Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699309 source statements · aliases may refer to the same vulnerability

CVE-2026-83153Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-55211Published

surfio IRAP header size fields cause out-of-bounds reads

cve-program ·

Vendor product: surfio

CVSS 3.0 9.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83155Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with access to …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83156Published

Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker havi…

cve-program ·

Vendor product: Oracle Database Server

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83157Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged …

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 8.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83158Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged att…

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83159Published

Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: ADPatch). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infr…

cve-program ·

Vendor product: Applications DBA

CVSS 3.1 7.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83160Published

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via …

cve-program ·

Vendor product: Oracle Database Server

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-92960Published

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host pro…

nvd ·

CVSS 4.0 · [email protected] · Secondary 10.0 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-92955Published

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigge…

nvd ·

CVSS 4.0 · [email protected] · Secondary 10.0 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-92950Published

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename)…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 8.6Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-92945Published

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with al…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 4.2Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-92939Published

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process autho…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Secondary 9.9Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-92934Published

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle dete…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.5 · CVSS 3.1 · [email protected] · Secondary 9.0Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-83161Published

Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle Project Intelligence

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83162Published

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with n…

cve-program ·

Vendor product: Oracle Application Object Library

CVSS 3.1 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-57139Published

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest() without authentication or …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 17 Sep 2026Recorded 25 Oct 2026

CVE-2026-83163Published

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Attachments / File Upload). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileg…

cve-program ·

Vendor product: Oracle Application Object Library

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83164Published

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle Customer Interaction History

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91992Published

Tornado before 6.5.7 Credential Leak via Handle Reuse

cve-program ·

Vendor product: tornado

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83165Published

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle Customer Interaction History

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83166Published

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle Customer Interaction History

CVSS 3.1 7.7Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83178Published

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with n…

cve-program ·

Vendor product: Oracle Application Object Library

CVSS 3.1 8.0Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83179Published

Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileg…

cve-program ·

Vendor product: Oracle Common Applications Calendar

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83180Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83181Published

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workspaces). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via …

cve-program ·

Vendor product: Siebel CRM Development

CVSS 3.1 8.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-61793Published

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

cve-program ·

Vendor product: og-image

CVSS 4.0 6.9Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83182Published

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network a…

cve-program ·

Vendor product: Siebel CRM Development

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83184Published

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with n…

cve-program ·

Vendor product: Oracle Application Object Library

CVSS 3.1 7.4Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83185Published

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Oracle Common Applications

CVSS 3.1 7.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91987Published

atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

cve-program ·

Vendor product: atomic-agents-stack

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83186Published

Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle Common Applications Calendar

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83187Published

Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged…

cve-program ·

Vendor product: Oracle Common Applications Calendar

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83188Published

Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with ne…

cve-program ·

Vendor product: Oracle Depot Repair

CVSS 3.1 7.2Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83199Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83200Published

Vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privil…

cve-program ·

Vendor product: Oracle Process Manufacturing Intelligence

CVSS 3.1 6.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83203Published

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t…

cve-program ·

Vendor product: Siebel CRM End User

CVSS 3.1 8.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83204Published

Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with netwo…

cve-program ·

Vendor product: Oracle Sourcing

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-91982Published

Vikunja before 2.6.0 TOTP Secret Disclosure via API

cve-program ·

Vendor product: vikunja

CVSS 3.1 4.3 · CVSS 4.0 5.3Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83205Published

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Oracle Applications Framework

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83206Published

Vulnerability in the Oracle Banking Corporate Lending Process Management product of Oracle Financial Services Applications (component: Base). Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerabilit…

cve-program ·

Vendor product: Oracle Banking Corporate Lending Process Management

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83207Published

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network…

cve-program ·

Vendor product: Siebel CRM Development

CVSS 3.1 7.6Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83209Published

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTT…

cve-program ·

Vendor product: Siebel CRM Development

CVSS 3.1 8.8Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-28836Published

A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device.

cve-program ·

Vendor product: macOS

Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83223Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Remote). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83224Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83226Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83227Published

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP t…

cve-program ·

Vendor product: Siebel CRM Integration

CVSS 3.1 7.5Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83229Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows high privileged attacker with netwo…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 9.1Source modified 17 Sep 2026Recorded 23 Oct 2026

CVE-2026-83230Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.1Source modified 17 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.