Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698276 source statements · aliases may refer to the same vulnerability

CVE-2026-73839Published

Ebyte NE2-D11 Insufficiently Protected Credentials

cve-program ·

Vendor product: Ebyte NE2-D11 Firmware

CVSS 3.1 4.6 · CVSS 4.0 5.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-77977Published

Ebyte NA111-M Missing Authentication for Critical Function

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 8.1 · CVSS 4.0 7.2Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-77975Published

Ebyte NA111-M Cleartext Storage of Sensitive Information

cve-program ·

Vendor product: Ebyte NE2-D11 Firmware

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-73819Published

Ebyte NA111-M Weak Authentication

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-76133Published

Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-69658Published

Ebyte NA111-M Cleartext Transmission of Sensitive Information

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-75548Published

Ebyte NA111-M Improper Restriction of Rendered UI Layers or Frames

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 5.4 · CVSS 4.0 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-71187Published

Ebyte NA111-M Use of Client-Side Authentication

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-73809Published

Ebyte NA111-M Cleartext Transmission of Sensitive Information

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-77966Published

Ebyte NA111-M Missing Authorization

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-76940Published

Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-75814Published

Ebyte NA111-M Cross-Site Request Forgery

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 8.8 · CVSS 4.0 8.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-76179Published

Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-73125Published

Ebyte NA111-M Missing Authentication for Critical Function

cve-program ·

Vendor product: Ebyte NA111-M Firmware

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104956Published

Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

cve-program ·

Vendor product: plane

CVSS 3.1 5.3Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105632Published

Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

cve-program ·

Vendor product: plane

CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104979Published

Plane: Cross-tenant stored XSS in intake enables account takeover

cve-program ·

Vendor product: plane

CVSS 3.1 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-58834Published

In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. Use…

cve-program ·

Vendor product: Android

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-58856Published

In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User i…

cve-program ·

Vendor product: Android

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105637Published

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

cve-program ·

Vendor product: plane

CVSS 3.1 9.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105712Published

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symli…

cve-program ·

Vendor product: GnuPG

CVSS 3.1 3.6Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105645Published

Ghost: Regular Expression Denial of Service in External Media Inliner

cve-program ·

Vendor product: Ghost

CVSS 3.1 4.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104974Published

Plane: Disabled User Auto-Reactivation on Login

cve-program ·

Vendor product: plane

CVSS 3.1 8.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-78413Published

Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

cve-program ·

Vendor product: Velociraptor

CVSS 3.1 5.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93319Published

A malicious frontend can cause a daemon panic

cve-program ·

Vendor product: github.com/moby/buildkit

CVSS 4.0 5.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93318Published

Cache poisoning via unvalidated image layer DiffIDs

cve-program ·

Vendor product: github.com/moby/buildkit

CVSS 4.0 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93317Published

Container blob cache can accept unverified content

cve-program ·

Vendor product: github.com/moby/buildkit

CVSS 4.0 5.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-104968Published

Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

cve-program ·

Vendor product: plane

CVSS 4.0 8.7Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93316Published

Starting daemon with --cdi-disabled flag can lead to panic on specific builds

cve-program ·

Vendor product: BuildKit

CVSS 4.0 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-78411Published

Velociraptor Server Metadata update with Insufficient Permission Check

cve-program ·

Vendor product: Velociraptor

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-78412Published

WatchEvent API streams another organization's live events

cve-program ·

Vendor product: Velociraptor

CVSS 3.1 4.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-12171Published

auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

cve-program ·

https://www.npmjs.com/: auto-changelog

CVSS 4.0 8.4 · CVSS 3.1 7.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-105642Published

Ghost: Remote Code Execution via Bookmark Card Images

cve-program ·

Vendor product: Ghost

CVSS 3.1 8.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-86671Published

In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allo…

cve-program ·

Vendor product: Eclipse Che

CVSS 4.0 8.4Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-28659Published

In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…

cve-program ·

Vendor product: XR

CVSS 4.0 10.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-58865Published

In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not nee…

cve-program ·

Vendor product: Android

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51897Published

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51884Published

The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassin…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51893Published

infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, w…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51904Published

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93320Published

BuildKit improperly handles special files in build snapshots

cve-program ·

Vendor product: github.com/moby/buildkit

CVSS 4.0 6.0Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93322Published

Malformed MergeOp can crash the BuildKit daemon

cve-program ·

Vendor product: github.com/moby/buildkit

CVSS 4.0 6.9Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51914Published

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept calle…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-97276Published

WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wp-statistics

CVSS 3.1 7.1Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-51918Published

FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2025-56361Published

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is e…

cve-program ·

Vendor product: n/a

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-100509Published

WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: computer-repair-shop

CVSS 3.1 6.5Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103878Published

Apache Directory LDAP API: Injection of plaintext responses during StartTLS

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.directory.api:api-ldap-client-api

Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-93323Published

Oversized Dockerfile or .dockerignore can exhaust buildkitd memory

cve-program ·

Vendor product: github.com/moby/buildkit

CVSS 4.0 6.8Source modified 5 Oct 2026Recorded 23 Oct 2026

CVE-2026-103334Published

WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: restaurant-reservations

CVSS 3.1 7.5Source modified 5 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.