArcGIS

CVSS 3.1 9.8Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-48377Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 5.3Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-108388Published

Indico legacy contribution export cache poisoning discloses restricted metadata

cve-program ·

Vendor product: indico

CVSS 3.1 3.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-100117Published

CAI Content Credentials | Improper Input Validation (CWE-20)

cve-program ·

Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK

CVSS 3.1 7.5Source modified 14 Oct 2026Recorded 23 Oct 2026

CVE-2026-110655Published

miniupnpc through 2.3.3 Heap Out-of-Bounds Read via minixml parseatt

cve-program ·

https://github.com/miniupnp/miniupnp: miniupnpc

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 14 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.