Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

696120 source statements · aliases may refer to the same vulnerability

CVE-2026-73618Published

Budibase Server before 3.40.0 NoSQL Injection via JSON Parameter

cve-program ·

Vendor product: server

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-73617Published

Budibase before 3.40.0 NoSQL Injection via MongoDB datasource

cve-program ·

Vendor product: server

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-73062Published

Scriban 3.0.0 through 7.2.0 Denial of Service via Array Multiplication

cve-program ·

NuGet: Scriban

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-73061Published

Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor

cve-program ·

NuGet: Scriban

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72859Published

Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL

cve-program ·

Vendor product: server

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72855Published

Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

cve-program ·

Vendor product: server

CVSS 4.0 8.4 · CVSS 3.1 8.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72851Published

Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook

cve-program ·

Vendor product: server

CVSS 4.0 9.0 · CVSS 3.1 10.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72850Published

Budibase before 3.40.0 Arbitrary File Write via Path Traversal

cve-program ·

Vendor product: server

CVSS 4.0 9.4 · CVSS 3.1 9.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72849Published

Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

cve-program ·

Vendor product: server

CVSS 4.0 8.7 · CVSS 3.1 7.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72819Published

Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72817Published

go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For

cve-program ·

Vendor product: chi

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72816Published

go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware

cve-program ·

Vendor product: chi

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72815Published

go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

cve-program ·

Vendor product: chi

CVSS 4.0 6.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72787Published

Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

cve-program ·

Vendor product: cms

CVSS 4.0 5.1 · CVSS 3.1 6.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72786Published

Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset

cve-program ·

Vendor product: cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72785Published

Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

cve-program ·

Vendor product: cms

CVSS 4.0 9.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72783Published

Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72782Published

Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72781Published

Craft CMS 5.0.0-RC1 before 5.10.7 Remote Code Execution via Twig Sandbox Escape

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72780Published

Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey

cve-program ·

Vendor product: cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72779Published

Craft CMS 5.0.0-RC1 before 5.10.6 Arbitrary File Read via SplFileObject

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 4.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72778Published

Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72702Published

Grav CMS before 2.0.16 Origin Validation Bypass via Referer

cve-program ·

Vendor product: grav

CVSS 4.0 9.3 · CVSS 3.1 5.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72701Published

Grav CMS before 2.0.16 Timing Attack via verifyNonce

cve-program ·

Vendor product: grav

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72698Published

Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72697Published

Grav CMS before 2.0.16 Path Traversal via media_directory

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-72695Published

Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-69089Published

Grav CMS before 2.0.11 Path Traversal via watermark

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-69088Published

Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

cve-program ·

Vendor product: grav

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67355Published

guzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope

cve-program ·

Vendor product: guzzle

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67354Published

guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer

cve-program ·

Vendor product: guzzle

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67353Published

guzzlehttp/guzzle before 7.15.1 Unbounded Cookie Denial of Service

cve-program ·

Vendor product: guzzle

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67339Published

guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

cve-program ·

Vendor product: guzzle

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67338Published

JupyterLab before 4.5.9 Stored XSS via Extension Manager

cve-program ·

Vendor product: jupyterlab

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67334Published

better-auth Stale Sessions Persist After User Deletion

cve-program ·

Vendor product: better-auth · Vendor product: better-auth

CVSS 4.0 5.1 · CVSS 3.1 3.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67332Published

@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

cve-program ·

Vendor product: oauth-provider

CVSS 4.0 5.3 · CVSS 3.1 6.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67331Published

better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

cve-program ·

Vendor product: scim

CVSS 4.0 8.7 · CVSS 3.1 8.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67330Published

better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision

cve-program ·

Vendor product: scim · Vendor product: scim

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67329Published

@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription

cve-program ·

Vendor product: stripe · Vendor product: stripe

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67328Published

@better-auth/sso before 1.6.21 Account Takeover via SSO

cve-program ·

Vendor product: sso · Vendor product: sso

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67325Published

GitPython before 3.1.51 Command Injection via option prefix abbreviation

cve-program ·

Vendor product: GitPython

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67324Published

GitPython 3.1.50 Authentication Bypass via Joined Short Options

cve-program ·

Vendor product: GitPython

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67323Published

GitPython before 3.1.51 Command Injection via unguarded Git options

cve-program ·

Vendor product: GitPython

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67309Published

Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass

cve-program ·

Vendor product: traefik

CVSS 4.0 7.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-67213Published

nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom

cve-program ·

Vendor product: nanoid

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-94583Published

A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists b…

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 2.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-66394Published

SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.3 · CVSS 3.1 8.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-65913Published

DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-65899Published

DOMPurify before 3.4.9 Trusted Types Policy State Contamination

cve-program ·

Vendor product: DOMPurify

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-65608Published

Grav before 2.0.9 Remote Code Execution via FlexDirectory

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.