Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698685 source statements · aliases may refer to the same vulnerability

CVE-2026-103285Published

Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery

cve-program ·

Vendor product: Ghost

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103281Published

Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

cve-program ·

Vendor product: Ghost

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103277Published

Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

cve-program ·

Vendor product: Ghost

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103276Published

Ghost before 6.20.0 File Read via URL Encoding Bypass

cve-program ·

Vendor product: Ghost

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103273Published

Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

cve-program ·

Vendor product: Ghost

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103268Published

Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

cve-program ·

Vendor product: Ghost

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103280Published

Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

cve-program ·

Vendor product: Ghost

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103264Published

Fleet before 4.87.0 Authentication Bypass via Device Identifiers

cve-program ·

Vendor product: fleet

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103284Published

Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback

cve-program ·

Vendor product: Ghost

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103260Published

n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

cve-program ·

Vendor product: n8n

CVSS 4.0 6.3 · CVSS 3.1 4.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103288Published

Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

cve-program ·

Vendor product: Ghost

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103256Published

n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

cve-program ·

Vendor product: n8n

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103252Published

n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

cve-program ·

Vendor product: n8n

CVSS 4.0 7.1 · CVSS 3.1 7.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103248Published

n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

cve-program ·

Vendor product: n8n

CVSS 4.0 7.1 · CVSS 3.1 9.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103244Published

ground-station before 0.8.0 Authentication Bypass via setup.restore

cve-program ·

Vendor product: ground-station

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103289Published

Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

cve-program ·

Vendor product: Ghost

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103757Published

Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

cve-program ·

Vendor product: budibase

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103067Published

WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://wordpress.org/plugins: memberful-wp

CVSS 3.1 8.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103343Published

WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: fluentform

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103338Published

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: unlimited-elements-for-elementor

CVSS 3.1 8.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102390Published

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: affi-affiliate-marketing-for-woo

CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103063Published

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: elementskit-lite

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-62063Published

WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: tour-booking-manager

CVSS 3.1 5.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-62060Published

WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: captivatesync-trade

CVSS 3.1 7.6Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103339Published

WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: metform

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102394Published

WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: essential-addons-for-elementor-lite

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-62061Published

WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: profilegrid-user-profiles-groups-and-communities

CVSS 3.1 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103292Published

Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

cve-program ·

Vendor product: Ghost

CVSS 4.0 8.6 · CVSS 3.1 8.0Source modified 1 Oct 2026Recorded 23 Oct 2026

GHSA-8cp2-47hg-mfghPublished

Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

osv · BIT-aspnet-core-2026-69304 · BIT-dotnet-2026-69304 · BIT-dotnet-sdk-2026-69304 · CVE-2026-69304

NuGet: Microsoft.AspNetCore.Server.IISIntegration · NuGet: Microsoft.AspNetCore.Server.IISIntegration · NuGet: Microsoft.AspNetCore.Server.IISIntegration

MODERATESource modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-82300Published

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

cve-program ·

Vendor product: Elasticsearch

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-103656Rejected

this is rejected

cve-program ·

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-16025Published

Improper Payment Validation in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

cve-program ·

Vendor product: PayTR Virtual Pos iFrame API WHMCS Module

CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-16272Published

Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

cve-program ·

Vendor product: PayTR Virtual Pos iFrame API WHMCS Module

CVSS 3.1 9.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-16037Published

Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

cve-program ·

Vendor product: PayTR Virtual Pos iFrame API WHMCS Module

CVSS 3.1 7.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100653Published

vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

cve-program ·

Vendor product: vllm

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100650Published

vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-76844Published

zlib 1.2.11 through 1.3.2 Heap Buffer Overflow via Stale gzwrite Pointer After Failed Write

cve-program ·

Vendor product: zlib

CVSS 4.0 8.3 · CVSS 3.1 7.4Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2023-1989Published

Kernel: use after free bug in btsdio_remove due to race condition

cve-program ·

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git: linux · https://access.redhat.com/downloads/content/package-browser/: kernel-rt · https://access.redhat.com/downloads/content/package-browser/: kernel

CVSS 3.1 7.0Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101147Published

Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

cve-program ·

Vendor product: Featured Image from URL (FIFU) · Vendor product: Featured Image from URL (FIFU) Premium

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101148Published

BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

cve-program ·

Vendor product: BackupSheep WordPress Backup Plugin

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-19253Published

Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url

cve-program ·

Vendor product: Cache Enabler

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81739Published

Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

cve-program ·

Vendor product: Paytm Payment Gateway

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-100823Published

Spoofing issue in the Downloads component in Firefox for Android

cve-program ·

Vendor product: Firefox

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-81809Published

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

cve-program ·

Vendor product: Paytm Payment Gateway

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-86610Published

Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

cve-program ·

Vendor product: Download Manager

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-87970Published

If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes

cve-program ·

Vendor product: If-So Dynamic Content

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-87973Published

If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name

cve-program ·

Vendor product: If-So Dynamic Content

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-89296Published

Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

cve-program ·

Vendor product: Pro Like Button

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-90972Published

WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

cve-program ·

Vendor product: WP Fusion Lite

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-90974Published

WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update

cve-program ·

Vendor product: WP Fusion Lite

Source modified 1 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.