Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698686 source statements · aliases may refer to the same vulnerability

CVE-2026-88062Published

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand valu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-94545Published

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be in…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 30 Sep 2026Recorded 27 Oct 2026

CVE-2026-102281Published

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. Ser…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-103548Published

Improperly Stored Credentials

cve-program ·

Vendor product: MV-90 xi

CVSS 4.0 5.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103547Published

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connectio…

cve-program ·

Vendor product: OpenBSD

CVSS 4.0 9.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101885Published

ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path

cve-program ·

Vendor product: ZeroClaw

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103387Published

garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

cve-program ·

Vendor product: uri-js

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102991Published

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

cve-program ·

Vendor product: mako

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-90979Published

Apache Karaf: LDAP filter injection in JAAS LDAP login modules

cve-program ·

Vendor product: org.apache.karaf.jaas.modules.ldap

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101881Published

OpenClaw Windows Node before 2026.7.1 Denial of Service

cve-program ·

Vendor product: OpenClaw Windows Node

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102938Published

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

cve-program ·

Vendor product: virtualenv

CVSS 4.0 5.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-88815Published

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv

cve-program ·

https://cpan.org/modules: DBI

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-55174Published

UltrafastSecp256k1: ECDSA adaptor verification accepts non-adaptable pre-signatures due to missing DLEQ binding

cve-program ·

Vendor product: UltrafastSecp256k1

CVSS 3.1 5.9Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92121Published

Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.wss4j:wss4j-ws-security-stax

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-88816Published

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName

cve-program ·

https://cpan.org/modules: DBI

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-55181Published

Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false

cve-program ·

Vendor product: tugtainer

CVSS 3.1 9.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-89238Published

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.wss4j:wss4j-ws-security-dom

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-85644Published

XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference

cve-program ·

https://cpan.org/modules: XS-Parse-Keyword

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-91095Published

In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then inst…

cve-program ·

Vendor product: proxygen

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-55107Published

Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

cve-program ·

Vendor product: kobako

CVSS 3.1 10.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-88920Published

Apache WSS4J: SAML Sender-Vouches Authentication Bypass

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.wss4j:wss4j-ws-security-dom

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-12425Published

Reflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10

cve-program ·

https://www.powerschool.com/: Employee Access Center

CVSS 4.0 5.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-91096Published

In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before de…

cve-program ·

Vendor product: proxygen

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-87830Published

Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.wss4j:wss4j-ws-security-policy-stax

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100756Published

Incorrect boundary conditions in the Audio/Video: Playback component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100758Published

Sandbox escape in the DOM: Navigation component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-85532Published

Apache WSS4J: Insufficient Validation of Derived-Key Parameters

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.wss4j:wss4j-ws-security-common

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-67993Published

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback.

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95301Published

Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94029Published

Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.sshd:sshd-sftp

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92870Published

A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination.

cve-program ·

Vendor product: Pgpool-II

CVSS 3.0 7.5 · CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95366Published

Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92869Published

An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.

cve-program ·

Vendor product: Pgpool-II

CVSS 3.0 6.5 · CVSS 4.0 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95297Published

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92868Published

An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication.

cve-program ·

Vendor product: Pgpool-II

CVSS 3.0 6.5 · CVSS 4.0 6.9Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102984Published

Astro: Malformed port in the Host header can crash the Node adapter

cve-program ·

Vendor product: astro

CVSS 4.0 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95375Published

Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101894Published

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attack…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101898Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 wi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101900Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process protot…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101902Published

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnera…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101903Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malf…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101904Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototyp…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101906Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101907Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.0Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-101908Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process pr…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102600Published

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special p…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-102983Published

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Becau…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-53496Published

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where find…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54155Published

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verif…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 30 Sep 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.