Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

695826 source statements · aliases may refer to the same vulnerability

CVE-2026-92989Published

SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing

cve-program ·

Vendor product: SendPress Newsletters

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-92990Published

SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token

cve-program ·

Vendor product: SendPress Newsletters

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-86850Published

SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion

cve-program ·

Vendor product: SKU Error Fixer for WooCommerce

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-88931Published

Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

cve-program ·

Vendor product: Social Web Suite

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-87841Published

UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook

cve-program ·

Vendor product: UnitechPay

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2025-15700Published

AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import

cve-program ·

Vendor product: AWP Classifieds

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106095Published

Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet

cve-program ·

Vendor product: Code Snippets

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106097Published

Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)

cve-program ·

Vendor product: Code Snippets

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-93548Published

FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation

cve-program ·

Vendor product: FooSales

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-11930Published

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

cve-program ·

Vendor product: Security Verify Access · Vendor product: Verify Identity Access · Vendor product: Security Verify Access Container

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-87980Published

Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 3.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-84891Published

Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 5.9Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-84247Published

IBM Guardium Data Protection is affected by multiple vulnerabilities.

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 8.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-84230Published

IBM Guardium Data Protection is affected by multiple vulnerabilities

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 7.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107828Published

Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login

cve-program ·

Vendor product: jivejdon

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-108107Published

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

cve-program ·

Vendor product: phpnuxbill

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-108102Published

Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE

cve-program ·

Vendor product: open5gs

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107707Published

Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction

cve-program ·

Vendor product: Intego Antivirus

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107793Published

Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107800Published

Jivejdon through 5.0 Stored XSS via Private Short Messages

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107797Published

Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107720Published

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

cve-program ·

Vendor product: fast-jwt

CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105269Published

Satel Netco Design Cross-site Scripting

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 8.5 · CVSS 3.1 6.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-84032Published

IBM Guardium Data Protection is affected by multiple vulnerabilities

cve-program ·

Vendor product: Guardium Data Protection

CVSS 3.1 5.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2023-22894Published

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API…

nvd ·

CVSS 3.1 · [email protected] · Primary 4.9 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.2Source modified 9 Oct 2026Recorded 24 Oct 2026

CVE-2026-103065Published

WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

cve-program ·

https://wordpress.org/plugins: kirki

CVSS 3.1 8.2Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107704Published

image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

cve-program ·

https://rubygems.org/gems/image_optimizer: image_optimizer

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107781Published

Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

cve-program ·

https://github.com/dromara/skyeye: skyeye

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107831Published

Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions

cve-program ·

Vendor product: jivejdon

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-46569Published

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is trig…

cve-program ·

Vendor product: n/a

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-106216Published

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium…

cve-program ·

Vendor product: Chrome

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2022-2946Published

Use After Free in vim/vim

cve-program ·

Vendor product: vim/vim

CVSS 3.0 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2022-2849Published

Heap-based Buffer Overflow in vim/vim

cve-program ·

Vendor product: vim/vim

CVSS 3.0 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2022-2845Published

Improper Validation of Specified Quantity in Input in vim/vim

cve-program ·

Vendor product: vim/vim

CVSS 3.1 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-100833Published

Contrast before 1.23.1 Image Substitution via Policy Generation

cve-program ·

Vendor product: contrast

CVSS 4.0 8.6 · CVSS 3.1 9.6Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-107715Published

Mechanize sends credential headers to another host after an HTTP redirect

cve-program ·

Vendor product: mechanize

CVSS 3.1 6.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-104628Published

Satel Netco Design Inefficient Regular Expression Complexity

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105275Published

Satel Netco Design Relative Path Traversal

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-11318Published

Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer

cve-program ·

Vendor product: DeskIn

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-101024Published

Satel Netco Design Relative path traversal

cve-program ·

Vendor product: Satel Netco Design

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105827Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105826Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105825Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105824Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105823Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105405Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105404Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105403Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105402Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

CVE-2026-105401Rejected

This CVE ID has been rejected as a duplicate.

cve-program ·

Source modified 9 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.