Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698751 source statements · aliases may refer to the same vulnerability

CVE-2026-87723Published

Untrusted Search Path (PATH Hijacking) in fuse-archive

cve-program ·

Vendor product: fuse-archive

CVSS 4.0 5.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-87748Published

Privilege Escalation via Account Takeover in Interprobe's Qorela DC

cve-program ·

Vendor product: Qorela DC

CVSS 3.1 8.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-82387Published

Apache Roller: Stored cross-site scripting via uploaded media content type

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 5.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-82348Published

Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 7.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102567Published

CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

cve-program ·

Vendor product: CTranslate2

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-82386Published

Apache Roller: XML external entity processing in OPML bookmark import

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 7.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-82385Published

Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 6.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-82376Published

Apache Roller: XML external entity processing in trackback response parser

cve-program ·

Vendor product: Apache Roller

CVSS 3.1 7.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-45381Published

Tautulli: Reflected XSS in `/search` endpoint

cve-program ·

Vendor product: Tautulli

CVSS 4.0 5.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102566Published

CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

cve-program ·

Vendor product: CTranslate2

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101269Published

Incorrect session validation for API-uploaded files

cve-program ·

https://pypi.python.org: pretix

CVSS 4.0 2.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101268Published

Customer session fixation

cve-program ·

https://pypi.python.org: pretix

CVSS 4.0 1.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101267Published

Revenue information leak

cve-program ·

https://pypi.python.org: pretix

CVSS 4.0 2.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-73597Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 6.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101266Published

Checkout validation bypass

cve-program ·

https://pypi.python.org: pretix

CVSS 4.0 1.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101270Published

HTML injection

cve-program ·

https://pypi.python.org: pretix

CVSS 4.0 2.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102272Published

PyJWT BOM Bypass

cve-program ·

Vendor product: pyjwt

CVSS 3.1 7.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102279Published

Laravel: XSS in Debug Page Information

cve-program ·

Vendor product: framework

CVSS 3.1 3.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101271Published

OAuth credentials not disabled when application is disabled

cve-program ·

https://pypi.python.org: pretix

CVSS 4.0 2.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102437Published

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

cve-program ·

Vendor product: DeepSeek-Reasonix · https://registry.npmjs.org: reasonix

CVSS 3.1 7.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-7193Published

Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

cve-program ·

Vendor product: T-CPE301K 4G Mini WiFi Router

CVSS 4.0 8.6Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-7192Published

Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment

cve-program ·

Vendor product: T-CPE301K 4G Mini WiFi Router

CVSS 4.0 9.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-82973Published

Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox

cve-program ·

Vendor product: docker-mailbox

CVSS 3.1 9.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-4034Published

TIBCO Administrator Injection Vulnerability

cve-program ·

Vendor product: Administrator

CVSS 4.0 8.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-55473Published

HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress

cve-program ·

Vendor product: homebox

CVSS 4.0 6.0Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-48974Published

HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler

cve-program ·

Vendor product: homebox

CVSS 3.1 5.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-55159Published

luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

cve-program ·

Vendor product: luci-app-adblock-fast

CVSS 3.1 8.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102268Published

PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

cve-program ·

Vendor product: pyjwt

CVSS 3.1 9.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-46650Published

Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

cve-program ·

Vendor product: joplin

CVSS 3.1 4.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101918Published

PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)

cve-program ·

Vendor product: pyjwt

CVSS 3.1 5.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102275Published

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

cve-program ·

Vendor product: pyjwt

CVSS 3.1 6.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102360Published

lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory

cve-program ·

Vendor product: lib0

CVSS 3.1 8.6Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-100371Published

InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

cve-program ·

Vendor product: InvoicePlane

CVSS 4.0 8.7Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102269Published

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

cve-program ·

Vendor product: pyjwt

CVSS 3.1 4.8Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-73599Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vul…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 5.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102273Published

PyJWT accepts public JWK containers as HMAC secrets

cve-program ·

Vendor product: pyjwt

CVSS 3.1 7.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102276Published

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

cve-program ·

Vendor product: brace-expansion

CVSS 3.1 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101093Published

Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

cve-program ·

Vendor product: Cotonti

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-76114Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerab…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 5.9Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101202Published

FastStone Image Viewer TGA Image out-of-bounds write

cve-program ·

Vendor product: Image Viewer

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-11871Published

Team Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details

cve-program ·

Vendor product: Team Members

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102281Published

Nest: Remote process termination via a deeply nested microservice message pattern

cve-program ·

Vendor product: nest

CVSS 3.1 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101205Published

FastStone Image Viewer PCX Decoder out-of-bounds

cve-program ·

Vendor product: Image Viewer

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102333Published

httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL

cve-program ·

Vendor product: httpdbg

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101262Published

Ziroom ZHOME A0101 set_online_client command injection

cve-program ·

Vendor product: ZHOME A0101

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2024-44986Published

ipv6: fix possible UAF in ip6_finish_output2()

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 8.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-74732Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-101265Published

Intelbras TIP 125i Básico sensitive information in source

cve-program ·

Vendor product: TIP 125i

CVSS 4.0 2.3 · CVSS 3.1 3.1 · CVSS 3.0 3.1 · CVSS 2.0 2.1Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-102362Published

mall4j through 4.0 Missing Authentication in Product Review Deletion

cve-program ·

https://github.com/gz-yami/mall4j: mall4j

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 29 Sep 2026Recorded 23 Oct 2026

CVE-2026-73591Published

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulne…

cve-program ·

Vendor product: Secure Connect Gateway (SCG) Policy Manager

CVSS 3.1 7.5Source modified 29 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.