Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698587 source statements · aliases may refer to the same vulnerability

CVE-2026-81697Published

openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 5.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81696Published

openssl_encrypt before 1.4.9 Terminal Injection via info Command

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 3.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81695Published

openssl_encrypt before 1.4.9 Terminal Injection via key_id

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 3.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81693Published

openssl_encrypt before 1.4.9 Denial of Service via QR total field

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81692Published

openssl_encrypt before 1.4.9 Denial of Service via STREAMINFO

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81691Published

openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81690Published

verify-usb before 1.4.9 Symlink Directory Traversal Code Execution

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81689Published

openssl_encrypt before 1.4.9 Weak Pepper Key Derivation

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81688Published

openssl_encrypt before 1.4.9 Plaintext Confirmation Oracle via SHA-256

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81687Published

openssl_encrypt before 1.4.9 Denial of Service via KDF

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 5.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81686Published

openssl_encrypt before 1.4.9 D-Bus Properties Authorization Bypass

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81685Published

openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 3.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81684Published

openssl_encrypt before 1.4.9 Information Disclosure via Command Line

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81683Published

openssl_encrypt before 1.4.9 Plaintext Private Key Storage

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.6 · CVSS 3.1 8.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81682Published

openssl_encrypt before 1.4.9 Insecure File Permissions

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.6 · CVSS 3.1 6.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81681Published

openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 4.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81680Published

openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 4.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-77923Published

Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

cve-program ·

Vendor product: dolibarr

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-77915Published

rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php

cve-program ·

Vendor product: rconfig

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-77086Published

SiYuan before v3.7.4 Path Traversal via packageName

cve-program ·

Vendor product: siyuan

CVSS 4.0 9.4 · CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-76841Published

Xinference through 2.11.0 Remote Code Execution via Hardcoded trust_remote_code in Model Loaders

cve-program ·

https://pypi.org/project/xinference/: xinference

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-76635Published

baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

cve-program ·

Vendor product: basercms

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-76634Published

WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

cve-program ·

Vendor product: WeGIA

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-76633Published

WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha

cve-program ·

Vendor product: WeGIA

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-76614Published

OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

cve-program ·

Vendor product: openemr

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-75133Published

Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

cve-program ·

Vendor product: Keep Backup Daily

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-75106Published

OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

cve-program ·

Vendor product: OpnForm

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74901Published

openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74900Published

openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74899Published

openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74896Published

openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74895Published

openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74894Published

openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74893Published

openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74892Published

openssl_encrypt before 1.4.0 Hardcoded Secret Key

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74891Published

openssl_encrypt before 1.4.0 Hardcoded Database Credentials

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74890Published

openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 5.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74889Published

openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74888Published

openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74887Published

openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74886Published

openssl_encrypt before 1.4.0 Plugin Import Guard Bypass

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74885Published

openssl_encrypt before 1.4.0 Logging Bug and Race Condition

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 9.3 · CVSS 3.1 3.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74884Published

openssl_encrypt before 1.4.0 Path Traversal via plugin_id

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74883Published

openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74882Published

openssl_encrypt before 1.4.0 Insecure Default Configuration

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74871Published

openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74870Published

openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

cve-program ·

Vendor product: openssl_encrypt

CVSS 4.0 8.7 · CVSS 3.1 3.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74239Published

XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

cve-program ·

Vendor product: XenForo

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74046Published

Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74044Published

Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 7.0 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.