Public security advisories
Current vulnerabilities, known exploitation, Microsoft security updates, and practical guidance from Griffin Technology Partners.
Primary sources
Microsoft Security Response Center
CISA Known Exploited Vulnerabilities
Vulnerability intelligence
Last collection: October 19, 2026
Six-hour refresh · Public-source information only
Showing the most recent saved intelligence. One or more sources are awaiting a successful refresh; source dates are listed below.
7,896 bulletins · Page 165 of 329
JSON feedAuthorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Affected: Visual Studio Code
Updated
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +28 more
Updated
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +28 more
Updated
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Affected: Visual Studio Code
Updated
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Affected: Visual Studio Code
Updated
Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Affected: Visual Studio Code
Updated
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Affected: Visual Studio Code
Updated
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Affected: Visual Studio Code
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0
Updated
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Affected: Starlette
Added to CISA KEV
Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials.
Affected: Kestra OSS
Added to CISA KEV
BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token.
Affected: LiteLLM
Added to CISA KEV
JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges.
Affected: Artifactory
Added to CISA KEV
SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Affected: SMA1000 Appliances
Added to CISA KEV
SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
Affected: SMA1000 Appliances
Added to CISA KEV
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Affected: Switchvox
Added to CISA KEV
Out-of-bounds read in Windows TCP/IP allows an authorized attacker to disclose information locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +25 more
Updated
Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +25 more
Updated
External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +25 more
Updated
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +28 more
Updated
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +28 more
Updated
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Affected: Microsoft 365 Apps for Enterprise for 32-bit Systems · Microsoft 365 Apps for Enterprise for 64-bit Systems · +11 more
Updated
PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078.
Affected: NG/MF
Added to CISA KEV
PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578.
Affected: NG/MF
Added to CISA KEV
The collection starts with 90 days of Microsoft updates and CISA additions, plus older Microsoft vulnerabilities still listed by CISA. Older entries do not imply that a product remains supported. Counts describe this collection, not every vulnerability or any customer environment.
Last successful check: October 13, 2026
Last successful check: October 19, 2026
Griffin Technology Partners managed customers may receive additional environment-specific security guidance and remediation assistance through their managed services relationship.
Security bulletins are provided for informational purposes and compiled from authoritative public sources. Vulnerability applicability varies by environment. Validate affected products, configuration, compatibility requirements, and vendor guidance before making production changes.
