Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698466 source statements · aliases may refer to the same vulnerability

CVE-2026-63724Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-92173Published

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That…

cve-program ·

Vendor product: Meta Horizon OS

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2024-58387Published

Inspur HCM Cloud Arbitrary File Read via file/download Endpoint

cve-program ·

Vendor product: Haiyue HCM Cloud

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102999Published

pypdf: Possible long runtimes with large amount of embedded files

cve-program ·

Vendor product: pypdf

CVSS 4.0 8.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102995Published

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

cve-program ·

Vendor product: pypdf

CVSS 4.0 8.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-51853Published

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access an…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-51859Published

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103044Published

EasyTimeline should not serve image maps as application/xml

cve-program ·

Vendor product: Mediawiki - EasyTimeline extension

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-51864Published

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). A remote attacker can use the validated exploitation path to write files outside the inte…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-63721Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-85626Published

git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

cve-program ·

Vendor product: git-mcp-server

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-51870Published

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-8618Published

Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus

cve-program ·

Vendor product: Deco M9 Plus V2

CVSS 4.0 7.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2022-27925Published

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, lead…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103048Published

Open Redirect in Special:Book

cve-program ·

Vendor product: Mediawiki - Collection extension

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2018-13374Published

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivit…

cve-program ·

Vendor product: Fortinet FortiOS, fortiADC

CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-55083Published

DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

cve-program ·

Vendor product: dhis2-core

CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-90992Published

Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field

cve-program ·

Vendor product: Redux Framework

CVSS 3.1 6.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-85235Published

Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

cve-program ·

Vendor product: Forminator Forms – Contact Form, Payment Form & Custom Form Builder

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2015-2291Published

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a)…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101925Published

bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name

cve-program ·

Vendor product: bbp style pack

CVSS 3.1 6.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-96268Published

Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action

cve-program ·

Vendor product: Awesome Support – WordPress HelpDesk & Support Plugin

CVSS 3.1 6.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2017-6884Published

A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-97661Published

Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field

cve-program ·

Vendor product: Business Essentials for Contact Form 7

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102796Published

Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

cve-program ·

Vendor product: Mediawiki - UserPageViewTracker Extension

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-68495Published

jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

cve-program ·

https://repo1.maven.org/maven2: com.fasterxml.jackson.dataformat:jackson-dataformat-cbor · https://repo1.maven.org/maven2: tools.jackson.dataformat:jackson-dataformat-cbor

CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-68496Published

jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

cve-program ·

https://repo1.maven.org/maven2: com.fasterxml.jackson.dataformat:jackson-dataformat-smile · https://repo1.maven.org/maven2: tools.jackson.dataformat:jackson-dataformat-smile

CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2024-9379Published

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

cve-program ·

Vendor product: CSA (Cloud Services Appliance)

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2025-0282Published

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve re…

cve-program ·

Vendor product: Connect Secure · Vendor product: Policy Secure · Vendor product: Neurons for ZTA gateways

CVSS 3.1 9.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100242Published

DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

cve-program ·

Vendor product: Mediawiki - DataTransfer Extension

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2021-22175Published

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instanc…

cve-program ·

Vendor product: GitLab

CVSS 3.1 6.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2025-68461Published

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

cve-program ·

Vendor product: Webmail

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2021-22054Published

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to U…

cve-program ·

Vendor product: VMware Workspace ONE UEM console

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2023-27351Published

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityReq…

cve-program ·

Vendor product: NG

CVSS 3.0 8.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-78577Published

Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200

cve-program ·

Vendor product: Tapo C200 v5 · Vendor product: Tapo C120 v1

CVSS 4.0 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2024-7399Published

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

cve-program ·

Vendor product: MagicINFO 9 Server

CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-78578Published

Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200

cve-program ·

Vendor product: Tapo C200 v5 · Vendor product: Tapo C120 v1

CVSS 4.0 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102369Published

Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

cve-program ·

Vendor product: Tapo C200 v5 · Vendor product: Tapo C120 v1

CVSS 4.0 8.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2025-62593Published

Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

cve-program ·

Vendor product: ray

CVSS 4.0 9.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100240Published

TemplateSandbox does not check read permissions for the page being previewed

cve-program ·

Vendor product: Mediawiki - TemplateSandbox Extension

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-42018Published

Anonymous user token generation exposure in JFrog Artifactory

cve-program ·

Vendor product: artifactory

CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100723Published

vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

cve-program ·

Vendor product: vm2

CVSS 4.0 6.9 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103921Published

GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor

cve-program ·

Vendor product: graphql-tools · Vendor product: executor-legacy-ws

CVSS 3.1 7.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-21833Published

HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)

cve-program ·

Vendor product: AION

CVSS 3.1 3.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2015-3246Published

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error d…

cve-program ·

Vendor product: n/a

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103922Published

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

cve-program ·

Vendor product: capacitor · Vendor product: android · Vendor product: ios

CVSS 3.1 9.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103472Published

restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering

cve-program ·

Vendor product: restbed

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73976Published

djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)

cve-program ·

Vendor product: djehuty

CVSS 4.0 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

GHSA-7952-gx68-cjqrPublished

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

osv · CVE-2026-65829 · PYSEC-2026-4108

NuGet: MPXJ.Net · RubyGems: mpxj · PyPI: mpxj

MODERATESource modified 1 Oct 2026Recorded 23 Oct 2026

GHSA-5vvx-3h34-f3gjPublished

MPXJ: XXE Vulnerability in MerlinReader

osv · CVE-2026-61570 · PYSEC-2026-4107

Maven: net.sf.mpxj:mpxj · RubyGems: mpxj · NuGet: MPXJ.Net

HIGHSource modified 1 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.