Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

696120 source statements · aliases may refer to the same vulnerability

CVE-2026-86434Published

commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision

cve-program ·

Vendor product: commonmark

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86433Published

commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes

cve-program ·

Vendor product: commonmark

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86432Published

commonmark 2.0.0 before 2.8.4 Denial of Service via XML

cve-program ·

Vendor product: commonmark

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86431Published

commonmark before 2.9.1 XSS via AttributesExtension form feed bypass

cve-program ·

Vendor product: commonmark

CVSS 4.0 6.9 · CVSS 3.1 7.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86430Published

league/commonmark before 2.9.1 Denial of Service via parsing

cve-program ·

Vendor product: commonmark

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86429Published

commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

cve-program ·

Vendor product: commonmark

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86428Published

commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

cve-program ·

Vendor product: commonmark

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86204Published

PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86203Published

PocketMine-MP before 5.39.2 Item Duplication via Despawn State

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86202Published

PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86201Published

PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86200Published

PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-86197Published

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

cve-program ·

Vendor product: grav

CVSS 4.0 5.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-84199Published

Kyverno before 1.16.2 SSRF via APICall Feature

cve-program ·

Vendor product: kyverno

CVSS 4.0 6.9 · CVSS 3.1 7.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-84192Published

LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data

cve-program ·

Vendor product: librenms

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-84190Published

LibreNMS before 26.5.0 Remote Code Execution via AboutController

cve-program ·

Vendor product: librenms

CVSS 4.0 8.7 · CVSS 3.1 7.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-84189Published

LibreNMS before 26.7.0 Stored XSS via Oxidized API

cve-program ·

Vendor product: librenms

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-84188Published

librenms before 26.7.0 Stored XSS via graph_descr settings

cve-program ·

Vendor product: librenms

CVSS 4.0 4.8 · CVSS 3.1 4.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82868Published

@pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

cve-program ·

Vendor product: schemas

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82867Published

@pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

cve-program ·

Vendor product: schemas

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82866Published

@pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

cve-program ·

Vendor product: common

CVSS 4.0 8.9 · CVSS 3.1 6.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82865Published

pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

cve-program ·

Vendor product: schemas

CVSS 4.0 2.1 · CVSS 3.1 4.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82864Published

pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

cve-program ·

Vendor product: pdf-lib

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82863Published

@hulumi/baseline before 1.3.2 CloudTrail Selector Tampering Detection

cve-program ·

Vendor product: baseline

CVSS 4.0 8.7 · CVSS 3.1 3.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82861Published

@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass

cve-program ·

Vendor product: policies

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82860Published

@hulumi/policies before 1.3.2 Admin Policy Bypass

cve-program ·

Vendor product: policies

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82858Published

@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

cve-program ·

Vendor product: drift

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82856Published

@hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

cve-program ·

Vendor product: policies

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82855Published

@hulumi/policies before 1.3.2 Evidence Validation Bypass

cve-program ·

Vendor product: policies

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82261Published

SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

cve-program ·

Vendor product: kit

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82260Published

SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

cve-program ·

Vendor product: kit

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82259Published

SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

cve-program ·

Vendor product: kit

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82258Published

SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch

cve-program ·

Vendor product: kit

CVSS 4.0 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82257Published

SvelteKit before 2.69.1 Prototype Pollution via File Input

cve-program ·

Vendor product: kit

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82256Published

SvelteKit before 2.69.1 Denial of Service via Remote Form

cve-program ·

Vendor product: kit

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82246Published

Budibase Server before 3.41.3 SSRF via Query Import

cve-program ·

Vendor product: server

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82245Published

Budibase before 3.41.3 Missing Authorization License Management

cve-program ·

Vendor product: server

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82244Published

Budibase before 3.41.3 Remote Code Execution via Plugin eval()

cve-program ·

Vendor product: server

CVSS 4.0 9.4 · CVSS 3.1 9.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82243Published

Budibase Server before 3.41.3 SSRF with Credential Leakage

cve-program ·

Vendor product: server

CVSS 4.0 8.3 · CVSS 3.1 7.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82242Published

Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization

cve-program ·

Vendor product: server

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82241Published

Budibase backend-core SSRF via incomplete default blacklist

cve-program ·

Vendor product: server

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82240Published

Budibase before 3.41.3 Privilege Escalation via User Update API

cve-program ·

Vendor product: server

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-82239Published

Budibase before 3.41.3 Authorization Bypass via datasources/query

cve-program ·

Vendor product: server

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-80202Published

Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

cve-program ·

Vendor product: kimai

CVSS 4.0 9.3 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-80201Published

Kimai before 2.53.0 API Token Leakage via Invoice Template

cve-program ·

Vendor product: kimai

CVSS 4.0 2.0 · CVSS 3.1 2.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-80200Published

Kimai before 2.53.0 Open Redirect via RelayState

cve-program ·

Vendor product: kimai

CVSS 4.0 5.3 · CVSS 3.1 4.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-80199Published

Kimai before 2.54.0 Username Enumeration via Timing Oracle

cve-program ·

Vendor product: kimai

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-80198Published

Kimai before 2.56.0 Information Disclosure via config() Twig Function

cve-program ·

Vendor product: kimai

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-80197Published

Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

cve-program ·

Vendor product: kimai

CVSS 4.0 8.7 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-80196Published

Kimai before 2.58.0 Authentication Bypass via Password Reset Link

cve-program ·

Vendor product: kimai

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.