Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

696049 source statements · aliases may refer to the same vulnerability

CVE-2026-107640Published

Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API

cve-program ·

Vendor product: Enswitch

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107677Published

FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media

cve-program ·

Vendor product: FFmpeg

CVSS 4.0 5.7 · CVSS 3.1 4.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-14496Published

IBM DataPower Gateway Out-of-bounds Read

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-14509Published

IBM DataPower Gateway Denial of Service

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106198Published

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106326Published

Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106361Published

Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security s…

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-15822Published

IBM DataPower Gateway Denial of Service

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93988Published

QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

cve-program ·

Vendor product: qloapps

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93452Published

snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress

cve-program ·

https://repo1.maven.org/maven2/org/xerial/snappy-java/: snappy-java

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-93451Published

snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

cve-program ·

https://repo1.maven.org/maven2/org/xerial/snappy-java/: snappy-java

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-92298Published

EspoCRM through 10.0.8 Weak Token Generation via rand()

cve-program ·

Vendor product: EspoCRM

CVSS 3.1 4.8 · CVSS 4.0 6.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-90559Published

snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

cve-program ·

https://repo1.maven.org/maven2/org/xerial/snappy-java/: snappy-java

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-88877Published

Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

cve-program ·

Vendor product: traefik

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-87807Published

siyuan before v3.8.2 SQL Injection via fullTextSearchBlock

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85597Published

Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict

cve-program ·

Vendor product: traefik · Vendor product: traefik

CVSS 4.0 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85596Published

Traefik v3.7 Authentication Bypass via TLS Option Conflict

cve-program ·

Vendor product: traefik

CVSS 4.0 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85595Published

Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

cve-program ·

Vendor product: traefik · Vendor product: traefik

CVSS 4.0 9.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85594Published

Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

cve-program ·

Vendor product: traefik

CVSS 4.0 7.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85578Published

SiYuan through 3.8.1 Authorization Bypass via getFile

cve-program ·

Vendor product: siyuan

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-85210Published

Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET

cve-program ·

Vendor product: oppia

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82450Published

BookStack before 26.05.4 Remote Code Execution via Book Cover

cve-program ·

Vendor product: bookstack

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-81679Published

OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API

cve-program ·

Vendor product: openremote

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-75917Published

SiYuan before v3.7.4 XSS-to-RCE via pathName.ts

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.3 · CVSS 3.1 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-75916Published

SiYuan XSS-to-RCE via unescaped block metadata in hint popup

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.3 · CVSS 3.1 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-75854Published

ArcadeDB Redis Wire-Protocol Plugin Missing Authentication

cve-program ·

Vendor product: arcadedb

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-74902Published

SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.3 · CVSS 3.1 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72846Published

Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

cve-program ·

Vendor product: lightdash

CVSS 3.1 6.4 · CVSS 4.0 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67310Published

openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks

cve-program ·

Vendor product: openremote

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-65601Published

Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

cve-program ·

Vendor product: traefik

CVSS 4.0 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-65009Published

OpenRemote before 1.26.2 Information Disclosure via Syslog REST API

cve-program ·

Vendor product: openremote

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-63306Published

stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints

cve-program ·

Vendor product: stoatchat

CVSS 4.0 9.2 · CVSS 3.1 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-16111Published

IBM DataPower Gateway Type Confusion

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-100645Published

SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.6 · CVSS 3.1 8.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-100644Published

SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-100634Published

SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

cve-program ·

Vendor product: siyuan

CVSS 4.0 5.3 · CVSS 3.1 4.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-16163Published

IBM DataPower Gateway Out-of-bounds Write

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-27420Published

WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: zotpress

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-94579Published

An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 5.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-106405Published

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 8 Oct 2026Recorded 23 Oct 2026

MAL-2026-17687Published

Malicious code in tailwindcss-ui-extensions (npm)

osv · GHSA-9ww2-25r2-rppg

npm: tailwindcss-ui-extensions

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17685Published

Malicious code in system-driver (npm)

osv · GHSA-43w2-g2fc-r4h3

npm: system-driver

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17682Published

Malicious code in connector-agent (npm)

osv · GHSA-422j-hgjh-g8fg

npm: connector-agent

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-2825Published

Malicious code in centralogger (npm)

osv · GHSA-wpw7-2rgx-4cfm

npm: centralogger

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-2826Published

Malicious code in dom-utils-lite (npm)

osv · GHSA-v6fr-pvhf-6rh5

npm: dom-utils-lite

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17684Published

Malicious code in node-gyp-runtime (npm)

osv · GHSA-v64f-f8pp-4qx2

npm: node-gyp-runtime

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17683Published

Malicious code in node-fetch-lite (npm)

osv · GHSA-cfmp-vp7q-257m

npm: node-fetch-lite

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17686Published

Malicious code in tailwindcss-effects-kit (npm)

osv · GHSA-9c94-xcv7-wcf4

npm: tailwindcss-effects-kit

Source modified 8 Oct 2026Recorded 24 Oct 2026

MAL-2026-17681Published

Malicious code in node-env-resolve (npm)

osv · GHSA-fw57-xw67-r253

npm: node-env-resolve

Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-94580Published

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can m…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 5.7Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.