Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698587 source statements · aliases may refer to the same vulnerability

CVE-2026-74039Published

Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-74038Published

Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 7.0 · CVSS 3.1 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73699Published

FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()

cve-program ·

Vendor product: FileRun

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73698Published

FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action

cve-program ·

Vendor product: FileRun

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73694Published

FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition

cve-program ·

Vendor product: FileRun

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73693Published

FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

cve-program ·

Vendor product: FileRun

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73680Published

Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

cve-program ·

Vendor product: Cockpit CMS

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73679Published

ImpressCMS Authenticated RCE via PHP Custom Tag eval()

cve-program ·

Vendor product: ImpressCMS

CVSS 3.1 7.2 · CVSS 4.0 8.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73321Published

XenForo < 2.3.13 Uncontrolled Recursion DoS via BBCode Parser

cve-program ·

Vendor product: XenForo

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73320Published

XenForo < 2.3.13 Unauthenticated Information Disclosure via Unfurl Endpoint

cve-program ·

Vendor product: XenForo

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73319Published

XenForo < 2.3.13 XSS via Dynamic Redirect Handler

cve-program ·

Vendor product: XenForo

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73318Published

XenForo < 2.3.13 Missing Authorization via force-agreement Controller

cve-program ·

Vendor product: XenForo

CVSS 4.0 5.1 · CVSS 3.1 3.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73317Published

XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

cve-program ·

Vendor product: XenForo

CVSS 4.0 5.1 · CVSS 3.1 2.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73316Published

XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider

cve-program ·

Vendor product: XenForo

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73315Published

XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler

cve-program ·

Vendor product: XenForo

CVSS 4.0 7.7 · CVSS 3.1 8.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73314Published

XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook

cve-program ·

Vendor product: XenForo

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73313Published

XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider

cve-program ·

Vendor product: XenForo

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73312Published

XenForo < 2.3.13 Refresh Token Replay via Expired Access Token

cve-program ·

Vendor product: XenForo

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73311Published

XenForo < 2.3.13 OAuth2 Authorization Code Reuse

cve-program ·

Vendor product: XenForo

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73310Published

XenForo < 2.3.13 OAuth2 Authorization Code Token Theft via redirect_uri Bypass

cve-program ·

Vendor product: XenForo

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73309Published

XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

cve-program ·

Vendor product: XenForo

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73108Published

RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec

cve-program ·

Vendor product: rustdesk

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-73102Published

RustDesk Path Traversal via macOS Clipboard File-Paste

cve-program ·

Vendor product: rustdesk

CVSS 4.0 6.9 · CVSS 3.1 5.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-72848Published

langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

cve-program ·

https://pypi.org: langchain-community

CVSS 3.1 8.6 · CVSS 4.0 7.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-72843Published

EverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover

cve-program ·

Vendor product: evershop

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-72710Published

SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection

cve-program ·

Vendor product: SPIP

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-72709Published

SPIP < 4.4.18 Missing Authorization via ecrire/action/

cve-program ·

Vendor product: SPIP

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71518Published

Typemill < 2.26.0 Authorization Bypass via Media File Download Route

cve-program ·

Vendor product: typemill

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71511Published

Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71510Published

Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71509Published

Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71508Published

Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71507Published

Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71506Published

Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71505Published

Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

cve-program ·

Vendor product: dolibarr

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71504Published

Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset

cve-program ·

Vendor product: dolibarr

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-71503Published

Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

cve-program ·

Vendor product: dolibarr

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-6958Published

Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe

cve-program ·

Vendor product: Acunetix

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-67602Published

phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache

cve-program ·

Vendor product: phpipam

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-67204Published

BookStack < 26.05.4 Broken Access Control via Image Gallery API

cve-program ·

Vendor product: BookStack

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-67189Published

pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record

cve-program ·

Vendor product: pfSense Plus · Vendor product: pfSense CE

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-66047Published

ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

cve-program ·

Vendor product: ProfilePress

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-66007Published

Datasets Path Traversal via Unsanitized file_name Metadata

cve-program ·

Vendor product: datasets

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-65010Published

Datasets Symlink-following Arbitrary File Write via Extractor.extract()

cve-program ·

Vendor product: datasets

CVSS 4.0 4.4 · CVSS 3.1 6.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-63722Published

ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

cve-program ·

Vendor product: ICEcoder

CVSS 4.0 8.7 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-61505Published

Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter

cve-program ·

Vendor product: hfs

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-61504Published

Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing

cve-program ·

Vendor product: hfs

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-61503Published

Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences

cve-program ·

Vendor product: hfs

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-61502Published

Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests

cve-program ·

Vendor product: hfs

CVSS 4.0 5.1 · CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-61501Published

Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer

cve-program ·

Vendor product: hfs

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 1 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.