Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

698779 source statements · aliases may refer to the same vulnerability

CVE-2026-79760Published

Termix: Authenticated blind SSRF through notification channel test endpoints

cve-program ·

Vendor product: Termix

CVSS 3.1 6.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-94609Published

authentik: Privilege Escalation to Superuser via Group Hierarchy

cve-program ·

Vendor product: authentik

CVSS 3.1 8.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-63498Published

Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API

cve-program ·

Vendor product: snipe-it

CVSS 3.1 8.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-79762Published

Termix: Hardcoded default key encrypts all OIDC/WebAuthn users' stored SSH credentials — full offline decryption from a database copy

cve-program ·

Vendor product: Termix

CVSS 3.1 5.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101071Published

Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload

cve-program ·

Vendor product: Unet Web Service

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-26054Published

SumatraPDF: Heap out-of-bounds read in MOBI header parser.

cve-program ·

Vendor product: sumatrapdf

CVSS 4.0 6.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-80359Published

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physi…

cve-program ·

Vendor product: Boot Optimized Server Storage (BOSS)

CVSS 3.1 6.8Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-89303Published

Post Voting System <= 1.0 - Subscriber+ SQLi via 'row' Parameter

cve-program ·

Vendor product: Post Voting System

Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-93000Published

SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search

cve-program ·

Vendor product: SPS-Suite

Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-89300Published

WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients

cve-program ·

Vendor product: WP Verify API

Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-84744Published

WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation

cve-program ·

https://wordpress.org/plugins: WPForms

CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-86838Published

Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation

cve-program ·

https://wordpress.org/plugins: Bookly

CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-88828Published

Blacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords

cve-program ·

https://wordpress.org/plugins: Blacklist Manager

CVSS 3.1 5.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-89411Published

Paymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent

cve-program ·

https://wordpress.org/plugins: Paymattic

CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-92996Published

Verge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_done

cve-program ·

https://wordpress.org/plugins: Verge3D Publishing and E-Commerce

CVSS 3.1 5.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101077Published

Netcore NR289-GE boa_temp process_request missing authentication

cve-program ·

Vendor product: NR289-GE

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 28 Sep 2026Recorded 23 Oct 2026

MAL-2026-17215Published

Malicious code in eslint-plugin-skywagon-web (npm)

osv ·

npm: eslint-plugin-skywagon-web

Source modified 28 Sep 2026Recorded 24 Oct 2026

CVE-2026-101074Published

Netcore NR289-GE Authentication boa password-check stack-based overflow

cve-program ·

Vendor product: NR289-GE

CVSS 4.0 9.3 · CVSS 3.1 9.8 · CVSS 3.0 9.8 · CVSS 2.0 10.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-93659Published

Concrete CMS Community Store before 2.7.8 Stored XSS

cve-program ·

https://packagist.org: concretecms-community-store/community_store

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-85056Published

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 28 Sep 2026Recorded 25 Oct 2026

CVE-2026-53493Published

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreat…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 28 Sep 2026Recorded 25 Oct 2026

CVE-2026-101051Published

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 3.1Source modified 28 Sep 2026Recorded 25 Oct 2026

CVE-2026-71540Published

Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion

cve-program ·

Vendor product: wazuh

CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100700Published

nodemailer before 10.0.6 Denial of Service via addressparser

cve-program ·

Vendor product: nodemailer

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-91119Published

Discourse: Encode action_code_who in mention URLs

cve-program ·

Vendor product: discourse

CVSS 3.1 6.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-53493Published

Containerd has image-pull DoS via crafted OCI index graph amplification

cve-program ·

Vendor product: containerd

CVSS 4.0 6.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-54461Published

Habitica: Regex Injection / ReDoS in Member Search

cve-program ·

Vendor product: habitica

CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-85056Published

ZITADEL: MFA bypass via session reuse in Login V2

cve-program ·

Vendor product: zitadel

CVSS 3.1 8.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-62286Published

Dozzle label filters do not restrict container event and statistics streams

cve-program ·

Vendor product: dozzle

CVSS 3.1 4.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-85738Published

TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)

cve-program ·

Vendor product: TREK

CVSS 3.1 6.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100704Published

Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass

cve-program ·

Vendor product: kyverno

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100708Published

Froxlor before 2.3.13 Private Key Disclosure via Certificates API

cve-program ·

Vendor product: froxlor

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-80357Published

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physi…

cve-program ·

Vendor product: Boot Optimized Server Storage (BOSS)

CVSS 3.1 7.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100712Published

froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

cve-program ·

Vendor product: froxlor

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100716Published

Froxlor before 2.3.12 Privilege Escalation via Symlink

cve-program ·

Vendor product: froxlor

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-100740Published

D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

cve-program ·

Vendor product: DIR-895L

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101069Published

dbgate Export databaseConnections.js exportModelSql path traversal

cve-program ·

Vendor product: dbgate

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-54790Published

InvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module

cve-program ·

Vendor product: InvoicePlane

CVSS 3.1 6.0Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-93435Published

redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

cve-program ·

Vendor product: redis-parser

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-42322Published

Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

cve-program ·

Vendor product: Piwigo

CVSS 3.1 9.1Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-63432Published

Horilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata

cve-program ·

Vendor product: horilla-hr

CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

MAL-2026-17214Published

Malicious code in git-en-boite-logging (npm)

osv ·

npm: git-en-boite-logging

Source modified 28 Sep 2026Recorded 24 Oct 2026

CVE-2026-42323Published

Piwigo: SQL Injection in Batch Manager

cve-program ·

Vendor product: Piwigo

CVSS 3.1 7.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-61823Published

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

cve-program ·

Vendor product: sharp

CVSS 3.1 7.3Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-63273Published

Heap buffer overflow in PDF import encryption handling

cve-program ·

Vendor product: LibreOffice

CVSS 4.0 5.4Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-12258Published

Inadequate access control in the Hiperdino REST API

cve-program ·

Vendor product: REST API

CVSS 4.0 9.2Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-101049Published

Heym before 0.0.53 Slack Webhook Signature Verification Bypass

cve-program ·

Vendor product: heym

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 28 Sep 2026Recorded 23 Oct 2026

CVE-2026-57449Published

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 28 Sep 2026Recorded 25 Oct 2026

CVE-2026-100722Published

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the re…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9 · CVSS 3.1 · [email protected] · Secondary 6.8Source modified 28 Sep 2026Recorded 25 Oct 2026

GHSA-456v-xq2p-r4cjPublished

code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)

osv ·

npm: code-ollama

HIGHSource modified 28 Sep 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.