Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

696213 source statements · aliases may refer to the same vulnerability

CVE-2024-58380Published

PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2024-58375Published

OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation

cve-program ·

Vendor product: opentofu

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2024-58303Published

FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings

cve-program ·

Vendor product: FriendsofFlarum Pretty Mail

CVSS 4.0 8.6Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54396Published

PocketMine-MP before 4.8.1 Server Crash via Banner NBT

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54395Published

PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54394Published

PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54393Published

PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54392Published

PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54390Published

PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54356Published

Kyverno before 1.9.5 Sweet32 Medium Strength Cipher Suites

cve-program ·

Vendor product: kyverno

CVSS 4.0 9.3 · CVSS 3.1 3.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2023-54355Published

PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51018Published

PocketMine-MP before 3.26.5 and 4.0.5 Input Validation via Book Pages

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51017Published

PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51016Published

PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51015Published

PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51014Published

PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51013Published

PocketMine-MP before 4.2.3 Denial of Service via NBT Metadata

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51012Published

PocketMine-MP before 4.2.9 Denial of Service via NBT Deserialization

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51011Published

PocketMine-MP before 4.2.10 Denial of Service via Chat Messages

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51010Published

PocketMine-MP before 4.4.2 Server Crash via Item ID

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2022-51009Published

PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-48007Published

PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-48006Published

PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-47935Published

Sentry 8.2.0 Remote Code Execution via Pickle Deserialization

cve-program ·

Vendor product: Sentry

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-47776Published

Umbraco v8.14.1 - 'baseUrl' SSRF

cve-program ·

NuGet: UmbracoCms

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2021-47763Published

Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection

cve-program ·

Vendor product: Aimeos Laravel ecommerce platform

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-37277Published

PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction

cve-program ·

Vendor product: PocketMine-MP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-37256Published

Grav - Cross-Site Scripting in Admin Plugin Page Editor

cve-program ·

Vendor product: Grav

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-36962Published

Tendenci 12.3.1 - CSV/ Formula Injection

cve-program ·

Vendor product: Tendenci

CVSS 4.0 5.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-36947Published

LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection

cve-program ·

Vendor product: LibreNMS

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2020-36939Published

Cassandra Web 0.5.0 - Remote File Read

cve-program ·

Vendor product: Cassandra Web

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2019-25710Published

Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter

cve-program ·

Vendor product: Dolibarr ERP-CRM

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2018-25357Published

Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

cve-program ·

Vendor product: Dolibarr ERP CRM

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2018-25157Published

Phraseanet 4.0.3 Stored XSS via Document Upload

cve-program ·

Vendor product: Phraseanet DAM Open Source

CVSS 4.0 5.1 · CVSS 3.1 6.4Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2016-20054Published

Nodcms Cross Site Request Forgery via admin endpoints

cve-program ·

Vendor product: nodCMS

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2011-10019Published

Spreecommerce < 0.60.2 Search Parameter RCE

cve-program ·

Vendor product: Spreecommerce

CVSS 4.0 10.0Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-94584Published

A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes …

cve-program ·

Vendor product: Fabric OS

CVSS 4.0 2.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-76267Published

Log Injection through the REST API in Splunk App for Splunk O11y Cloud

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-76272Published

Missing Access Control through the REST API in Splunk Secure Gateway

cve-program ·

Vendor product: Splunk Enterprise · Vendor product: Splunk Secure Gateway

CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-76277Published

Improper Input Validation of Native Splunk Usernames through the REST API in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 4.1Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107279Published

AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int

cve-program ·

Vendor product: async-http-client

CVSS 4.0 8.8Source modified 8 Oct 2026Recorded 23 Oct 2026

RUSTSEC-2026-0333Published

Resource budgets not enforced on the typed deserialization path

osv · GHSA-4xcc-23fx-w2wj

crates.io: noyalib

Source modified 8 Oct 2026Recorded 24 Oct 2026

CVE-2026-107284Published

AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

cve-program ·

Vendor product: async-http-client

CVSS 3.1 3.7Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-101329Published

Langflow OSS is affected by multiple vulnerabilities

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 6.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-16170Published

IBM DataPower Gateway Out-of-bounds Write

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-16161Published

IBM DataPower Gateway Out-of-bounds Read

cve-program ·

Vendor product: DataPower Gateway 10.6CD · Vendor product: DataPower Gateway 10.6.0 · Vendor product: DataPower Gateway 11.0.0

CVSS 3.1 7.5Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-105832Published

EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes

cve-program ·

Vendor product: espocrm

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107637Published

pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action

cve-program ·

Vendor product: ph7builder

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 8 Oct 2026Recorded 23 Oct 2026

CVE-2026-107314Published

pgjdbc does not enforce requireAuth when the value excludes every authentication method

cve-program ·

https://repo.maven.apache.org/maven2: org.postgresql:postgresql

CVSS 3.1 5.9Source modified 8 Oct 2026Recorded 23 Oct 2026

MAL-2026-17349Published

Malicious code in @bellaxchuu/velvetry (npm)

osv · GHSA-9jwq-m497-mcq5

npm: @bellaxchuu/velvetry

Source modified 8 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.