Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698686 source statements · aliases may refer to the same vulnerability

CVE-2026-46711Published

Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

cve-program ·

Vendor product: security

CVSS 3.1 8.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102908Published

SourceCodester Online Reviewer Management System questions-view.php sql injection

cve-program ·

Vendor product: Online Reviewer Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101033Published

KitchenOwl through 0.7.10 IDOR via unchecked category ID

cve-program ·

Vendor product: kitchenowl

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92872Published

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

cve-program ·

Vendor product: Pgpool-II

CVSS 3.0 4.3 · CVSS 4.0 5.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92873Published

Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node.

cve-program ·

Vendor product: Pgpool-II

CVSS 3.0 7.3 · CVSS 4.0 6.9Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103396Published

bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount

cve-program ·

Vendor product: bbs-go

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92867Published

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution.

cve-program ·

Vendor product: Pgpool-II

CVSS 3.0 8.8 · CVSS 4.0 8.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-81310Published

Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance.

cve-program ·

Vendor product: Image Scanner Driver for Linux (fi Series) · Vendor product: Image Scanner Driver for Linux (SP Series)

CVSS 3.1 6.6 · CVSS 4.0 5.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103108Published

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service

cve-program ·

Vendor product: Infinity

CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103054Published

AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP

cve-program ·

Vendor product: AiSOC

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102330Published

Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-15154Published

Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex

cve-program ·

https://github.com/trustyai-explainability/guardrails-detectors: guardrails-detectors · https://catalog.redhat.com/software/containers/: rhoai/odh-built-in-detector-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-built-in-detector-rhel9

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102310Published

Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102320Published

Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100842Published

MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

cve-program ·

Vendor product: MONAI

CVSS 4.0 7.3 · CVSS 3.1 7.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102911Published

zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection

cve-program ·

Vendor product: pi-llm-wiki

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102329Published

Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102312Published

UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-77185Published

Apache MINA SSHD: Asynchronous authentication can bypass signature verification

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.sshd:sshd-core

CVSS 3.1 9.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103239Published

MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

cve-program ·

Vendor product: MISP

CVSS 4.0 8.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95340Published

Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95342Published

Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95361Published

Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94952Published

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuration handler) and is tr…

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-79537Published

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id …

cve-program ·

Vendor product: n/a

Source modified 30 Sep 2026Recorded 23 Oct 2026

MAL-2026-10497Published

Malicious code in ddok-modal (npm)

osv · GHSA-5xvp-j6m9-rwr6

npm: ddok-modal

Source modified 30 Sep 2026Recorded 24 Oct 2026

CVE-2026-102511Published

Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

cve-program ·

https://golang.org/pkg: github.com/apache/plc4x/plc4go · https://repo.maven.apache.org/maven2: org.apache.plc4x:plc4j-driver-ads · https://repo.maven.apache.org/maven2: org.apache.plc4x:plc4j-driver-modbus

CVSS 4.0 8.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92284Published

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body midd…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-92700Published

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules o…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-82877Published

ILIAS Arbitrary File Read via SOAP addFile

cve-program ·

https://github.com/ILIAS-eLearning/ILIAS: ILIAS

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-80428Published

ILIAS PHP Object Injection via Shibboleth Logout

cve-program ·

https://github.com/ILIAS-eLearning/ILIAS: ILIAS

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-82538Published

ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

cve-program ·

https://github.com/ILIAS-eLearning/ILIAS: ILIAS

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103116Published

OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection

cve-program ·

Vendor product: openSIS-Classic

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100699Published

Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-100700Published

nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-f…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-100701Published

Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Secondary 5.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-100702Published

Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recur…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Secondary 5.9Source modified 30 Sep 2026Recorded 25 Oct 2026

CVE-2026-103222Published

Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow

cve-program ·

Vendor product: C-Blosc2

CVSS 4.0 6.3 · CVSS 3.1 5.6 · CVSS 3.0 5.6 · CVSS 2.0 5.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102983Published

Astro: Netlify Image CDN allowlist bypass enables SSRF

cve-program ·

Vendor product: astro · Vendor product: netlify

CVSS 4.0 6.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-13087Rejected

This CVE was reserved in error and duplicates CVE-2026-89530.

cve-program ·

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92227Published

Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 8.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-18951Published

Odh-training-operator-rhel9: [trainer v2 security] trn-02: rhoai overlay aggregates trainjobs crud into standard edit clusterrole

cve-program ·

https://catalog.redhat.com/software/containers/: rhoai/odh-training-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-training-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-training-operator-rhel9

CVSS 3.1 8.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-16745Published

Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation

cve-program ·

https://catalog.redhat.com/software/containers/: rhoai/odh-dashboard-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-dashboard-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-dashboard-rhel9

CVSS 3.1 8.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-15378Published

Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)

cve-program ·

https://catalog.redhat.com/software/containers/: rhoai/odh-fms-guardrails-orchestrator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-fms-guardrails-orchestrator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-fms-guardrails-orchestrator-rhel9

CVSS 3.1 9.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-90915Published

Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 7.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92226Published

Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 7.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-92224Published

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 5.9Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-76570Published

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

cve-program ·

Vendor product: JCTables extension for Joomla

CVSS 4.0 10.0Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-90907Published

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

cve-program ·

Vendor product: Joomla! CMS

CVSS 4.0 6.9Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-101111Published

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6

cve-program ·

Vendor product: com_booklibrary

CVSS 4.0 5.3Source modified 30 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.