Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698746 source statements · aliases may refer to the same vulnerability

CVE-2026-62080Published

WordPress Happy Addons for Elementor plugin <= 3.23.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: happy-elementor-addons

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94178Published

WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability

cve-program ·

https://wordpress.org/plugins: import-users-from-csv-with-meta

CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-62079Published

WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: qi-addons-for-elementor

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-62078Published

WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: premium-addons-for-elementor

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102398Published

WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: popup-by-supsystic

CVSS 3.1 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-27371Published

WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wpfunnels

CVSS 3.1 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94194Published

Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

cve-program ·

https://repo.hex.pm: mint · https://github.com: elixir-mint/mint

CVSS 4.0 6.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-27085Published

WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability

cve-program ·

https://wordpress.org/themes: astra

CVSS 3.1 2.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94173Published

WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: business-directory-plugin

CVSS 3.1 5.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94123Published

WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

cve-program ·

https://wordpress.org/plugins: nextgen-gallery

CVSS 3.1 7.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-93514Published

WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: notification-for-telegram

CVSS 3.1 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-62085Published

WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: wp-security-audit-log

CVSS 3.1 7.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-62081Published

WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability

cve-program ·

https://wordpress.org/plugins: flexible-coupons

CVSS 3.1 5.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-81867Published

Deserialization of Untrusted Data in Application Integration allows Remote Code Execution

cve-program ·

Vendor product: Application Integration

CVSS 4.0 9.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-7171Published

Stored Cross-Site Scripting (XSS) in TPVEnlanube

cve-program ·

Vendor product: Cloud Web application

CVSS 4.0 4.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-7172Published

Stored Cross-Site Scripting (XSS) in TPVEnlanube

cve-program ·

Vendor product: Cloud Web application

CVSS 4.0 4.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-7170Published

Stored Cross-Site Scripting (XSS) in TPVEnlanube

cve-program ·

Vendor product: Cloud Web application

CVSS 4.0 4.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-81841Published

Paused shared dashboard access tokens still expose data source configuration

cve-program ·

Vendor product: Grafana Enterprise · Vendor product: Grafana OSS

CVSS 3.1 5.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100638Published

SiYuan before v3.8.4 Path Traversal via setNotebookIcon

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.3 · CVSS 3.1 7.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2025-68195Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94286Published

Out-of-bounds read in libXtst's RECORD reply parser

cve-program ·

Vendor product: libXtst

CVSS 3.1 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94285Published

Out-of-bounds read in libX11's byte-oriented codeset parser

cve-program ·

Vendor product: libX11

CVSS 3.1 5.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-74864Published

Authentication Bypass in sogo_yhn

cve-program ·

Vendor product: sogo_yhn

CVSS 4.0 9.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-74865Published

Authentication Bypass in sogo_yhn

cve-program ·

Vendor product: sogo_yhn

CVSS 4.0 9.2Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100609Published

Flowise through 3.1.4 Insecure Direct Object Reference via Credential

cve-program ·

Vendor product: Flowise · Vendor product: Flowise

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100605Published

Flowise through 3.1.4 Missing Authorization via Chat Message Routes

cve-program ·

Vendor product: Flowise

CVSS 4.0 7.5 · CVSS 3.1 7.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94284Published

Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser

cve-program ·

Vendor product: libX11

CVSS 3.1 5.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100601Published

ClawHub SSRF via Unchecked DNS Resolution in Profile Image

cve-program ·

Vendor product: clawhub

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-103321Published

MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

cve-program ·

Vendor product: MISP

CVSS 4.0 8.3Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94283Published

Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser

cve-program ·

Vendor product: libX11

CVSS 3.1 6.5Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-94282Published

Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion

cve-program ·

Vendor product: libXi

CVSS 3.1 5.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95287Published

Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95292Published

Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-95352Published

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-76738Published

Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service

cve-program ·

Vendor product: Instant ON

CVSS 3.1 2.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-86530Published

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command.

cve-program ·

Vendor product: WSR-300HP · Vendor product: WEX-G300

CVSS 3.1 7.2 · CVSS 4.0 8.6Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-82546Published

Apache Roller: Stored cross-site scripting through incoming Trackback links

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 6.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-91204Published

Apache Roller: Stored javascript: URI in HTML comments

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 6.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-91206Published

Apache Roller: Reflected XSS in the optional LDAP comment authenticator

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 6.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-40552Published

Remote Code Execution in multiple BinSoft products

cve-program ·

Vendor product: mpGabinet · Vendor product: mpFirma · Vendor product: mpFaktura

CVSS 4.0 4.7Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-40551Published

Use of Client-Side Authentication in multiple BinSoft products

cve-program ·

Vendor product: mpGabinet · Vendor product: mpFirma · Vendor product: mpFaktura

CVSS 4.0 8.4Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-40550Published

Privilege Escalation in multiple BinSoft products

cve-program ·

Vendor product: mpGabinet · Vendor product: mpFirma · Vendor product: mpFaktura

CVSS 4.0 6.9Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102374Published

GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector

cve-program ·

Vendor product: GestSup

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-102372Published

GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector

cve-program ·

Vendor product: GestSup

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-100389Published

GestSup before 3.2.62 Remote Code Execution via IMAP Attachment

cve-program ·

Vendor product: GestSup

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 30 Sep 2026Recorded 23 Oct 2026

CVE-2026-15442Published

Heap use-after-free on read during bidirectional (D)TLS shutdown

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 2.3Source modified 30 Sep 2026Recorded 23 Oct 2026

MAL-2026-17329Published

Malicious code in focaleys (npm)

osv ·

npm: focaleys

Source modified 30 Sep 2026Recorded 24 Oct 2026

MAL-2026-17406Published

Malicious code in spencer-baileys (npm)

osv ·

npm: spencer-baileys

Source modified 30 Sep 2026Recorded 24 Oct 2026

MAL-2026-17391Published

Malicious code in eliteprotech-baileys (npm)

osv ·

npm: eliteprotech-baileys

Source modified 30 Sep 2026Recorded 24 Oct 2026

MAL-2026-17409Published

Malicious code in xvinleys (npm)

osv ·

npm: xvinleys

Source modified 30 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.