Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699150 source statements · aliases may refer to the same vulnerability

MAL-2026-16381Published

Malicious code in cisco-github-simple (npm)

osv ·

npm: cisco-github-simple

Source modified 22 Sep 2026Recorded 24 Oct 2026

MAL-2026-16380Published

Malicious code in chai-logger (npm)

osv ·

npm: chai-logger

Source modified 22 Sep 2026Recorded 24 Oct 2026

CVE-2026-83417Published

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerabili…

cve-program ·

Vendor product: Oracle Communications Cloud Native Core Security Edge Protection Proxy

CVSS 3.1 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-62282Published

OpenCVE: Server-Side Request Forgery (SSRF) in notifications

cve-program ·

Vendor product: opencve

CVSS 3.1 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83424Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93560Published

Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: netty-codec-stomp · https://access.redhat.com/downloads/content/package-browser/: netty-codec-stomp · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: jboss-eap-7/eap74-els-openjdk11-openshift-rhel8

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-88403Published

A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93603Published

vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

cve-program ·

Vendor product: vm2

CVSS 4.0 10.0 · CVSS 3.1 10.0Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-88404Published

A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93598Published

ArcadeDB before 26.9.1 Classpath Credential Disclosure via ResourceBundle

cve-program ·

Vendor product: arcadedb

CVSS 4.0 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83425Published

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.12-12.2.15. Easily exploitable vulnerability allows low…

cve-program ·

Vendor product: Oracle Complex Maintenance, Repair and Overhaul

CVSS 3.1 8.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93593Published

ArcadeDB before 26.9.1 TimeSeries ACL Bypass via Type Permission

cve-program ·

Vendor product: arcadedb

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95511Rejected

Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin), which is an opt-in cupsd admin role granted by a superuser. No privilege boundary is crossed.

cve-program ·

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76686Published

Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83486Published

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: Oracle Product Hub

CVSS 3.1 7.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76687Published

Authenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN Orchestrator

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83487Published

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: Oracle Product Hub

CVSS 3.1 7.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76688Published

Authentication Bypass Vulnerabilities in the Web-Based Management Interface of EdgeConnect SD-WAN Orchestrator

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76689Published

Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.2Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-87136Published

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticate…

cve-program ·

Vendor product: Oracle Hyperion Data Relationship Management

CVSS 3.1 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76690Published

Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.2Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94504Published

Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

cve-program ·

Vendor product: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

CVSS 3.1 7.2Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-87137Published

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle Hyperion Data Relationship Management

CVSS 3.1 7.6Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76691Published

Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateway API Endpoint

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 7.2Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-76698Published

Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

cve-program ·

Vendor product: EdgeConnect SD-WAN Gateways

CVSS 3.1 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-1645Published

Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting

cve-program ·

Vendor product: Hostel

CVSS 3.1 4.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-87141Published

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle Hyperion Data Relationship Management

CVSS 3.1 7.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83354Published

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via H…

cve-program ·

Vendor product: Oracle Coherence

CVSS 3.1 6.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83413Published

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows high privil…

cve-program ·

Vendor product: Oracle Coherence

CVSS 3.1 1.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-15095Published

Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

cve-program ·

Vendor product: Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels

CVSS 3.1 4.9Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-79317Published

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database o…

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-58270Published

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

cve-program ·

Vendor product: server

CVSS 3.1 6.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95499Published

JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload

cve-program ·

Vendor product: php-file-manager-with-code-editor

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-93341Published

MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX

cve-program ·

Vendor product: MarketKing

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83356Published

Vulnerability in the Enterprise Command Center Framework product of Oracle E-Business Suite (component: Security). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network…

cve-program ·

Vendor product: Enterprise Command Center Framework

CVSS 3.1 7.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83352Published

Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Oracle XML Gateway

CVSS 3.1 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83308Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83305Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticate…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.6Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-83303Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.5Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-88746Published

idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-87142Published

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticate…

cve-program ·

Vendor product: Oracle Hyperion Data Relationship Management

CVSS 3.1 7.1Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-95666Published

Unbounded post ID array in the bulk reactions endpoint allows denial of service

cve-program ·

Vendor product: Mattermost

CVSS 3.1 4.3Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-87144Published

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle Hyperion Data Relationship Management

CVSS 3.1 7.6Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-88402Published

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-79079Published

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components

cve-program ·

Vendor product: n/a

Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-88409Published

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

cve-program ·

Vendor product: n/a

CVSS 3.1 8.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-85219Published

Denial-of-Service in the OpenCanary Redis service

cve-program ·

https://pypi.org/project/opencanary/: opencanary

CVSS 3.1 3.7Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-49995Published

Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

cve-program ·

Vendor product: Tautulli

CVSS 4.0 4.8Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-94571Published

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and…

cve-program ·

Vendor product: Octavia

CVSS 4.0 9.4Source modified 22 Sep 2026Recorded 23 Oct 2026

CVE-2026-77523Published

MaxKB: Cross-workspace model parameter form write

cve-program ·

Vendor product: MaxKB

CVSS 3.1 7.4Source modified 22 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.