Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699171 source statements · aliases may refer to the same vulnerability

CVE-2026-87133Published

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows high privilege…

cve-program ·

Vendor product: Oracle Hyperion Data Relationship Management

CVSS 3.1 7.6Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94100Published

Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow

cve-program ·

Vendor product: NBR200V2

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87197Published

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Hyperion Financial Management

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87205Published

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Hyperion Financial Management

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87200Published

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Hyperion Financial Management

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83490Published

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…

cve-program ·

Vendor product: Oracle iRecruitment

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87124Published

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…

cve-program ·

Vendor product: Oracle iRecruitment

CVSS 3.1 7.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83266Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Resource Catalog Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-17909Published

Insufficient validation of untrusted input in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via malicious network traffic. (Chromium security severity: Low)

cve-program ·

Vendor product: Chrome

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87196Published

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Hyperion Financial Management

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94148Published

ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure

cve-program ·

Vendor product: ScadaBR

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91165Published

Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values

cve-program ·

Vendor product: warpgate

CVSS 3.1 2.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83485Published

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: Oracle Product Hub

CVSS 3.1 7.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83431Published

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acce…

cve-program ·

Vendor product: Oracle Product Workbench

CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87127Published

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acce…

cve-program ·

Vendor product: Oracle Purchasing

CVSS 3.1 7.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83461Published

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle Mobile Application Server

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91986Published

gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection

cve-program ·

Vendor product: gitoxide

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83465Published

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle Mobile Application Server

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83484Published

Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged att…

cve-program ·

Vendor product: Oracle US Federal Human Resources

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94494Published

jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

cve-program ·

Vendor product: jshERP

CVSS 3.1 5.0 · CVSS 4.0 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83343Published

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Supported versions that are affected are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A an…

cve-program ·

Vendor product: Oracle Utilities Network Management System

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83334Published

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthe…

cve-program ·

Vendor product: Oracle Web Services Manager

CVSS 3.1 7.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83345Published

Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Oracle XML Gateway

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83326Published

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network acce…

cve-program ·

Vendor product: Siebel CRM Integration

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91981Published

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 4.3Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-91971Published

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with e…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-87126Published

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Reports Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with netw…

cve-program ·

Vendor product: Oracle Report Manager

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87149Published

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low priv…

cve-program ·

Vendor product: Oracle Contract Lifecycle Management for Public Sector

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83270Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allow…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83324Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Difficult to exploit vulnerability all…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83321Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Actions). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows l…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83309Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83457Published

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle Demand Signal Repository

CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83449Published

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: Oracle Bills of Material

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-31277Published

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory co…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83443Published

Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network a…

cve-program ·

Vendor product: Oracle Assets

CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83341Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91164Published

Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

cve-program ·

Vendor product: warpgate

CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83332Published

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Oracle Applications Framework

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-61746Published

InvenTree: Plugin-settings GET endpoints are readable without authentication

cve-program ·

Vendor product: InvenTree

CVSS 3.1 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83267Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83274Published

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the …

cve-program ·

Vendor product: Oracle Agile PLM MCAD Connector

CVSS 3.1 5.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94496Published

jshERP through 3.6 Privilege Escalation via Role Management

cve-program ·

Vendor product: jshERP

CVSS 3.1 8.3 · CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83488Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows low privileged attacker with network…

cve-program ·

Vendor product: Helidon

CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94412Published

jshERP through 3.6 Authorization Bypass via resetPwd

cve-program ·

Vendor product: jshERP

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91946Published

FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-82163Published

Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclos…

cve-program ·

Vendor product: Command | Intel vPro Out of Band

CVSS 3.1 5.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2023-43000Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to mem…

cve-program ·

Vendor product: macOS · Vendor product: iOS and iPadOS · Vendor product: Safari

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-69190Published

Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

cve-program ·

Vendor product: graylog2-server

CVSS 3.1 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-48975Published

HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox

cve-program ·

Vendor product: homebox

CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.