Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698685 source statements · aliases may refer to the same vulnerability

CVE-2026-103538Published

ZongXR SuperMarket Order Deletion Endpoint OrderController.java OrderController.deleteOrder missing authentication

cve-program ·

Vendor product: SuperMarket

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101067Published

dbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal

cve-program ·

Vendor product: dbgate

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101054Published

Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control

cve-program ·

Vendor product: U3000

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103544Published

datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session

cve-program ·

Vendor product: OpenConstructionERP

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-92144Published

Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

cve-program ·

Vendor product: Forminator Forms – Contact Form, Payment Form & Custom Form Builder

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-89424Published

Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter

cve-program ·

Vendor product: Duplicate Post

CVSS 3.1 6.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101040Published

Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service

cve-program ·

Vendor product: SP 330DN · Vendor product: SP 221 · Vendor product: SP C252SF

CVSS 4.0 7.1 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-91048Published

Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create

cve-program ·

Vendor product: Apache Karaf

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-96573Published

Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

cve-program ·

Vendor product: Appointment Hour Booking – Booking Calendar

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101037Published

FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow

cve-program ·

Vendor product: FAC1200R

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-95137Rejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cve-program ·

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101018Published

dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection

cve-program ·

Vendor product: XunruiCMS

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-92244Published

PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

cve-program ·

Vendor product: PDF Invoices & Packing Slips for WooCommerce

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-91012Published

Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

cve-program ·

Vendor product: org.apache.karaf.config.core.impl

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101015Published

Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input

cve-program ·

Vendor product: OpenDMARC

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101009Published

aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection

cve-program ·

Vendor product: BaoTa

CVSS 4.0 9.3 · CVSS 3.1 8.4 · CVSS 3.0 8.4 · CVSS 2.0 8.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101006Published

Frappe HR Permission Validation init.py get_attendance_requests authorization

cve-program ·

Vendor product: HR

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100179Published

Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()

cve-program ·

Vendor product: Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More

CVSS 3.1 6.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101003Published

Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

cve-program ·

Vendor product: Mongoose

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101000Published

Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization

cve-program ·

Vendor product: NBR100V2

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100907Published

Eyeplus p2pcam Service snapshot information disclosure

cve-program ·

Vendor product: Eyeplus

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100903Published

ООО НПО Ритм GEOritm REST API obj-groups missing authentication

cve-program ·

Vendor product: GEOritm

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-14995Published

Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

cve-program ·

Vendor product: Autoptimize

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-84895Published

In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the …

cve-program ·

Vendor product: proxygen

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100900Published

DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery

cve-program ·

Vendor product: project-management

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100897Published

fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization

cve-program ·

Vendor product: StudentInfo

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-62059Published

WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: ultimate-member

CVSS 3.1 7.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100894Published

mathurvishal CloudClassroom-PHP-Project updateguest.php sql injection

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101012Published

mathurvishal CloudClassroom-PHP-Project makeresult.php sql injection

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102382Published

WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: majestic-support

CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100891Published

Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error

cve-program ·

Vendor product: OpenDMARC

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103341Published

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: unlimited-elements-for-elementor

CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103064Published

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: elementskit-lite

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-66246Published

HCL iControl is affected by multiple security vulnerabilities

cve-program ·

Vendor product: iControl

CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-66247Published

iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate s…

cve-program ·

Vendor product: iControl

CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-15989Published

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

cve-program ·

Vendor product: Super Forms – Drag & Drop Form Builder

CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-75957Published

Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter

cve-program ·

Vendor product: Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform

CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102381Published

WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: majestic-support

CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-62058Published

WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: contact-form-7-honeypot

CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102089Published

Kiteworks Email Protection Gateway path traversal

cve-program ·

Vendor product: Email Protection Gateway

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102098Published

Kiteworks Core SQL Injection

cve-program ·

Vendor product: Core

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102090Published

Kiteworks Core content injection

cve-program ·

Vendor product: Core

CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102091Published

Kiteworks Secure Data Forms server-side request forgery

cve-program ·

Vendor product: Secure Data Forms

CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102094Published

Kiteworks Email Protection Gateway unsafe reflection

cve-program ·

Vendor product: Email Protection Gateway

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102095Published

Kiteworks Email Protection Gateway server-side request forgery

cve-program ·

Vendor product: Email Protection Gateway

CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102099Published

Kiteworks Core arbitrary file write

cve-program ·

Vendor product: Core

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102096Published

Kiteworks Core OS command injection

cve-program ·

Vendor product: Core

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102097Published

Kiteworks Email Protection Gateway remote code execution

cve-program ·

Vendor product: Email Protection Gateway

CVSS 3.1 7.2Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102145Published

Kiteworks Core Server-Side Request Forgery through CRLF Injection

cve-program ·

Vendor product: Core

CVSS 3.1 6.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102146Published

Kiteworks Email Protection Gateway Arbitrary File Write through Server-Side Template Injection

cve-program ·

Vendor product: Email Protection Gateway

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.