Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699210 source statements · aliases may refer to the same vulnerability

CVE-2026-83484Published

Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged att…

cve-program ·

Vendor product: Oracle US Federal Human Resources

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94494Published

jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

cve-program ·

Vendor product: jshERP

CVSS 3.1 5.0 · CVSS 4.0 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83343Published

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Supported versions that are affected are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A an…

cve-program ·

Vendor product: Oracle Utilities Network Management System

CVSS 3.1 8.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83334Published

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthe…

cve-program ·

Vendor product: Oracle Web Services Manager

CVSS 3.1 7.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83345Published

Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Oracle XML Gateway

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83326Published

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network acce…

cve-program ·

Vendor product: Siebel CRM Integration

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91981Published

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 4.3Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-91971Published

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with e…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 21 Sep 2026Recorded 25 Oct 2026

CVE-2026-87126Published

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Reports Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with netw…

cve-program ·

Vendor product: Oracle Report Manager

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-87149Published

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low priv…

cve-program ·

Vendor product: Oracle Contract Lifecycle Management for Public Sector

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83270Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allow…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83324Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Difficult to exploit vulnerability all…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83321Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Actions). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows l…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83309Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83457Published

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle Demand Signal Repository

CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83449Published

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: Oracle Bills of Material

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-31277Published

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory co…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83443Published

Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network a…

cve-program ·

Vendor product: Oracle Assets

CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83341Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 7.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91164Published

Warpgate: API tokens bypass the user's allowed_ip_ranges restriction

cve-program ·

Vendor product: warpgate

CVSS 3.1 4.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83332Published

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Oracle Applications Framework

CVSS 3.1 7.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-61746Published

InvenTree: Plugin-settings GET endpoints are readable without authentication

cve-program ·

Vendor product: InvenTree

CVSS 3.1 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83267Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83274Published

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the …

cve-program ·

Vendor product: Oracle Agile PLM MCAD Connector

CVSS 3.1 5.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94496Published

jshERP through 3.6 Privilege Escalation via Role Management

cve-program ·

Vendor product: jshERP

CVSS 3.1 8.3 · CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-83488Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows low privileged attacker with network…

cve-program ·

Vendor product: Helidon

CVSS 3.1 5.4Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-94412Published

jshERP through 3.6 Authorization Bypass via resetPwd

cve-program ·

Vendor product: jshERP

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91946Published

FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-82163Published

Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclos…

cve-program ·

Vendor product: Command | Intel vPro Out of Band

CVSS 3.1 5.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2023-43000Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, Safari 16.6, iOS 15.8.7 and iPadOS 15.8.7. Processing maliciously crafted web content may lead to mem…

cve-program ·

Vendor product: macOS · Vendor product: iOS and iPadOS · Vendor product: Safari

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-69190Published

Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards

cve-program ·

Vendor product: graylog2-server

CVSS 3.1 6.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-48975Published

HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox

cve-program ·

Vendor product: homebox

CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-62371Published

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

cve-program ·

Vendor product: kubeedge

CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-79920Published

Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

cve-program ·

Vendor product: ajenti

CVSS 3.1 9.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-63334Published

draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

cve-program ·

Vendor product: drawio

CVSS 3.1 6.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-61674Published

Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler

cve-program ·

Vendor product: fluent-bit

CVSS 4.0 9.2Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2025-62817Published

An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, and 2500. A NULL pointer dereference of session->ncp_hdr_buf in __pilot_parsing_ncp() causes a denial of service.

cve-program ·

Vendor product: n/a

Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-84298Published

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

cve-program ·

Vendor product: hatchet

CVSS 3.1 3.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91971Published

Vikunja before 2.6.0 Denial of Service via Avatar Upload

cve-program ·

Vendor product: vikunja

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-82165Published

Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Inform…

cve-program ·

Vendor product: Command | Integration Suite for System Center

CVSS 3.1 5.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93764Published

Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation

cve-program ·

Vendor product: Mongoid

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-91981Published

Vikunja before 2.6.0 User Enumeration via v2 API

cve-program ·

Vendor product: vikunja

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93765Published

Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation

cve-program ·

Vendor product: Mongoid

CVSS 4.0 8.3 · CVSS 3.1 9.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-53940Published

Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

cve-program ·

Vendor product: conda

CVSS 3.1 8.8Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-93758Published

Cross-principal document update, theft, and deletion via unvalidated id in nested attributes

cve-program ·

Vendor product: Mongoid

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-72733Published

Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore

cve-program ·

Vendor product: dokploy

CVSS 3.1 9.9Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85497Published

CareCam CM2507 Use of Password Hash With Insufficient Computational Effort

cve-program ·

Vendor product: HMT.CM2507 Firmware

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 21 Sep 2026Recorded 23 Oct 2026

CVE-2026-85478Published

CareCam CM2507 Missing Authentication for Critical Function

cve-program ·

Vendor product: HMT.CM2507 Firmware

CVSS 3.1 3.5 · CVSS 4.0 2.4Source modified 21 Sep 2026Recorded 23 Oct 2026

GHSA-3h3x-2hwv-hr52Published

Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability

osv · CVE-2024-9355 · GO-2024-3167

Go: github.com/golang-fips/openssl

HIGHSource modified 21 Sep 2026Recorded 24 Oct 2026

CVE-2026-77866Published

SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

cve-program ·

https://repo.hex.pm: safeurl · https://github.com: slab/safeurl-elixir

CVSS 4.0 9.0Source modified 21 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.