Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698419 source statements · aliases may refer to the same vulnerability

CVE-2026-93982Published

OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

cve-program ·

Vendor product: openpanel

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102797Published

WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: trx_addons

CVSS 3.1 6.4Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-90440Published

Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service

cve-program ·

Vendor product: D language bindings

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-92834Published

Apache Thrift: C++ WebSocket server transport does not read a full request length

cve-program ·

https://conan.io/center: thrift

CVSS 4.0 6.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-94646Published

Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)

cve-program ·

https://registry.npmjs.org: thrift

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104610Published

Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow

cve-program ·

Vendor product: HG7 · Vendor product: HG9 · Vendor product: HG10

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-96277Published

Apache Thrift: Ruby `SimpleServer` ends `serve()` on any non-Transport/Protocol exception

cve-program ·

https://rubygems.org: thrift

CVSS 4.0 8.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104471Published

YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-93875Published

JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter

cve-program ·

Vendor product: JetAppointment

CVSS 3.1 7.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104463Published

YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.3 · CVSS 3.1 7.0Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-96286Published

Apache Thrift: Perl servers end `serve()` when serving one connection fails

cve-program ·

https://cpan.org/modules: Thrift

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104459Published

YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

cve-program ·

Vendor product: yeswiki

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104455Published

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action

cve-program ·

Vendor product: yeswiki

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104451Published

YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104447Published

YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104443Published

YesWiki before 4.6.7 Scope Bypass via Triples Delete API

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104439Published

YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.1 · CVSS 3.1 5.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104611Published

Tenda AC9 POST Request fast_setting_internet_set stack-based overflow

cve-program ·

Vendor product: AC9

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102798Published

WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: trx_addons

CVSS 3.1 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-7064Published

AgentDeskAI browser-tools-mcp browser-connector.ts os command injection

cve-program ·

Vendor product: browser-tools-mcp

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104721Published

Logback: Incomplete protection against CVE-2026-19880

cve-program ·

Vendor product: Logback-classic

CVSS 4.0 6.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102823Published

Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHAN…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 2 Oct 2026Recorded 25 Oct 2026

CVE-2026-102913Published

SourceCodester Car Driving School Management System Master.php save_enrollment sql injection

cve-program ·

Vendor product: Car Driving School Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102910Published

SourceCodester Online Reviewer Management System exam-delete.php sql injection

cve-program ·

Vendor product: Online Reviewer Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103110Published

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.

cve-program ·

Vendor product: Infinity

CVSS 3.1 9.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103105Published

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an…

cve-program ·

Vendor product: Infinity

CVSS 3.1 8.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102906Published

0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection

cve-program ·

Vendor product: github-mcp-server

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103100Published

Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a software abort resulting in a denial of service.

cve-program ·

Vendor product: Infinity

CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102846Published

gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102843Published

gedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51936Published

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databas…

cve-program ·

Vendor product: SQLCipher

CVSS 4.0 2.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103055Published

AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret

cve-program ·

Vendor product: AiSOC

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102804Published

Nothings stb stb_hexwave.h hexwave_init integer overflow

cve-program ·

Vendor product: stb

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51872Published

Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51867Published

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visib…

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51861Published

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51857Published

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.

cve-program ·

Vendor product: n/a

Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-51570Published

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.

cve-program ·

Vendor product: n/a

CVSS 3.1 8.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-103042Published

LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value

cve-program ·

Vendor product: LightLLM

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102792Published

Ziroom ZHOME A0101 set_syslog command injection

cve-program ·

Vendor product: ZHOME A0101

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-96289Published

Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard

cve-program ·

https://packagist.org: apache/thrift

CVSS 4.0 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-74222Published

U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback

cve-program ·

Vendor product: u-boot

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-71973Published

U-Boot before 2026.10-rc4 Integer Overflow in SquashFS Directory Table Allocation

cve-program ·

Vendor product: u-boot

CVSS 4.0 5.2 · CVSS 3.1 5.2Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102937Published

virtualenv: Command injection via --prompt in activate.bat (batch activator)

cve-program ·

Vendor product: virtualenv

CVSS 4.0 7.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104421Published

Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout

cve-program ·

Vendor product: zebra

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-104429Published

Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages

cve-program ·

Vendor product: zebra

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102620Published

Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow

cve-program ·

Vendor product: Poppler

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102876Published

SurrealDB before 3.3.0 Cross-Tenant Access via Headers

cve-program ·

Vendor product: surrealdb

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102831Published

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

cve-program ·

Vendor product: jupyterlab · Vendor product: notebook · Vendor product: jupyterlite-core

CVSS 3.1 8.1Source modified 2 Oct 2026Recorded 23 Oct 2026

CVE-2026-102379Published

WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woo-product-builder

CVSS 3.1 8.5Source modified 2 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.