Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698686 source statements · aliases may refer to the same vulnerability

CVE-2026-102994Published

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

cve-program ·

Vendor product: pypdf

CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102998Published

pypdf: Possible long runtimes when generating appearance streams

cve-program ·

Vendor product: pypdf

CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103000Published

pypdf: Possible large memory usage when retrieving alphabetical page labels

cve-program ·

Vendor product: pypdf

CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102996Published

pypdf: Possible large memory usage when parsing font data

cve-program ·

Vendor product: pypdf

CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102992Published

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

cve-program ·

Vendor product: piscina

CVSS 4.0 9.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100241Published

Private change tags exposed to anonymous users via revision-tags-change events

cve-program ·

Vendor product: Mediawiki - EventBus Extension

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100243Published

Stored XSS in WikiSEO author and image properties on action=info

cve-program ·

Vendor product: Mediawiki - WikiSEO Extension

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100244Published

CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

cve-program ·

Vendor product: Mediawiki - CentralAuth Extension

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100245Published

Stored XSS on Wikibase Special:SetSiteLink via unescaped system message

cve-program ·

Vendor product: Mediawiki - Wikibase Extension

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102758Published

The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data. It is the primitive underneath all X.509 certificate parsing in NetX Secure, and therefore runs on certificates suppli…

cve-program ·

Vendor product: NetX Duo

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102761Published

NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop's upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a …

cve-program ·

Vendor product: NetX Duo

CVSS 4.0 9.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102762Published

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few …

cve-program ·

Vendor product: NetX Duo

CVSS 4.0 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102824Published

Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange

cve-program ·

Vendor product: russh

CVSS 3.1 4.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103045Published

XSS in Refreshed skin

cve-program ·

Vendor product: Mediawiki - Refreshed skin

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-76730Published

Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs

cve-program ·

Vendor product: Instant ON

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-55177Published

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family (api/routes/esri.ts) takes a fully attacker-controlled URL from the req…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.6Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102984Published

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102829Published

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv dr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102825Published

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_au…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102821Published

Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required SSH_MSG_KEX_ECDH_INIT and then flood SSH_MSG_CHANNEL_OPEN messages while SessionKexState::InProgress …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-97059Published

DCMTK through 3.7.0 Heap Over-read via NumberOfFrames

cve-program ·

Vendor product: DCMTK

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100612Published

Capgo SSO Provider ID Authentication Bypass via Incomplete Migration

cve-program ·

Vendor product: capgo.app

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100669Published

Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100673Published

Grav Data Manager before 1.4.5 Stored XSS via item-detail view

cve-program ·

Vendor product: grav-plugin-datamanager

CVSS 4.0 8.4 · CVSS 3.1 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86330Published

Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: odf4/mcg-core-rhel9 · https://access.redhat.com/downloads/content/package-browser/: rhceph-dev/odf4-mcg-core-rhel9

CVSS 3.1 7.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94954Published

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formFilter (access-control / URL filter configuration handle…

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-79535Published

mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-79536Published

bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement.

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94953Published

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig…

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-79534Published

mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helper.go). When filepath.EvalSymlinks returns os.IsNotExist for a dangling symlink, t…

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2024-31027Published

Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration function…

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-79403Published

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-79417Published

Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRP_MJ_CREATE and send a crafted IOCTL 0…

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100822Published

Spoofing issue in the Networking: HTTP component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102521Published

lib0 `readFromDataView` out-of-bounds read

cve-program ·

Vendor product: lib0

CVSS 3.1 8.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-93332Published

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.

cve-program ·

Vendor product: Server

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-97687Published

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

cve-program ·

Vendor product: urllib3

CVSS 4.0 7.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-35191Published

QUIC Unvalidated Amplification Credit may be Over Accounted

cve-program ·

Vendor product: OpenSSL

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-42772Published

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

cve-program ·

Vendor product: OpenSSL

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-54873Published

QUIC STREAM Fragment Metadata DoS

cve-program ·

Vendor product: OpenSSL

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100288Published

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direc…

cve-program ·

Vendor product: Server

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102635Published

ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100238Published

Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

cve-program ·

Vendor product: Mediawiki - Flow Extension

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102820Published

pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

cve-program ·

Vendor product: russh · Vendor product: pageant

CVSS 3.1 6.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102673Published

Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

cve-program ·

Vendor product: electron

CVSS 3.1 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95370Published

Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95290Published

Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95300Published

Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95344Published

Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isolation via a crafted Chrome extension. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95358Published

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.