Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699685 source statements · aliases may refer to the same vulnerability

CVE-2026-16093Published

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

cve-program ·

https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator

CVSS 3.1 5.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-16089Published

Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

cve-program ·

CVSS 3.1 5.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-16072Published

Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

cve-program ·

CVSS 3.1 4.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-15945Published

Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

cve-program ·

CVSS 3.1 4.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92141Published

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks.

cve-program ·

Vendor product: Jenkins Keycloak Authentication Plugin

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-61593Published

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

cve-program ·

Vendor product: djust

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27549Published

Command Injection in /index.php/attached_devices_tab/do_upload

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27554Published

Command Injection in /index.php/ajax/save_iodd_parameters

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-85732Published

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tag…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-85731Published

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarD…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-57133Published

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/tools/utility-tools.ts checks only the first whitespace-delimited token against safeCommands and then passes the complete…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-27559Published

Command Injection via GET in /api/status/data

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27564Published

Command Injection via PUT in /api/datastorage/data

cve-program ·

Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45

CVSS 3.1 7.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-89207Published

A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services.

cve-program ·

Vendor product: WTV676-HB6035 Web Interface · Vendor product: WTV776-HB6035 Web Interface

CVSS 3.1 6.5 · CVSS 4.0 6.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-45794Published

OpenAM Unsafe Java Deserialization via SNS

cve-program ·

Vendor product: OpenAM

CVSS 4.0 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54637Published

Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

cve-program ·

Vendor product: dragonfly

CVSS 4.0 5.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82567Published

mySCADA myPRO Manager Missing Authorization

cve-program ·

Vendor product: mySCADA myPRO

CVSS 3.1 6.3 · CVSS 4.0 5.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73807Published

mySCADA myPRO Manager Missing Authorization

cve-program ·

Vendor product: mySCADA myPRO

CVSS 3.1 9.8 · CVSS 4.0 9.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-53719Published

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

cve-program ·

Vendor product: gateway

CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-85628Published

Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability

cve-program ·

Vendor product: com.fermax.blue.app · Vendor product: DUOX PLUS monitor firmware (VEO Wi-Fi range)

CVSS 4.0 7.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-17526Published

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

cve-program ·

CVSS 3.1 7.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-92259Published

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file.

cve-program ·

Vendor product: Escargot

CVSS 3.1 5.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-45052Published

OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints

cve-program ·

Vendor product: OpenAM

CVSS 4.0 9.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73444Published

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the

cve-program ·

Vendor product: EOS

CVSS 3.1 4.7 · CVSS 4.0 5.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-68491Published

An insufficient check allowed for the overwrite of arbitrary files via a symlink.

cve-program ·

Vendor product: SolusVM

CVSS 4.0 9.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73438Published

Security Advisory 0172

cve-program ·

Vendor product: EOS

CVSS 3.1 5.3 · CVSS 4.0 7.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-19655Published

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent

cve-program ·

Vendor product: EOS

CVSS 3.1 6.5 · CVSS 4.0 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83047Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 8.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83048Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-61554Published

emp3r0r has an unauthenticated HTTP Polling DoS

cve-program ·

Vendor product: emp3r0r

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83049Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged a…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83050Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83051Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83052Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attac…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 7.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83067Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83068Published

Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Core). The supported version that is affected is 24.1. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: Oracle Enterprise Manager for Oracle Database

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83070Published

Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub product of Oracle PeopleSoft (component: Enterprise Portal). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: PeopleSoft Enterprise PRTL Interaction Hub

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83074Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83075Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83076Published

Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: Oracle HR Intelligence

CVSS 3.1 6.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83077Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows low privileged attacker with net…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 6.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83078Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 8.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83083Published

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access vi…

cve-program ·

Vendor product: Oracle Marketing

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83084Published

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access vi…

cve-program ·

Vendor product: Oracle Marketing

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83085Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows low privileged attacker with acc…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 8.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83088Published

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Authenticated User privilege with network acces…

cve-program ·

Vendor product: Oracle Database Server

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83091Published

Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with ne…

cve-program ·

Vendor product: Oracle Field Service

CVSS 3.1 7.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83093Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83097Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83109Published

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Forms

CVSS 3.1 5.3Source modified 16 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.