Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695749 source statements · aliases may refer to the same vulnerability

CVE-2026-17475Published

IBM Planning Analytics Local is affected by security vulnerabilities

cve-program ·

Vendor product: Planning Analytics

CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-93892Published

Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console

cve-program ·

Vendor product: TRIRIGA Application Platform

CVSS 3.1 8.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-75095Published

IBM Aspera Enterprise Webapps Denial of Service

cve-program ·

Vendor product: Aspera Enterprise WebApps

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-93886Published

IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI

cve-program ·

Vendor product: i

CVSS 3.1 8.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-58242Published

Improper Authorization check in SAP Cloud Connector

cve-program ·

Vendor product: SAP Cloud Connector

CVSS 3.1 3.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-58249Published

Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

cve-program ·

Vendor product: SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

CVSS 3.1 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-76972Published

Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence

cve-program ·

Vendor product: SAP Manufacturing Integration and Intelligence

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-76975Published

Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)

cve-program ·

Vendor product: SAPUI5 (Support Assistant Overlay)

CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-76976Published

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

cve-program ·

Vendor product: SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89105Published

Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library

cve-program ·

Vendor product: SAP/cloud-security-services-integration-library

CVSS 3.1 4.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89106Published

Cross Site Scripting (XSS) vulnerability in SAPUI5

cve-program ·

Vendor product: SAPUI5

CVSS 3.1 4.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89108Published

Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)

cve-program ·

Vendor product: SAP Manufacturing Integration and Intelligence (Configuration Service)

CVSS 3.1 9.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89112Published

Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure

cve-program ·

Vendor product: CLA-Assistant

CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89116Published

OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

cve-program ·

Vendor product: SAP yeoman-ui

CVSS 3.1 5.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89117Published

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

cve-program ·

Vendor product: SAP NetWeaver Enterprise Portal

CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89118Published

Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal

cve-program ·

Vendor product: SAP NetWeaver Enterprise Portal

CVSS 3.1 5.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89120Published

Missing authorization check in SAP ABAP Platform

cve-program ·

Vendor product: SAP ABAP Platform

CVSS 3.1 7.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89121Published

Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)

cve-program ·

Vendor product: SAP S/4HANA (Linear Asset Management RAP Business Object)

CVSS 3.1 4.7Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89122Published

Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal

cve-program ·

Vendor product: SAP NetWeaver Enterprise Portal

CVSS 3.1 6.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-89124Published

Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)

cve-program ·

Vendor product: SAP HANA (Display Product Catalog Based on Customs Declaration)

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-6567Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-5954Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 4.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108740Published

GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

cve-program ·

Vendor product: GoatCounter

CVSS 4.0 7.2 · CVSS 3.1 8.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108960Published

Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create_striped_mat_to_gpu out-of-bounds

cve-program ·

Vendor product: PowerInfer

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108965Published

SourceCodester Performance Indicator System edit_quantity.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108969Published

itsmeravitejak Online-Examination-System Session session.php checkLogin comparison

cve-program ·

Vendor product: Online-Examination-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108973Published

SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload

cve-program ·

Vendor product: Contact Tracing System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108956Published

code-projects Online Reviewer System User Update btn_functions.php sql injection

cve-program ·

Vendor product: Online Reviewer System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108735Published

Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL

cve-program ·

Vendor product: miniflux

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108947Published

yoshitomo-matsubara torchdistill main_util.py load_ckpt deserialization

cve-program ·

Vendor product: torchdistill

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108942Published

philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting

cve-program ·

Vendor product: clarity-upscaler

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-73642Published

Path Traversal in Dayforce ESS Excelity

cve-program ·

Vendor product: ESS Excelity

CVSS 4.0 9.2Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-73641Published

Multiple Reflected XSS in Dayforce ESS Excelity

cve-program ·

Vendor product: ESS Excelity

CVSS 4.0 5.1Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108730Published

Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs

cve-program ·

Vendor product: raven

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-73640Published

Time-based SQL Injection in Dayforce ESS Excelity

cve-program ·

Vendor product: ESS Excelity

CVSS 4.0 9.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109107Published

Wavlink WL-WN592AX6 upload.cgi main null pointer dereference

cve-program ·

Vendor product: WL-WN592AX6

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108725Published

Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin

cve-program ·

Vendor product: core

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108720Published

phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages

cve-program ·

Vendor product: phpipam

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-15399Published

Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter

cve-program ·

Vendor product: Animated Number Counters

CVSS 3.1 4.9Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109114Published

AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication

cve-program ·

Vendor product: Restaurant-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109155Published

DeepPavlov Model Download untar path traversal

cve-program ·

Vendor product: DeepPavlov

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108715Published

LibreNMS through 26.9.1.1 Authorization Bypass via Smokeping Graph auth.inc.php

cve-program ·

Vendor product: librenms

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109144Published

wbond certvalidator Certificate Path Builder resource consumption

cve-program ·

Vendor product: certvalidator

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108710Published

NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints

cve-program ·

Vendor product: NornicDB

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-107225Published

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction predicates check only upper bounds for attacker-controlled style-table indices. File.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 13 Oct 2026Recorded 25 Oct 2026

CVE-2026-109189Published

fit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout server-side request forgery

cve-program ·

Vendor product: MeterSphere

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108574Published

BerriAI LiteLLM Spend Tracking spend_management_endpoints.py ui_view_session_spend_logs authorization

cve-program ·

Vendor product: LiteLLM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-109404Published

conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery

cve-program ·

Vendor product: conductor

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108570Published

Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine

cve-program ·

Vendor product: .NET Framework

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 13 Oct 2026Recorded 23 Oct 2026

CVE-2026-108566Published

InstantSoft icms2 Private Message index.tpl.php index cross site scripting

cve-program ·

Vendor product: icms2

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 13 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.