Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698364 source statements · aliases may refer to the same vulnerability

CVE-2026-90450Published

Incorrect Authorization in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90451Published

Use of Default Credentials in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90452Published

Improper certificate validation in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90453Published

Open Redirect in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 4.0 5.1 · CVSS 3.1 3.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90454Published

Missing authorization in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90455Published

Dependency on vulnerable third-party component in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-100661Published

Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

cve-program ·

Vendor product: netty

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90456Published

Use of default credentials in Malcolm

cve-program ·

Vendor product: Malcolm

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90457Published

The administrative password is hashed using a comparatively weak, fast algorithm for the credential store backing one authentication path, and the file containing that hash is written with permissions allowing it to be read by any local use…

cve-program ·

Vendor product: Malcolm

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104444Published

YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63177Published

Malcolm Vulnerable to Authorization Bypass via URI Normalization Differential in Nginx Lua RBAC

cve-program ·

Vendor product: Malcolm

CVSS 3.1 7.1 · CVSS 4.0 7.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63134Published

Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

cve-program ·

Vendor product: Malcolm

CVSS 3.1 5.4 · CVSS 4.0 5.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51899Published

In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, ed…

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-55676Published

Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

cve-program ·

Vendor product: Malcolm

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51916Published

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected…

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63133Published

Malcolm has Uncontrolled Resource Consumption in Archive Extraction (Inode-Exhaustion DoS)

cve-program ·

Vendor product: Malcolm

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2020-37278Published

Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile

cve-program ·

Vendor product: e-Bridge

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-39718Published

WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: wallstreet

CVSS 3.1 8.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104871Published

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

cve-program ·

Vendor product: angular-cli

CVSS 4.0 6.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-15896Published

Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

cve-program ·

Vendor product: Super Forms – Drag & Drop Form Builder

CVSS 3.1 9.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-92820Published

Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

cve-program ·

Vendor product: Ninja Forms - File Uploads

CVSS 3.1 8.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-84925Published

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter

cve-program ·

Vendor product: Avada | Website Builder For WordPress & WooCommerce

CVSS 3.1 6.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-93367Published

Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)

cve-program ·

Vendor product: Visitor Traffic Real Time Statistics pro

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104054Published

calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

cve-program ·

Vendor product: cal.diy

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103097Published

GV-Eye Relay Payment API Key Vulnerability

cve-program ·

Vendor product: tw.com.geovision.gveye

CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103096Published

GV-Eye Hardcoded API Key Vulnerability

cve-program ·

Vendor product: tw.com.geovision.gveye

CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103765Published

Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server

cve-program ·

Vendor product: Mooncake

CVSS 4.0 8.8 · CVSS 3.1 9.4Source modified 2 Oct 2026Recorded 23 Oct 2026

GHSA-qxpp-qjg8-x4jvPublished

Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)

osv · CVE-2026-85651

npm: trigger.dev

HIGHSource modified 2 Oct 2026Recorded 24 Oct 2026

GHSA-xxv7-2vv3-h682Published

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

osv · CVE-2026-85650

npm: trigger.dev

HIGHSource modified 2 Oct 2026Recorded 24 Oct 2026

CVE-2025-71427Published

Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image

cve-program ·

Vendor product: Office-PowerPoint-MCP-Server

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-18397Published

SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

cve-program ·

Vendor product: SConnect

CVSS 4.0 9.4Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-64893Published

- Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.

cve-program ·

Vendor product: EasyIO NEO

CVSS 4.0 7.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-64892Published

- Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations.

cve-program ·

Vendor product: Easy IO Neo

CVSS 4.0 6.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-34494Published

- On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.

cve-program ·

Vendor product: Neo Series MVP2

CVSS 4.0 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-34493Published

- On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations.

cve-program ·

Vendor product: EasyIO FS32

CVSS 4.0 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-71448Published

: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse.

cve-program ·

Vendor product: EasyIO FS32

CVSS 4.0 5.6Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51907Published

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-71454Published

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS).

cve-program ·

Vendor product: CAPEC-63

CVSS 4.0 5.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-71453Published

- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack.

cve-program ·

Vendor product: EasyIO FS32

CVSS 4.0 5.6Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63575Published

PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 7.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63574Published

Unbounded allocation from OpenPGP signature and user attribute subpacket lengths

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63573Published

Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63572Published

Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 7.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51858Published

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104861Published

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end o…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-63571Published

Attribute certificate path validation does not verify the attribute certificate's signature

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63570Published

Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 7.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-67989Published

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-63569Published

MTI/A0 DHAgreement does not validate the peer's ephemeral value

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 9.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51895Published

Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations.

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.