Security Intelligence

Published intelligence

Source-backed advisories and research briefings from the configured public feeds, translated into SOC checks. Dates are source publication dates; unknown dates stay searchable.

Latest release-level summaryMicrosoft Security Update Guide · Limited verification13 Oct 2026, 12:30 PM IST

October 2026 Security Updates

A release summary covers many CVEs. Affected products and detection queries are scoped on each individual CVE record, not on this page.

Inspect release summary

CVEs in release2,134

KEV-listed in release0

Critical (raw label)205

Products named351

Product families:azl3 dpdk 23.11.3-1 on Azure Linux 3.0azl3 httpd 2.4.68-1 on Azure Linux 3.0azl3 javapackages-bootstrap 1.14.0-4 on Azure Linux 3.0azl3 opensc 0.27.1-2 on Azure Linux 3.0azl3 erlang 26.2.5.21-6 on Azure Linux 3.0azl3 cups 2.4.19-1 on Azure Linux 3.0+345 more

KEV and Critical counts read this release's CVE list against stored vulnerability records; CVEs not yet stored are not counted.

344 matching briefings

Sorted by source update or publication date.

Collection Degraded · last successful 18 Oct 2026, 11:08 PM IST

MSRC CSAF / VEX · Limited verification•23 Aug 2026, 06:33 AM IST•Updated 18 Oct 2026, 07:17 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-53572

KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

azl3 keda 0:2.14.1-16.azl3 as a component of Azure Linux 3.0<azl3 keda 0:2.14.1-19.azl3 as a component of Azure Linux 3.0azl3 keda 0:2.14.1-18.azl3 as a component of Azure Linux 3.0

Microsoft Security Update Guide · Limited verification•11 Aug 2026, 12:30 PM IST•Updated 18 Oct 2026, 07:17 AM ISTMicrosoft MSRC CVRF

UPDATED TODAYRELEASE SUMMARY · 1,676 CVEsHigh (raw)VulnerabilityCVE-2022-4996CVE-2025-30156CVE-2025-49506

August 2026 Security Updates

1676 Microsoft CVEs in the 2026-Aug security release.

Release-level; products are scoped on each CVE record

MSRC CSAF / VEX · Limited verification•09 Sept 2026, 08:30 PM IST•Updated 18 Oct 2026, 07:17 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-13622

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host CVE-2026-13622 Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host

azl3 kubevirt 0:1.8.4-1.azl3 as a component of Azure Linux 3.0<azl3 kubevirt 0:1.8.4-2.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•11 Aug 2026, 06:33 AM IST•Updated 18 Oct 2026, 07:17 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-71497

jsoup: Cleaner may expose markup with custom raw-text elements

jsoup: Cleaner may expose markup with custom raw-text elements CVE-2026-71497 jsoup: Cleaner may expose markup with custom raw-text elements

<azl3 javapackages-bootstrap 0:1.14.0-4.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•27 Jun 2026, 06:35 AM IST•Updated 18 Oct 2026, 07:17 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-13201

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption CVE-2026-13201 Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

azl3 kubevirt 0:1.8.4-1.azl3 as a component of Azure Linux 3.0<azl3 kubevirt 0:1.8.4-2.azl3 as a component of Azure Linux 3.0azl3 kubevirt 0:1.7.1-7.azl3 as a component of Azure Linux 3.0azl3 kubevirt 0:1.7.1-8.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•15 May 2026, 06:32 AM IST•Updated 18 Oct 2026, 07:17 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-43969

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1 CVE-2026-43969 Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

azl3 rabbitmq-server 0:3.13.7-3.azl3 as a component of Azure Linux 3.0azl3 rabbitmq-server 0:3.13.7-5.azl3 as a component of Azure Linux 3.0azl3 rabbitmq-server 0:3.13.7-6.azl3 as a component of Azure Linux 3.0azl3 rabbitmq-server 0:3.13.7-8.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•11 Oct 2026, 07:30 AM IST•Updated 18 Oct 2026, 07:16 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-19585

Go-getter vulnerable to a path traversal in S3/GCS directory download handling

Go-getter vulnerable to a path traversal in S3/GCS directory download handling CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

<azl3 packer 0:1.9.5-21.azl3 as a component of Azure Linux 3.0

Microsoft Security Update Guide · Limited verification•13 Oct 2026, 12:30 PM IST•Updated 18 Oct 2026, 07:16 AM ISTMicrosoft MSRC CVRF

