Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698685 source statements · aliases may refer to the same vulnerability

CVE-2026-92412Published

Five Star Restaurant Reviews < 2.3.14 - Reflected XSS

cve-program ·

Vendor product: Five Star Restaurant Reviews

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-96173Published

Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

cve-program ·

Vendor product: Payments for Hubtel

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-96200Published

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

cve-program ·

Vendor product: Payments for Hubtel

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-96255Published

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log

cve-program ·

Vendor product: Payments for Hubtel

Source modified 1 Oct 2026Recorded 23 Oct 2026

GHSA-527h-q9f6-p7qxPublished

Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability

osv · BIT-dotnet-2026-69439 · BIT-dotnet-sdk-2026-69439 · CVE-2026-69439

NuGet: Microsoft.DiaSymReader.Native

HIGHSource modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-94684Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection.

cve-program ·

Source modified 1 Oct 2026Recorded 23 Oct 2026

RUSTSEC-2026-0317Published

A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process

osv · GHSA-w5x2-6474-pqp4

crates.io: sheets-diff

Source modified 1 Oct 2026Recorded 24 Oct 2026

CVE-2026-0019Published

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

cve-program ·

Vendor product: Android

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-0018Published

In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User in…

cve-program ·

Vendor product: Android

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-0017Published

In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i…

cve-program ·

Vendor product: Android

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-0016Published

In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution privi…

cve-program ·

Vendor product: Android

Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-65482Published

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: lastudio-element-kit

CVSS 3.1 6.5Source modified 1 Oct 2026Recorded 23 Oct 2026

MAL-2026-17304Published

Malicious code in dotenv-precheck (npm)

osv ·

npm: dotenv-precheck

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-17324Published

Malicious code in dotenv-preflight (npm)

osv ·

npm: dotenv-preflight

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-17224Published

Malicious code in fabric-asset-pipeline (npm)

osv ·

npm: fabric-asset-pipeline

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-17306Published

Malicious code in fabric-loader-core (npm)

osv ·

npm: fabric-loader-core

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-17418Published

Malicious code in future-scripts (npm)

osv ·

npm: future-scripts

Source modified 1 Oct 2026Recorded 24 Oct 2026

CVE-2026-102424Published

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4

cve-program ·

Vendor product: com_baforms

CVSS 4.0 8.9Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-93464Published

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

cve-program ·

Vendor product: baserCMS

CVSS 3.0 5.4 · CVSS 4.0 5.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-93462Published

A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may obtain sensitive information.

cve-program ·

Vendor product: baserCMS

CVSS 3.0 5.3 · CVSS 4.0 6.9Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-93460Published

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

cve-program ·

Vendor product: baserCMS

CVSS 3.0 5.4 · CVSS 4.0 5.1Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-84063Published

BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited, an arbitrary file may be uploaded by an attacker who can log in to the product, potentially allowin…

cve-program ·

Vendor product: BurgerEditor · Vendor product: BurgerEditor

CVSS 3.0 6.5 · CVSS 4.0 8.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-84062Published

BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of the page may be altered by an attacker who can log in to the product.

cve-program ·

Vendor product: BurgerEditor

CVSS 3.0 4.3 · CVSS 4.0 5.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-102425Published

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4

cve-program ·

Vendor product: com_baforms

CVSS 4.0 9.5Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-101126Published

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4

cve-program ·

Vendor product: com_baforms

CVSS 4.0 6.9Source modified 1 Oct 2026Recorded 23 Oct 2026

MAL-2026-16340Published

Malicious code in pf25262 (npm)

osv · GHSA-3pg3-52vp-54fg

npm: pf25262

Source modified 1 Oct 2026Recorded 24 Oct 2026

CVE-2026-90916Published

Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 5.1Source modified 1 Oct 2026Recorded 23 Oct 2026

MAL-2026-16338Published

Malicious code in pf23727 (npm)

osv · GHSA-p2hc-jmvm-qwc9

npm: pf23727

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-16365Published

Malicious code in my-ctf-helper-script-9921 (npm)

osv · GHSA-7mhc-78r2-fgw8

npm: my-ctf-helper-script-9921

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-16341Published

Malicious code in pflag14570 (npm)

osv · GHSA-qxgf-vc83-fc34

npm: pflag14570

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-16342Published

Malicious code in pflag29424 (npm)

osv · GHSA-8jr8-g7mm-57m6

npm: pflag29424

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-16339Published

Malicious code in pf25133 (npm)

osv · GHSA-8f7g-cf69-g5p8

npm: pf25133

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2026-16254Published

Malicious code in pulse-pwn-9f3a2 (npm)

osv · GHSA-fwr5-cj49-cq4h

npm: pulse-pwn-9f3a2

Source modified 1 Oct 2026Recorded 24 Oct 2026

CVE-2026-101127Published

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4

cve-program ·

Vendor product: com_baforms

CVSS 4.0 8.6Source modified 1 Oct 2026Recorded 23 Oct 2026

GHSA-vcvr-r3jv-pc5jPublished

Next.js: Remote Code Execution in next/og ImageResponse

osv ·

npm: next

CRITICALSource modified 1 Oct 2026Recorded 24 Oct 2026

CVE-2026-47569Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a type confusion via a handle recycle race. A successful exploit of this vulnerability might lead to code execution, denial of se…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47563Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to code execution, denial of service, escalatio…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47561Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47560Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escal…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47559Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonging to another user's process. A successful exploit of this vulnerability might lead to code execution…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47558Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, de…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47556Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an integer overflow that leads to an out-of-bounds write. A successful exploit of this vulnerability mi…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47553Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47552Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorization check and modify privileged configuration. A successful exploit of this vulnerability might lead …

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47551Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escalat…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47550Published

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged local user can supply an untrusted pointer that the driver dereferences without validation. A successful exploit of this vulnerabi…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47548Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of servi…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47545Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of servic…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47530Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of servi…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2026-47540Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 7.8Source modified 1 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.