Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698751 source statements · aliases may refer to the same vulnerability

CVE-2026-102263Published

mwasikz robo-cafe-rms manage-food.php unrestricted upload

cve-program ·

Vendor product: robo-cafe-rms

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102292Published

coolbeans1212 MateisHomePage-Website users.php cross site scripting

cve-program ·

Vendor product: MateisHomePage-Website

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-84154Published

Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x

cve-program ·

Vendor product: GEOVIA Geospatial Data Manager

CVSS 3.1 9.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101169Published

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute a…

cve-program ·

Vendor product: Octopus Server

CVSS 4.0 8.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-96428Published

Flowring Agentflow 4.0 - SQL Injection

cve-program ·

Vendor product: Agentflow 4.0

CVSS 4.0 9.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-94418Published

Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 2.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-96429Published

Flowring Agentflow 4.0 - SQL Injection

cve-program ·

Vendor product: Agentflow 4.0

CVSS 4.0 9.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-66792Published

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-agent-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-manager-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-rhel9-operator

CVSS 3.1 9.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-84784Published

QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

cve-program ·

Vendor product: OpenSSL

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-71576Published

Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

cve-program ·

https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-manager-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-manager-rhel9 · https://catalog.redhat.com/software/containers/: multicluster-globalhub/multicluster-globalhub-manager-rhel9

CVSS 3.1 8.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-93304Published

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 6.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-84783Published

Use-After-Free in X.509 Extension Cache Under Concurrent Use

cve-program ·

Vendor product: OpenSSL

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-93302Published

Trusted peer certificate match ignores public key, allowing forged CA clones

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-100286Published

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.

cve-program ·

Vendor product: Server

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-100287Published

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

cve-program ·

Vendor product: Server

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-100289Published

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning t…

cve-program ·

Vendor product: Server

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-89136Published

Client accepts unsolicited RawPublicKey server certificate type

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-89134Published

Subject CN name-constraint check bypassed when non-DNS SAN present

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 6.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-88778Published

TCP Initial Sequence Number (ISN) prediction

cve-program ·

Vendor product: ADC · Vendor product: Gateway

CVSS 4.0 8.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102491Published

mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection

cve-program ·

Vendor product: kykms

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-63209Published

Integer Overflow or Wraparound and Out-of-bounds Write in compress

cve-program ·

Vendor product: compress

CVSS 3.1 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101139Published

Webkul Bagisto Invoice Mass Status Update state authorization

cve-program ·

Vendor product: Bagisto

CVSS 4.0 5.1 · CVSS 3.1 2.7 · CVSS 3.0 2.7 · CVSS 2.0 3.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102600Published

Socket.IO: Prototype Pollution via Unsafe Client Session Lookup

cve-program ·

Vendor product: socket.io · Vendor product: cluster-engine

CVSS 3.1 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-97689Published

urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory

cve-program ·

Vendor product: urllib3

CVSS 4.0 8.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-89135Published

Failed X509_verify_cert leaves unverified CA in shared CertManager

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 6.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-89133Published

NameConstraints not enforced across unconstrained intermediate CA

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 6.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-44940Published

Service token exposure and potential privilege escalation in SUSE Observability

cve-program ·

Vendor product: rancher-extension-stackstate

CVSS 3.1 5.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-19915Published

HP Support Assistant - Local Escalation of Privilege

cve-program ·

Vendor product: HP Support Assistant

CVSS 4.0 7.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-96606Published

LB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure

cve-program ·

Vendor product: BL-CPE600EU

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-92564Published

Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2015-20122Published

Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp

cve-program ·

Vendor product: A6 OA

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-88776Published

Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service

cve-program ·

Vendor product: ADC · Vendor product: Gateway

CVSS 4.0 8.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-68911Published

Nicotine+: Decompression of peer messages can exhaust available memory

cve-program ·

Vendor product: nicotine-plus

CVSS 4.0 8.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-89102Published

OCSP stapling v2 multi accepts non-CA chain certificates as issuers

cve-program ·

Vendor product: wolfSSL

CVSS 4.0 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102601Published

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

cve-program ·

Vendor product: flysystem

CVSS 3.1 3.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-51996Published

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function

cve-program ·

Vendor product: n/a

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-96430Published

Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

cve-program ·

Vendor product: Agentflow 4.0

CVSS 4.0 8.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-96431Published

Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

cve-program ·

Vendor product: Agentflow 4.0

CVSS 4.0 9.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-88420Published

A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the vic…

cve-program ·

Vendor product: n/a

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-8065Published

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation cou…

cve-program ·

Vendor product: RTU500 series CMU firmware

CVSS 3.1 9.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-81569Published

Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-8066Published

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files af…

cve-program ·

Vendor product: RTU500 series CMU firmware

CVSS 3.1 9.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95395Published

Missing Release of Memory after Effective Lifetime in Wireshark

cve-program ·

Vendor product: Wireshark

CVSS 3.1 5.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2023-30548Published

gatsby-plugin-sharp is a plugin for the gatsby framework which exposes functions built on the Sharp image processing library. The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 29 Sep 2026Recorded 24 Oct 2026

CVE-2026-95387Published

Heap-based Buffer Overflow in Wireshark

cve-program ·

Vendor product: Wireshark

CVSS 3.1 8.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2022-25863Published

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sa…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1 · CVSS 3.1 · [email protected] · Primary 9.8 · CVSS 2.0 · [email protected] · Primary 7.5Source modified 29 Sep 2026Recorded 24 Oct 2026

CVE-2026-95394Published

Unchecked Input for Loop Condition in Wireshark

cve-program ·

Vendor product: Wireshark

CVSS 3.1 4.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95393Published

Heap-based Buffer Overflow in Wireshark

cve-program ·

Vendor product: Wireshark

CVSS 3.1 4.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-78214Published

Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.dolphinscheduler:dolphinscheduler-api

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-95392Published

Buffer Over-read in Wireshark

cve-program ·

Vendor product: Wireshark

CVSS 3.1 5.5Source modified 29 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.