Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

699685 source statements · aliases may refer to the same vulnerability

CVE-2026-83002Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83003Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83004Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low pri…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 7.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83005Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83006Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high priv…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 9.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83007Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83008Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83009Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83010Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high priv…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83011Published

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability al…

cve-program ·

Vendor product: Oracle Platform Security for Java

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83012Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83013Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83014Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83015Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83016Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.2Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83017Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83018Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the inf…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83019Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 8.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83022Published

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthe…

cve-program ·

Vendor product: Oracle WebCenter Enterprise Capture

CVSS 3.1 7.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83023Published

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Identity Manager Connector

CVSS 3.1 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83024Published

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle Identity Manager Connector

CVSS 3.1 7.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83025Published

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle Identity Manager Connector

CVSS 3.1 8.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83026Published

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle Identity Manager Connector

CVSS 3.1 8.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83027Published

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Identity Manager Connector

CVSS 3.1 9.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83028Published

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle Identity Manager Connector

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83029Published

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privile…

cve-program ·

Vendor product: Oracle Managed File Transfer

CVSS 3.1 9.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83030Published

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privile…

cve-program ·

Vendor product: Oracle Managed File Transfer

CVSS 3.1 8.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83031Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83032Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83033Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 8.8Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83034Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 7.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83038Published

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability…

cve-program ·

Vendor product: Oracle WebLogic Server

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83039Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 9.9Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83040Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated at…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 9.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83041Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged att…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-4130Published

Storage of Sensitive Information in Cleartext in NI SystemLink

cve-program ·

Vendor product: SystemLink · Vendor product: SystemLink Server

CVSS 3.1 7.1 · CVSS 4.0 8.4Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83043Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker w…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 9.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83044Published

Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: Oracle XML Gateway

CVSS 3.1 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83045Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 8.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-83046Published

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle WebCenter Portal

CVSS 3.1 7.1Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-4129Published

Improper Access Controls in NI SystemLink

cve-program ·

Vendor product: SystemLink · Vendor product: SystemLink Server

CVSS 3.1 8.1 · CVSS 4.0 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90826Published

GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds

cve-program ·

Vendor product: GPAC

CVSS 4.0 2.4 · CVSS 3.1 2.8 · CVSS 3.0 2.8 · CVSS 2.0 1.7Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-53716Published

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

cve-program ·

Vendor product: gateway

CVSS 3.1 6.5Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-90818Published

netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery

cve-program ·

Vendor product: LobsterAI

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-54247Published

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

cve-program ·

Vendor product: skipper

CVSS 3.1 4.3Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55244Published

ASTEVAL: Sandbox Escape via BaseException Subclasses

cve-program ·

Vendor product: asteval

CVSS 3.1 5.0Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-88976Published

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, Plate core HTML deserialization APIs parse supplied HTML strings in the active document. When an applic…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 16 Sep 2026Recorded 25 Oct 2026

CVE-2026-54628Published

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

cve-program ·

Vendor product: anyquery

CVSS 3.1 8.6Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-55301Published

In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

cve-program ·

Vendor product: Android

Source modified 16 Sep 2026Recorded 23 Oct 2026

CVE-2026-73496Published

MCP Atlassian: Arbitrary server-side file read via attachment upload

cve-program ·

Vendor product: mcp-atlassian

CVSS 3.1 7.7Source modified 16 Sep 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.