Public security advisories
Current vulnerabilities, known exploitation, Microsoft security updates, and practical guidance from Griffin Technology Partners.
Primary sources
Microsoft Security Response Center
CISA Known Exploited Vulnerabilities
Vulnerability intelligence
Last collection: October 8, 2026
Six-hour refresh · Public-source information only
954 bulletins · Page 1 of 40
JSON feedUntrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +21 more
Updated
Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
Affected: Windows 10 Version 1809 for 32-bit Systems · Windows 10 Version 1809 for x64-based Systems · +17 more
Updated
ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Affected: ProFTPD
Added to CISA KEV
ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.
Affected: BIND
Added to CISA KEV
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
Affected: Struts
Added to CISA KEV
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
Affected: Docs
Added to CISA KEV
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Affected: Strapi
Added to CISA KEV
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
Affected: azl3 cert-manager 1.12.15-11 on Azure Linux 3.0 · azl3 cert-manager 1.12.15-12 on Azure Linux 3.0 · +34 more
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 sos 4.6.1-2 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 python3 3.12.14-1 on Azure Linux 3.0 · azl3 python3 3.12.14-2 on Azure Linux 3.0 · +1 more
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 python3 3.12.14-1 on Azure Linux 3.0 · azl3 python3 3.12.14-2 on Azure Linux 3.0 · +2 more
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 kernel 6.6.157.1-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 kernel 6.6.157.1-1 on Azure Linux 3.0
Updated
Review the authoritative advisory for the vulnerability description and applicability.
Affected: azl3 thrift 0.24.0-1 on Azure Linux 3.0
Updated
The collection starts with 90 days of Microsoft updates and CISA additions, plus older Microsoft vulnerabilities still listed by CISA. Older entries do not imply that a product remains supported. Counts describe this collection, not every vulnerability or any customer environment.
Last successful check: October 8, 2026
Last successful check: October 8, 2026
Griffin Technology Partners managed customers may receive additional environment-specific security guidance and remediation assistance through their managed services relationship.
Security bulletins are provided for informational purposes and compiled from authoritative public sources. Vulnerability applicability varies by environment. Validate affected products, configuration, compatibility requirements, and vendor guidance before making production changes.
