Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699685 source statements · aliases may refer to the same vulnerability

CVE-2026-85732Published

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

cve-program ·

Vendor product: oras-go

CVSS 3.1 4.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-59944Published

Composer: CVE-2026-59946 fix bypass via symlinked package bin path

cve-program ·

Vendor product: composer

CVSS 3.1 6.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-59974Published

Stanza: Zip Slip Path Traversal in Model/Resource Extraction

cve-program ·

Vendor product: stanza

CVSS 3.1 7.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-71182Published

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, …

cve-program ·

Vendor product: Update Package Framework

CVSS 3.1 3.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-85731Published

oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

cve-program ·

Vendor product: oras-go

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-27238Published

InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

cve-program ·

Vendor product: InDesign Desktop

CVSS 3.1 7.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54247Published

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to …

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-90876Published

SourceCodester Online Faculty Clearance System delete_requirement.php sql injection

cve-program ·

Vendor product: Online Faculty Clearance System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90854Published

SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection

cve-program ·

Vendor product: Online Food Ordering System · Vendor product: Online Food Ordering System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0187Published

In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not n…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0189Published

In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0192Published

In Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-79411Published

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint (…

cve-program ·

Vendor product: n/a

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-39038Published

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.

cve-program ·

Vendor product: n/a

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0179Published

In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-0186Published

In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for explo…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-37152Published

TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.

cve-program ·

Vendor product: n/a

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88617Published

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.

cve-program ·

Vendor product: n/a

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-25827Published

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal i…

cve-program ·

Vendor product: n/a

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-62597Published

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle Enterprise Manager Base Platform

CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-70755Published

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Oracle Web Applications Desktop Integrator

CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-70915Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-71047Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-71163Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73926Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73941Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

GHSA-r2pf-9cw4-5j65Published

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

osv · CVE-2026-68904

npm: node-opcua-transport · npm: node-opcua-client · npm: node-opcua

HIGHSource modified 16 Sep 2026Recorded 24 Oct 2026

CVE-2026-73942Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73943Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attac…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 7.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73945Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73946Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 9.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73948Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73949Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged att…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73951Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated …

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73954Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker wit…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73955Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73957Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 9.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73958Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticat…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73959Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73962Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 9.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73965Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73966Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows high privileged attacker with network access via …

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 7.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82992Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infras…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82993Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82996Published

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allo…

cve-program ·

Vendor product: Oracle Platform Security for Java

CVSS 3.1 7.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82997Published

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Service Delivery Platform

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82998Published

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Service Delivery Platform

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-82999Published

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: Service Delivery Platform

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90831Published

GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption

cve-program ·

Vendor product: Binutils

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83001Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 9.1Source modified 16 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.