Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699261 source statements · aliases may refer to the same vulnerability

CVE-2026-65970Published

OpenImageIO: TIFF multithreaded scanline read use-after-scope in `TIFFInput::read_native_scanlines`

cve-program ·

Vendor product: OpenImageIO

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-16514Published

Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86520Published

Use of Hard-coded Credentials in Bransys ELD

cve-program ·

Vendor product: ELD · Vendor product: ELD

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-10030Published

IBM MQ Console is vulnerable to privilege escalation

cve-program ·

Vendor product: MQ

CVSS 3.1 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

MAL-2026-16287Published

Malicious code in openmct-heatmap (npm)

osv · GHSA-qx52-2xq4-3x3v

npm: openmct-heatmap

Source modified 18 Sep 2026Recorded 24 Oct 2026

CVE-2026-92972Published

SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint

cve-program ·

Vendor product: sglang

CVSS 4.0 8.8 · CVSS 3.1 8.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-86689Published

Cleartext Transmission of Sensitive Information in Bransys ELD

cve-program ·

Vendor product: ELD · Vendor product: ELD

CVSS 3.1 5.9 · CVSS 4.0 8.2Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83319Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 7.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2025-13882Published

Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

cve-program ·

Vendor product: Sterling Partner Engagement Manager Essentials Edition · Vendor product: Sterling Partner Engagement Manager Standard Edition

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-77960Published

Use of Hard-coded Credentials in Bransys ELD

cve-program ·

Vendor product: ELD · Vendor product: ELD

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83320Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 7.6Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93531Published

gedelumbung HospitalManagement cross-site request forgery

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-1037Published

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

cve-program ·

Vendor product: Common Licensing

CVSS 3.1 6.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-57322Published

WordPress weMail plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wemail

CVSS 3.1 7.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-65490Published

WordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: mediavine-create

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83347Published

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCPS to comprom…

cve-program ·

Vendor product: Oracle Database Server

CVSS 3.1 6.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83369Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Access SDK). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 3.1Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83416Published

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle Coherence

CVSS 3.1 4.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83458Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSON). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comp…

cve-program ·

Vendor product: Helidon

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-83480Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…

cve-program ·

Vendor product: Helidon

CVSS 3.1 5.3Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-84383Published

libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items

cve-program ·

Vendor product: libheif

CVSS 3.1 9.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-92926Published

code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection

cve-program ·

Vendor product: Matrimonial System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-93505Published

SveltyCMS SVG Media Upload media-service.server.ts cross site scripting

cve-program ·

Vendor product: SveltyCMS

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-81943Published

PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE

cve-program ·

Vendor product: PLANET IGS-5225-8P2T4S V1 · Vendor product: PLANET IGS-5225-8P2T4S V2

CVSS 4.0 8.4 · CVSS 3.1 6.7Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-60115Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2024-53063Published

media: dvbdev: prevent the risk of out of memory access

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 7.8Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2023-1390Published

A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets …

cve-program ·

Vendor product: Linux kernel (TIPC kernel module)

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2023-1380Published

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer…

cve-program ·

Vendor product: Kernel

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2023-1118Published

A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the sy…

cve-program ·

Vendor product: Kernel

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2023-35788Published

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of…

cve-program ·

Vendor product: n/a

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-79294Published

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component

cve-program ·

Vendor product: n/a

Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-20325Published

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutralization of Special Elements used in a Command

cve-program ·

Vendor product: Cisco Nexus Dashboard

CVSS 3.1 9.9Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-80355Published

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote exe…

cve-program ·

Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4

CVSS 3.1 5.4Source modified 18 Sep 2026Recorded 23 Oct 2026

CVE-2026-87234Published