Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695782 source statements · aliases may refer to the same vulnerability

CVE-2026-87761Published

Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings

cve-program ·

Vendor product: Adwised Web Push Notification

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-87762Published

Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling

cve-program ·

Vendor product: Adwised Web Push Notification

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-87764Published

BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message

cve-program ·

Vendor product: BuddyPress Instant Chat

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-88785Published

Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String

cve-program ·

Vendor product: Simple Membership

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-88826Published

SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums

cve-program ·

Vendor product: SmugMug Embed

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-88827Published

Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

cve-program ·

Vendor product: Disable Users

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-88903Published

Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook

cve-program ·

Vendor product: Topcontent

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-88905Published

KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings

cve-program ·

Vendor product: KeyWord Collector

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-88930Published

Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret

cve-program ·

Vendor product: Social Web Suite

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89195Published

Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists

cve-program ·

Vendor product: Site Setup Wizard

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89213Published

Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter

cve-program ·

Vendor product: Llavero.io

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89214Published

WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission

cve-program ·

Vendor product: WpCues Basic Quiz

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89232Published

RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter

cve-program ·

Vendor product: Recordbrowser

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89234Published

WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter

cve-program ·

Vendor product: WP-Partner

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89283Published

WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite

cve-program ·

Vendor product: WP Posts Password Batch Manager

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89285Published

Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action

cve-program ·

Vendor product: Datalist it

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89287Published

ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter

cve-program ·

Vendor product: ASPL Product Quotation

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89297Published

Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter

cve-program ·

Vendor product: Loja Automática

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89299Published

WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter

cve-program ·

Vendor product: WP Verify API

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89302Published

Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter

cve-program ·

Vendor product: Post Voting System

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89304Published

Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter

cve-program ·

Vendor product: paymendo

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-89305Published

Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter

cve-program ·

Vendor product: paymendo

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-91829Published

Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter

cve-program ·

Vendor product: Subscribe to Comments

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-93550Published

Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_process

cve-program ·

Vendor product: Veeqo for WooCommerce

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-96227Published

Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload

cve-program ·

Vendor product: Piotnet Forms

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-97183Published

WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers

cve-program ·

Vendor product: WP-Invoice

Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2024-1525Published

Authentication Bypass Using an Alternate Path or Channel in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 5.3Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2023-5963Published

Allocation of Resources Without Limits or Throttling in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 3.1Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2023-5831Published

Insertion of Sensitive Information Into Sent Data in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 3.7Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-82049Published

tarfile extraction filters allow file modification and content disclosure via hard link to symlink

cve-program ·

Vendor product: CPython

CVSS 4.0 8.4Source modified 11 Oct 2026Recorded 23 Oct 2026

CVE-2026-104841Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2025-8787Published

Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting

cve-program ·

Vendor product: i-Diario

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2025-8786Published

Portabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scripting

cve-program ·

Vendor product: i-Diario

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2025-8511Published

Portabilis i-Diario Observações diario-de-observacoes cross site scripting

cve-program ·

Vendor product: i-Diario

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-84272Published

IBM Guardium Data Protection Missing Authentication

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 9.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-78401Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 9.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-19494Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 8.1Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-19491Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 9.1Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-16916Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 9.1Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-82900Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 8.1Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-78020Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading …

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 7.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-78026Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerab…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 4.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-78341Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevat…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 6.5Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-14991Published

IBM DataPower Gateway Out-of-bounds Write

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 9.8Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-78023Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerab…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 7.1Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-76769Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation …

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 4.3Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-11888Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 6.4Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-104752Published

Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

cve-program ·

Vendor product: Rank Math SEO

Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-104753Published

Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter

cve-program ·

Vendor product: Rank Math SEO

Source modified 10 Oct 2026Recorded 23 Oct 2026

CVE-2026-104754Published

Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL

cve-program ·

Vendor product: Rank Math SEO

Source modified 10 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.