Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698686 source statements · aliases may refer to the same vulnerability

MAL-2025-49214Published

Malicious code in epic-web-payment-management-iframe (npm)

osv ·

npm: epic-web-payment-management-iframe

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2025-49208Published

Malicious code in epic-ue-utils (npm)

osv ·

npm: epic-ue-utils

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2025-49211Published

Malicious code in epic-video-player (npm)

osv ·

npm: epic-video-player

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2025-49213Published

Malicious code in epic-web-payment-management (npm)

osv ·

npm: epic-web-payment-management

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2025-49215Published

Malicious code in epic-web-payment-management-sandbox (npm)

osv ·

npm: epic-web-payment-management-sandbox

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2025-49217Published

Malicious code in epic-web-sso (npm)

osv ·

npm: epic-web-sso

Source modified 1 Oct 2026Recorded 24 Oct 2026

MAL-2025-49210Published

Malicious code in epic-ui-toolkit (npm)

osv ·

npm: epic-ui-toolkit

Source modified 1 Oct 2026Recorded 24 Oct 2026

CVE-2024-1233Published

Eap: wildfly-elytron has a ssrf security issue

cve-program ·

https://github.com/wildfly/wildfly: wildfly · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: org.wildfly.security/wildfly-elytron · https://access.redhat.com/downloads/content/package-browser/: eap7-glassfish-el

CVSS 3.1 7.3Source modified 1 Oct 2026Recorded 23 Oct 2026

CVE-2025-6558Published

Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 1 Oct 2026Recorded 23 Oct 2026

GHSA-q5pr-72pq-83v3Published

H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

osv · CVE-2026-86250

npm: h3

MODERATESource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-4mh8-r7rc-xpvcPublished

fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

osv · CVE-2026-92081

npm: fastify

MODERATESource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-9q9j-q6p8-xq58Published

fastify vulnerable to header validation bypass via incomplete schema case normalization

osv · CVE-2026-84428

npm: fastify

HIGHSource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-hxh3-vqpv-xpqvPublished

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

osv · CVE-2026-93981

npm: hono

MODERATESource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-p68q-wchp-6fh7Published

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

osv · CVE-2026-76169

npm: fastify

HIGHSource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-6623-4q32-82v8Withdrawn

Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

osv ·

npm: hono

LOWSource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-hwr6-493r-vm6hPublished

fastify vulnerable to request validation bypass via skipped boolean false schemas

osv · CVE-2026-84469

npm: fastify

HIGHSource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-35g8-35p8-c8fwPublished

Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

osv · CVE-2026-102821

crates.io: russh

MODERATESource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-fg72-q65g-wm5wWithdrawn

Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

osv ·

npm: h3

HIGHSource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-g4mp-vgx3-xrvmPublished

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

osv · CVE-2026-102820

crates.io: pageant

MODERATESource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-667r-xxjv-c9mmPublished

fastify vulnerable to request body replacement via an async validation result collision

osv · CVE-2026-84504

npm: fastify

HIGHSource modified 1 Oct 2026Recorded 24 Oct 2026

GHSA-qh8j-hqjv-7m4xPublished

Astro: Malformed port in the Host header can crash the Node adapter

osv · CVE-2026-102984

npm: @astrojs/node

HIGHSource modified 30 Sep 2026Recorded 24 Oct 2026

GHSA-47hw-gvq5-r2gmPublished

russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

osv · CVE-2026-102823

crates.io: russh

HIGHSource modified 30 Sep 2026Recorded 24 Oct 2026

GHSA-4233-jc72-56c5Published

Astro: Netlify Image CDN allowlist bypass enables SSRF

osv · CVE-2026-102983

npm: @astrojs/netlify

MODERATESource modified 30 Sep 2026Recorded 24 Oct 2026

GHSA-p8qx-h547-fjw9Published

russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic

osv · CVE-2026-102822

crates.io: russh

LOWSource modified 30 Sep 2026Recorded 24 Oct 2026

GHSA-w3jg-pjxf-73p4Published

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

osv · CVE-2026-102824

crates.io: russh

MODERATESource modified 30 Sep 2026Recorded 24 Oct 2026

GHSA-g6xm-f9xp-qq35Published

Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path

osv · CVE-2026-102825

crates.io: russh

LOWSource modified 30 Sep 2026Recorded 24 Oct 2026

CVE-2026-101084Published

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.6Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101062Published

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 8.8Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2025-10097Published

A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2025-14764Published

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "inst…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 6.0 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 5.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2025-58430Published

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2025-58752Published

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2025-59145Published

color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a m…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2025-68154Published

systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is dir…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-100888Published

Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds write

cve-program ·

Vendor product: OpenDKIM

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100885Published

Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

cve-program ·

Vendor product: laravel-crm

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100882Published

Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scripting

cve-program ·

Vendor product: laravel-crm

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101088Published

Nezha before 2.3.1 Denial of Service via Concurrent Server Delete

cve-program ·

Vendor product: nezha

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101084Published

obot before v0.21.1 Authorization Bypass via /mcp-connect

cve-program ·

Vendor product: obot

CVSS 4.0 9.3 · CVSS 3.1 9.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101062Published

Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

cve-program ·

Vendor product: obot

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100879Published

zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization

cve-program ·

Vendor product: StarTraining

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100876Published

mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100873Published

mathurvishal CloudClassroom-PHP-Project cross-site request forgery

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101058Published

python-utcp before 1.1.12 SSRF via Remote HTTP Manual

cve-program ·

Vendor product: python-utcp

CVSS 4.0 7.1 · CVSS 3.1 6.9Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47097Published

AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle

cve-program ·

Vendor product: HELO Plus

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102992Published

piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollutio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102990Published

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts back…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102824Published

Russh is a Rust SSH client and server library. Prior to 0.63.0, the hybrid ML-KEM 768 and X25519 implementation in russh/src/kex/hybrid_mlkem.rs accepts an all-zero 32-byte peer X25519 public key in both server_dh and compute_shared_secret,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102820Published

pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2025-14300Published

Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425

cve-program ·

Vendor product: Tapo C200 · Vendor product: Tapo C100 v5 · Vendor product: Tapo C425 v1.2

CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.