Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698779 source statements · aliases may refer to the same vulnerability

CVE-2026-46649Published

Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

cve-program ·

Vendor product: joplin

CVSS 4.0 9.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-76804Published

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 28 Sep 2026Recorded 25 Oct 2026

CVE-2026-56681Published

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLo…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 28 Sep 2026Recorded 25 Oct 2026

CVE-2026-65980Published

Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

cve-program ·

Vendor product: chartbrew

CVSS 4.0 7.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-49449Published

Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows

cve-program ·

Vendor product: joplin

CVSS 3.1 2.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-77516Published

MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path

cve-program ·

Vendor product: MaxKB

CVSS 3.1 5.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-56739Published

Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint

cve-program ·

Vendor product: logto

CVSS 4.0 8.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-75608Published

Frigate: Viewer-Role User Can Access go2rtc Internal API to obtain sensitive information

cve-program ·

Vendor product: frigate

CVSS 3.1 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100578Published

OpenClaw before 2026.7.1 Authorization Bypass via chat.send

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-85740Published

LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

cve-program ·

Vendor product: LightRAG

CVSS 3.1 7.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-56681Published

9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

cve-program ·

Vendor product: 9router

CVSS 3.1 7.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101902Published

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

cve-program ·

Vendor product: axios

CVSS 4.0 6.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-19759Published

Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution

cve-program ·

Vendor product: Application Integration

CVSS 4.0 9.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100586Published

OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-83602Published

Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK

cve-program ·

Vendor product: netdata

CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100590Published

OpenClaw before 2026.7.1 Authorization Bypass via voice set

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-13018Published

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100594Published

OpenClaw before 2026.7.1 Authorization Bypass via trajectory export

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100598Published

OpenClaw before 2026.7.1 Approval Binding Logic Error

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.5 · CVSS 3.1 7.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-76804Published

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass

cve-program ·

Vendor product: nuclei

CVSS 3.1 5.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100313Published

mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-49994Published

Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

cve-program ·

Vendor product: bluehood

CVSS 3.1 9.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101906Published

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

cve-program ·

Vendor product: axios

CVSS 4.0 8.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101912Published

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

cve-program ·

Vendor product: ip-address

CVSS 4.0 6.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100602Published

ClawHub Changelog Preview Information Disclosure via Authorization Bypass

cve-program ·

Vendor product: clawhub

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100606Published

Flowise through 3.1.4 Authentication Bypass via SSO Email Match

cve-program ·

Vendor product: Flowise

CVSS 4.0 9.2 · CVSS 3.1 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-19304Published

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

cve-program ·

Vendor product: Langflow OSS

CVSS 3.1 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100610Published

Flowise through 3.1.4 Missing Authorization via upsert-history

cve-program ·

Vendor product: Flowise

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100614Published

Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker

cve-program ·

Vendor product: capgo.app

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100622Published

capgo.app through 12.129.0 Cache Restoration of Deleted Bundles

cve-program ·

Vendor product: capgo.app

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100631Published

Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100639Published

SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.6 · CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100663Published

Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

cve-program ·

Vendor product: netty

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101131Published

deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision

cve-program ·

Vendor product: deepseek-harness

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101907Published

Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

cve-program ·

Vendor product: axios

CVSS 4.0 7.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-54674Published

Authenticated Command Injection in FreePBX UCP Interface

cve-program ·

Vendor product: security-reporting

CVSS 4.0 8.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101913Published

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

cve-program ·

Vendor product: ip-address

CVSS 4.0 6.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-45562Published

FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

cve-program ·

Vendor product: security-reporting

CVSS 4.0 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-55160Published

Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

cve-program ·

Vendor product: stringer

CVSS 3.1 7.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100902Published

Barco ClickShare CX-20 Gen2 Wallpaper Upload wallpaper improper validation of syntactic correctness of input

cve-program ·

Vendor product: ClickShare CX-20 Gen2

CVSS 4.0 7.1 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100643Published

SiYuan before v3.8.4 Stored XSS via Attribute View textarea

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.5 · CVSS 3.1 8.0Source modified 28 Sep 2026Recorded 23 Oct 2026

MAL-2026-17229Published

Malicious code in simple-date-formatter-new-12 (npm)

osv ·

npm: simple-date-formatter-new-12

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17228Published

Malicious code in nebulaai-sdk (npm)

osv ·

npm: nebulaai-sdk

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17206Published

Malicious code in kalasnik-npm-simple-test (npm)

osv · GHSA-pm4h-xrhq-vh62

npm: kalasnik-npm-simple-test

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17223Published

Malicious code in chalk-figlet (npm)

osv ·

npm: chalk-figlet

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17220Published

Malicious code in nebulajs-api (npm)

osv · GHSA-2gr6-gxvx-3594

npm: nebulajs-api

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17227Published

Malicious code in nebula-llm (npm)

osv ·

npm: nebula-llm

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17219Published

Malicious code in nebula-sdk (npm)

osv · GHSA-fm5g-6rr8-p9vq

npm: nebula-sdk

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17225Published

Malicious code in fabric-render-bridge (npm)

osv ·

npm: fabric-render-bridge

Source modified 28 Sep 2026Recorded 24 Oct 2026

CVE-2026-100647Published

vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

cve-program ·

Vendor product: vllm

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.