Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698686 source statements · aliases may refer to the same vulnerability

CVE-2026-47517Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode driver where a local user may cause a null pointer dereference by submitting a crafted ioctl. A successful exploit of this vulnerability might lead to denial of…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47534Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a divide by zero. A successful exploit of this vulnerability might lead to denial of service.

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47549Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel module where an unprivileged local user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47555Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be copied back to userspace. A successful exploit of this vulnerability might lead to …

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47557Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47566Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leading to kernel memory exhaustion. A successful exploit of this vulnerability might …

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47567Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability mig…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47568Published

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generation by repeatedly invoking an interface that emits unrate-limited error messages. A successful exp…

cve-program ·

Vendor product: GeForce · Vendor product: GeForce · Vendor product: RTX, Quadro, NVS

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47581Published

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper locking. A successful exploit of this vulnerability might lead to denial of service.

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47584Published

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker with local access could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-47603Published

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerabi…

cve-program ·

Vendor product: GeForce · Vendor product: RTX, Quadro, NVS · Vendor product: GeForce

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-32599Published

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct string concatenation of user-supplied input. This allows an authe…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-47252Published

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.0Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-47780Published

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/api_datarepository.go validate the ueId path value with a regular …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-49254Published

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/hand…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-49446Published

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunne…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-50006Published

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-50018Published

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, remote post-serve actions use `http.DefaultClient` without any timeout configuration. When the remote endpoint is unreachable or intentionally slow (accepts TCP connec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-53957Published

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54072Published

Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `AllowedOrigins`. When `response_type=token` or …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54450Published

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54452Published

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54504Published

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with START_…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54541Published

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TriePro…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54542Published

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieN…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54561Published

MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54628Published

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without res…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54629Published

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, auth…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54632Published

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted byte…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54637Published

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through Re…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54688Published

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed(…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-54689Published

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55091Published

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp an…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55093Published

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimen…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55149Published

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55178Published

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a se…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55591Published

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKCon…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.8Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55617Published

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55636Published

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the validating webhook with namespace/finalize instead of the Kubernetes resource name na…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55650Published

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerousl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.4Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55828Published

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A craf…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-55887Published

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-57441Published

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canon…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.4Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-57442Published

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules path …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-57497Published

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, ret…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-58196Published

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-58200Published

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-58201Published

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled pat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-58483Published

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-reader…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-58485Published

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the lit…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 30 Sep 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.