Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698779 source statements · aliases may refer to the same vulnerability

CVE-2026-100739Published

mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection

cve-program ·

Vendor product: CloudClassroom-PHP-Project

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100721Published

vm2 before 3.12.2 Authorization Bypass via Custom Resolver

cve-program ·

Vendor product: vm2

CVSS 4.0 9.5 · CVSS 3.1 9.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100636Published

SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder

cve-program ·

Vendor product: siyuan

CVSS 4.0 8.3 · CVSS 3.1 7.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100632Published

Parse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101081Published

D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

cve-program ·

Vendor product: DI-8400

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100664Published

Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

cve-program ·

Vendor product: netty

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100840Published

MONAI through 1.6.0 Remote Code Execution via bundle configuration

cve-program ·

Vendor product: MONAI

CVSS 4.0 8.5 · CVSS 3.1 7.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100660Published

Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

cve-program ·

Vendor product: netty

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

MAL-2026-13616Published

Malicious code in hardhat-cap (npm)

osv · GHSA-3jrx-49jf-x2rp

npm: hardhat-cap

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-14201Published

Malicious code in chaikit (npm)

osv · GHSA-6c2m-985r-wrwm

npm: chaikit

Source modified 28 Sep 2026Recorded 24 Oct 2026

MAL-2026-17187Published

Malicious code in @digift/cli (npm)

osv · GHSA-xp76-38xh-m8wc

npm: @digift/cli

Source modified 28 Sep 2026Recorded 24 Oct 2026

CVE-2026-100652Published

vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

cve-program ·

Vendor product: vllm

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100648Published

vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

cve-program ·

Vendor product: vllm

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100848Published

AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

cve-program ·

Vendor product: AzuraCast

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100676Published

stoatchat before 0.15.5 Local Filesystem Read via SVG

cve-program ·

Vendor product: stoatchat

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-81882Published

radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist parser

cve-program ·

Vendor product: radare2

CVSS 3.1 3.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-63374Published

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

cve-program ·

Vendor product: anyio

CVSS 4.0 9.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-12269Published

Authenticated File Write to RCE via keepalived in DDI Central

cve-program ·

Vendor product: DDI Central

CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-82928Published

Undocumented access path in mH-DEVELOPER

cve-program ·

Vendor product: mH-DEVELOPER

CVSS 4.0 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-15953Published

Path Traversal During Project Archive Import

cve-program ·

Vendor product: Protection and control IED manager (PCM600)

CVSS 3.1 5.0 · CVSS 4.0 5.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-86335Published

LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse

cve-program ·

Vendor product: LXD

CVSS 3.1 6.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-85185Published

Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

cve-program ·

Vendor product: LXD

CVSS 3.1 9.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-97335Published

Incorrect authorization in LXD storage volume API allows reading volumes from other projects

cve-program ·

Vendor product: LXD

CVSS 3.1 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-87798Published

LXD client recursive file pull allows directory escape via malicious VM agent

cve-program ·

Vendor product: LXD

CVSS 3.1 5.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-90926Published

Code Injection in Innotim Software's Logsign SIEM

cve-program ·

Vendor product: Logsign SIEM

CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-90925Published

Path Traversal in Innotim Software's Logsign SIEM

cve-program ·

Vendor product: Logsign SIEM

CVSS 3.1 7.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100672Published

grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

cve-program ·

Vendor product: grav-plugin-comments

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100668Published

Grav before 2.0.25 Sandbox Escape via array Filter

cve-program ·

Vendor product: grav

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100692Published

Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

cve-program ·

Vendor product: hugo

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-58464Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-58463Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100696Published

Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver

cve-program ·

Vendor product: adminer

CVSS 4.0 6.9 · CVSS 3.1 5.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101075Published

Netcore NR289-GE Location Time location_time.cgi system os command injection

cve-program ·

Vendor product: NR289-GE

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101078Published

deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation

cve-program ·

Vendor product: deepseek-harness

CVSS 4.0 4.8 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 4.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-90924Published

Default Admin Credentials in Innotim Software's Logsign SIEM

cve-program ·

Vendor product: Logsign SIEM

CVSS 3.1 9.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-93538Published

Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet

cve-program ·

Vendor product: Fleet

CVSS 3.1 7.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-93539Published

Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver

cve-program ·

Vendor product: Fleet

CVSS 3.1 5.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-80358Published

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physi…

cve-program ·

Vendor product: Boot Optimized Server Storage (BOSS)

CVSS 3.1 5.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-70413Published

Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

cve-program ·

Vendor product: Live Optics Collector

CVSS 3.1 5.6Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-4556Published

macOS Exam4 Local Privilege Escalation via Command Injection

cve-program ·

Vendor product: com.extegrity.LogTool

CVSS 3.1 7.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-96538Published

WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation

cve-program ·

Vendor product: WarehousePG

CVSS 4.0 8.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-93540Published

Fleet applies namespace labels and annotations without the bundle's service account privileges

cve-program ·

Vendor product: Fleet

CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-96273Published

Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB

cve-program ·

Vendor product: ghidra

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100836Published

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 4.3Source modified 28 Sep 2026Recorded 25 Oct 2026

CVE-2026-100852Published

AzuraCast before 0.23.8 Command Injection via Streamer Username

cve-program ·

Vendor product: AzuraCast

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100860Published

heym before 0.0.105 Authentication Bypass via Redis Node

cve-program ·

Vendor product: heym

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100864Published

heym before 0.0.91 Remote Code Execution via Expression Engine

cve-program ·

Vendor product: heym

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100836Published

Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

cve-program ·

Vendor product: contrast

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100745Published

Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow

cve-program ·

Vendor product: BR-6428nC

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-19477Published

Stack-based Buffer Overflow Vulnerability in Linux (uldaq)

cve-program ·

Vendor product: Universal Library for Linux (uldaq)

CVSS 3.1 7.8 · CVSS 4.0 8.6Source modified 28 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.