Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698779 source statements · aliases may refer to the same vulnerability

CVE-2026-100651Published

vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100659Published

Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

cve-program ·

Vendor product: netty

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101908Published

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

cve-program ·

Vendor product: axios

CVSS 4.0 6.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100667Published

grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

cve-program ·

Vendor product: grav

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-54675Published

FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

cve-program ·

Vendor product: security-reporting

CVSS 4.0 8.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101101Published

ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception

cve-program ·

Vendor product: ag-ui

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101910Published

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

cve-program ·

Vendor product: ip-address

CVSS 4.0 6.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100671Published

Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

cve-program ·

Vendor product: grav

CVSS 4.0 8.6 · CVSS 3.1 8.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-55156Published

Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

cve-program ·

Vendor product: token-optimizer-mcp

CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-19444Published

Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes

cve-program ·

Vendor product: Kubernetes

CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100675Published

stoatchat before 0.15.5 Denial of Service via mass mentions

cve-program ·

Vendor product: stoatchat

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100679Published

stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket

cve-program ·

Vendor product: stoatchat

CVSS 4.0 7.1 · CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-88804Published

Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

cve-program ·

Vendor product: Rancher

CVSS 3.1 9.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101891Published

WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access

cve-program ·

Vendor product: WatchGuard AP

CVSS 4.0 9.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-87969Published

WatchGuard AP Authenticated Command Injection in Diagnostic CLI

cve-program ·

Vendor product: WatchGuard AP

CVSS 4.0 8.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-86102Published

WatchGuard AP Command Injection in Internal Management API Allows Command Execution

cve-program ·

Vendor product: WatchGuard AP

CVSS 4.0 9.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-15952Published

Improper Permission Assignment in Scheduler Service

cve-program ·

Vendor product: Protection and control IED manager (PCM600)

CVSS 3.1 6.4 · CVSS 4.0 7.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-86595Published

SQLi in Iron Mountain's enVision

cve-program ·

Vendor product: enVision

CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-86334Published

CLI Path Traversal via Content-Disposition in LXD Image Export/Copy

cve-program ·

Vendor product: LXD

CVSS 3.1 4.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-93537Published

Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory

cve-program ·

Vendor product: Fleet

CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-91154Published

Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

cve-program ·

Vendor product: Ecommerce Template

CVSS 4.0 6.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100691Published

Hugo before 0.166.0 Stored XSS via lineAnchors code block option

cve-program ·

Vendor product: hugo

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101898Published

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

cve-program ·

Vendor product: axios

CVSS 4.0 7.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101904Published

Axios: Header Injection via Inherited headers After Minimal Interceptor

cve-program ·

Vendor product: axios

CVSS 4.0 6.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101903Published

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

cve-program ·

Vendor product: axios

CVSS 4.0 8.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101900Published

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

cve-program ·

Vendor product: axios

CVSS 4.0 6.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101098Published

ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption

cve-program ·

Vendor product: ag-ui

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101100Published

ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup

cve-program ·

Vendor product: ag-ui

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-77265Published

MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 5.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100546Published

OpenClaw 2026.7.2 before 2026.9.2 Authentication Bypass via Voice Transcript

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 6.1 · CVSS 3.1 6.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100695Published

Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE

cve-program ·

Vendor product: adminer

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100542Published

OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100538Published

OpenClaw before 2026.8.1 Local File Read via Outbound Attachments

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100699Published

Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

cve-program ·

Vendor product: nodemailer

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100534Published

OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100703Published

Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

cve-program ·

Vendor product: kyverno

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100530Published

OpenClaw before 2026.8.1 Exec Approval Directory Binding

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 8.5 · CVSS 3.1 7.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100522Published

Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

cve-program ·

Vendor product: Cotonti

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100707Published

Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

cve-program ·

Vendor product: kyverno

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101894Published

@xhmikosr/decompress: Path traversal via symlink chain

cve-program ·

Vendor product: decompress · Vendor product: decompress

CVSS 3.1 9.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100554Published

OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100558Published

OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-77605Published

Notepad++ “Run by system” executes .txt.cmd when user selected .txt (target confusion → command execution)

cve-program ·

Vendor product: notepad-plus-plus

CVSS 3.1 7.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100562Published

OpenClaw before 2026.8.1 Authorization Bypass via sessions.create

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100567Published

OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 8.9 · CVSS 3.1 8.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101080Published

Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal

cve-program ·

Vendor product: AI-Infra-Guard

CVSS 4.0 2.4 · CVSS 3.1 4.8 · CVSS 3.0 4.8 · CVSS 2.0 4.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-86054Published

Notepad++: Stack Buffer Overflow in `NppParameters::writeSession` via overlong session path

cve-program ·

Vendor product: notepad-plus-plus

CVSS 3.1 7.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-57178Published

social-auth-core: VK App backend accepts unsigned callback data when auth_key is missing

cve-program ·

Vendor product: social-core

CVSS 3.1 7.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100571Published

OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100550Published

OpenClaw before 2026.8.1 Authentication Bypass via Access Group

cve-program ·

Vendor product: OpenClaw

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 28 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.