Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698750 source statements · aliases may refer to the same vulnerability

CVE-2026-102623Published

Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: container-native-virtualization/virt-controller · https://access.redhat.com/downloads/content/package-browser/: container-native-virtualization/virt-controller-rhel9

CVSS 3.1 6.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102676Published

Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions

cve-program ·

Vendor product: electron

CVSS 3.1 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-77177Published

Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluation …

cve-program ·

Vendor product: n/a

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102334Published

Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

cve-program ·

Vendor product: nginx-proxy-manager

CVSS 4.0 9.1 · CVSS 3.1 7.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101260Published

Ziroom ZHOME A0101 firstLogin command injection

cve-program ·

Vendor product: ZHOME A0101

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-24061Published

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

cve-program ·

Vendor product: Inetutils

CVSS 3.1 9.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-84463Published

Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute

cve-program ·

Vendor product: zammad

CVSS 4.0 6.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-75569Published

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-engine/mce-operator-bundle · https://catalog.redhat.com/software/containers/: multicluster-engine/mce-operator-bundle · https://catalog.redhat.com/software/containers/: multicluster-engine/mce-operator-bundle

CVSS 3.1 7.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101203Published

FastStone Image Viewer 1bpp RLE Decoder out-of-bounds write

cve-program ·

Vendor product: Image Viewer

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-73269Published

Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-curator-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-curator-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-curator-controller-rhel9

CVSS 3.1 9.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-63216Published

Zammad: Stored XSS via unescaped option labels in the object attribute options context UI

cve-program ·

Vendor product: zammad

CVSS 4.0 5.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-73268Published

Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

cve-program ·

CVSS 3.1 9.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-73267Published

Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-engine/clusterclaims-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/clusterclaims-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/clusterclaims-controller-rhel9

CVSS 3.1 7.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-73266Published

Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

cve-program ·

CVSS 3.1 7.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-66795Published

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-engine/managedcluster-import-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/managedcluster-import-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/managedcluster-import-controller-rhel9

CVSS 3.1 9.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-66794Published

Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-proxy-addon-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-proxy-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/cluster-proxy-rhel9

CVSS 3.1 9.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-19130Published

Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-engine/provider-credential-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/provider-credential-controller-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-engine/provider-credential-controller-rhel9

CVSS 3.1 5.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-63205Published

Zammad: Channel admins can read unauthorized attachments via signature rich-text body

cve-program ·

Vendor product: zammad

CVSS 4.0 5.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102277Published

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

cve-program ·

Vendor product: brace-expansion

CVSS 3.1 5.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-100192Published

X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

cve-program ·

Vendor product: X-SpringBoot

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102274Published

PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

cve-program ·

Vendor product: pyjwt

CVSS 3.1 5.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-56725Published

Zammad: Denial of Service via OTRS Import Controller

cve-program ·

Vendor product: zammad

CVSS 4.0 8.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102270Published

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

cve-program ·

Vendor product: pyjwt

CVSS 3.1 4.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-56730Published

Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

cve-program ·

Vendor product: zammad

CVSS 4.0 2.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102266Published

PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation

cve-program ·

Vendor product: pyjwt

CVSS 3.1 7.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-56734Published

Zammad: Avatar Image URL Server-Side Request Forwarding

cve-program ·

Vendor product: zammad

CVSS 4.0 5.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-97882Published

mathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-11415Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-67420Published

RabbitMQ OAuth credential refresh retains revoked runtime tags

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 2.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-13019Published

Missing Authentication

cve-program ·

Vendor product: Portal for ArcGIS

CVSS 3.1 9.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-67413Published

RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.0Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-61837Published

RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-67241Published

RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 4.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-100392Published

InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)

cve-program ·

Vendor product: InvoicePlane

CVSS 4.0 7.0Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-66078Published

RabbitMQ: protected tag bypass via bulk-delete

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 2.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101187Published

Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection

cve-program ·

Vendor product: ZHOME A0101

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-67230Published

RabbitMQ: Web-STOMP unbounded pre-auth accumulation

cve-program ·

Vendor product: rabbitmq-server

CVSS 4.0 6.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-87741Published

ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

cve-program ·

Vendor product: ConvertPlus

CVSS 3.1 8.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101914Published

@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches

cve-program ·

Vendor product: grpc-node

CVSS 3.1 6.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-92161Published

FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

cve-program ·

Vendor product: oauth

CVSS 3.1 9.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-62262Published

Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`

cve-program ·

Vendor product: Piwigo

CVSS 3.1 9.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101263Published

Ziroom ZHOME A0101 set_online_client command injection

cve-program ·

Vendor product: ZHOME A0101

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95302Published

Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-33639Published

InvoicePlane permits DDL injection through tax_rate_decimal_places

cve-program ·

Vendor product: InvoicePlane

CVSS 3.1 7.2Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95317Published

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95312Published

Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95289Published

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95368Published

Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95296Published

Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95316Published

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 29 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.