Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698419 source statements · aliases may refer to the same vulnerability

CVE-2026-97634Published

Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter

cve-program ·

Vendor product: Event Tickets and Registration

CVSS 3.1 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-100182Published

Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

cve-program ·

Vendor product: Download Monitor

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-15999Published

AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-95817Published

DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

cve-program ·

Vendor product: DoFollow Case by Case

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-16000Published

KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-100649Published

vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

cve-program ·

Vendor product: vllm

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-97336Published

CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

cve-program ·

Vendor product: CMB2

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104413Published

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5 · CVSS 3.1 · [email protected] · Secondary 7.3Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104415Published

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 3.1Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104417Published

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale se…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 4.9Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104434Published

ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler, which calls expect() on Sapling receiver parsing that fails for Unified Addresses carrying invalid…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-104435Published

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more input…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 7.4Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-93880Published

Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder

cve-program ·

Vendor product: Greenshift – animation and page builder blocks

CVSS 3.1 6.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-96578Published

GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

cve-program ·

Vendor product: GSpeech TTS – WordPress Text To Speech Plugin

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-97663Published

Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

cve-program ·

Vendor product: Customer Reviews for WooCommerce

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-16001Published

IesEngine stream-mode MAC forgery via length-dependent KDF split

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103600Published

Unbounded ASN.1 nesting depth causes process-terminating stack overflow

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104411Published

Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

cve-program ·

Vendor product: Ghost

CVSS 4.0 8.5 · CVSS 3.1 7.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103601Published

CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-94180Published

WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: advanced-ads

CVSS 3.1 4.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-95662Published

Multiple vulnerabilities in the Repasat application

cve-program ·

Vendor product: Repasat application

CVSS 4.0 4.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103602Published

Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-91135Published

Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

cve-program ·

https://conan.io/center: thrift

CVSS 4.0 9.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104606Published

itsourcecode Online Admission System Project confirm.php sql injection

cve-program ·

Vendor product: Online Admission System Project

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-97286Published

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: strong-testimonials

CVSS 3.1 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-97876Published

Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address

cve-program ·

Vendor product: grub2

CVSS 3.1 6.4Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103603Published

Unbounded HSS public key level count allows huge array allocation during signature verification

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103604Published

Quadratic-time escaping when converting X.509 distinguished names to strings

cve-program ·

https://www.nuget.org/packages/BouncyCastle.Cryptography: BouncyCastle.Cryptography

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-17507Published

MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcmls

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-82458Published

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available

cve-program ·

https://golang.org/pkg: github.com/apache/thrift · https://crates.io: thrift · NuGet: ApacheThrift

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-82459Published

Apache Thrift: Integer underflow in C++ THeaderTransport allows an unauthenticated remote peer to terminate a 32-bit process

cve-program ·

https://conan.io/center: thrift

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-17508Published

Password-based KDF cost parameters honoured unbounded from untrusted input across the remaining PBE entry points

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcpkix · https://www.bouncycastle.org/download/bouncy-castle-java/: bcprov · https://www.bouncycastle.org/download/bouncy-castle-java-lts/: bcpkix-lts8on

CVSS 4.0 5.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-18036Published

NTRU leaks private key information by reducing secret values with a non-constant-time integer division

cve-program ·

https://www.bouncycastle.org/download/bouncy-castle-java/: bcprov

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-85086Published

Apache Thrift: Perl TLS client disables certificate verification by default

cve-program ·

https://cpan.org/modules: Thrift

CVSS 4.0 6.9Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-91784Published

Argument Injection leading to arbitrary process termination in gotop

cve-program ·

Vendor product: gotop

CVSS 4.0 4.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-85087Published

Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

cve-program ·

https://pypi.python.org: thrift

CVSS 4.0 6.9Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104853Published

Nx: Path traversal in nx migrate package-migrations extraction

cve-program ·

Vendor product: nx

CVSS 4.0 5.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-96292Published

Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)

cve-program ·

Vendor product: lua bindings

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-85088Published

Apache Thrift, Apache Thrift: The C++ and D clients fall back to the certificate Common Name when subjectAltName entries are present but do not match

cve-program ·

https://conan.io/center: thrift · Vendor product: D language bindings

CVSS 4.0 6.9Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104410Published

SiYuan before 3.8.5 Information Disclosure via /api/export/preview

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104414Published

Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses

cve-program ·

Vendor product: Ghost

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-79654Published

Ketello: katello content view history api cross-organization authorization bypass

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: rubygem-katello · https://access.redhat.com/downloads/content/package-browser/: rubygem-katello · https://access.redhat.com/downloads/content/package-browser/: rubygem-katello

CVSS 3.1 4.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104418Published

Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files

cve-program ·

Vendor product: Ghost

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104422Published

Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite

cve-program ·

Vendor product: zebra

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-87117Published

Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec

cve-program ·

https://packagist.org: apache/thrift

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-94636Published

Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

cve-program ·

https://pypi.python.org: thrift

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-86536Published

Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript

cve-program ·

https://registry.npmjs.org: thrift · Vendor product: javascript bindings · Vendor product: typescript bindings

CVSS 4.0 6.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-86535Published

Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely

cve-program ·

https://registry.npmjs.org: thrift

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-85209Published

IDOR in AVEZ Electronics's LMS

cve-program ·

Vendor product: Learning Management System (LMS)

CVSS 3.1 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104848Published

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

cve-program ·

Vendor product: tinypool

CVSS 4.0 9.5Source modified 2 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.