UPDATED TODAYRELEASE SUMMARY · 2,134 CVEsHigh (raw)VulnerabilityCVE-2026-100236CVE-2026-101019CVE-2026-101025

October 2026 Security Updates

2134 Microsoft CVEs in the 2026-Oct security release.

Release-level; products are scoped on each CVE record

MSRC CSAF / VEX · Limited verification•11 Oct 2026, 07:20 AM IST•Updated 18 Oct 2026, 07:16 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-61801

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

<azl3 containerd2 0:2.3.4-1.azl3 as a component of Azure Linux 3.0<azl3 containerized-data-importer 0:1.62.0-8.azl3 as a component of Azure Linux 3.0<azl3 docker-compose 0:2.27.0-14.azl3 as a component of Azure Linux 3.0azl3 kata-containers 0:4.1.0.kata0-1.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•11 Oct 2026, 07:29 AM IST•Updated 18 Oct 2026, 07:16 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-107324

Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver CVE-2026-107324 Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

azl3 kata-containers 0:4.1.0.kata0-1.azl3 as a component of Azure Linux 3.0azl3 kata-containers-cc 0:3.15.0.aks0-21.azl3 as a component of Azure Linux 3.0<azl3 keda 0:2.14.1-19.azl3 as a component of Azure Linux 3.0<azl3 kubevirt 0:1.8.4-2.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•11 Oct 2026, 07:28 AM IST•Updated 18 Oct 2026, 07:15 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-107325

Application denial of service via missing BSON array length validation in MongoDB Go Driver

Application denial of service via missing BSON array length validation in MongoDB Go Driver CVE-2026-107325 Application denial of service via missing BSON array length validation in MongoDB Go Driver

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:23 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67229

RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

Microsoft Security Update Guide · Limited verification•08 Sept 2026, 12:30 PM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft MSRC CVRF

UPDATED TODAYRELEASE SUMMARY · 2,780 CVEsHigh (raw)VulnerabilityCVE-2025-1218CVE-2025-14181CVE-2026-0799

September 2026 Security Updates

2780 Microsoft CVEs in the 2026-Sep security release.

Release-level; products are scoped on each CVE record

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:23 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-66070

RabbitMQ: CORS * reflects Origin with Allow-Credentials

RabbitMQ: CORS * reflects Origin with Allow-Credentials CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:22 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67235

RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size CVE-2026-67235 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:22 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67232

RabbitMQ: Web-MQTT decompression bomb

RabbitMQ: Web-MQTT decompression bomb CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:21 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67225

RabbitMQ: Stream-protocol frame length never validated against frame_max

RabbitMQ: Stream-protocol frame length never validated against frame_max CVE-2026-67225 RabbitMQ: Stream-protocol frame length never validated against frame_max

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:21 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-66072

RabbitMQ: Atom table exhaustion via stream `chunk_selector`

RabbitMQ: Atom table exhaustion via stream `chunk_selector` CVE-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector`

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:20 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-66074

RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ: ReDoS via management API ?name= filter CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:20 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67233

RabbitMQ: Monitoring-tag user can DELETE shovels

RabbitMQ: Monitoring-tag user can DELETE shovels CVE-2026-67233 RabbitMQ: Monitoring-tag user can DELETE shovels

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:20 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67228

RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component

RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component CVE-2026-67228 RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:19 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-66068

RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:19 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67226

RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list

RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list CVE-2026-67226 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:18 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-66067

RabbitMQ: Stream protocol skips per vhost per user connection limits

RabbitMQ: Stream protocol skips per vhost per user connection limits CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

MSRC CSAF / VEX · Limited verification•03 Oct 2026, 07:18 AM IST•Updated 18 Oct 2026, 07:14 AM ISTMicrosoft authoritative security API

UPDATED TODAYVulnerabilityCVE-2026-67219

RabbitMQ: Consistent-hash exchange unbounded weight

RabbitMQ: Consistent-hash exchange unbounded weight CVE-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight

<azl3 rabbitmq-server 0:3.13.7-9.azl3 as a component of Azure Linux 3.0

Showing 1 – 25 of 344

Published intelligence is the editorial-scope feed. Switch Scope to Full archive to include everything stored.