Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

689764 source statements · aliases may refer to the same vulnerability

CVE-2026-116746Published

QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview

cve-program ·

Vendor product: qloapps

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116591Published

compress zstd: Panic on two-block frames

cve-program ·

Vendor product: compress

CVSS 4.0 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116515Published

itsourcecode Online Book Store book.php sql injection

cve-program ·

Vendor product: Online Book Store

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116556Published

Argilla TextField.vue cross site scripting

cve-program ·

Vendor product: Argilla

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116801Published

Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116805Published

OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list

cve-program ·

Vendor product: openpanel

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116809Published

OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

cve-program ·

Vendor product: openpanel

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116813Published

OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

cve-program ·

Vendor product: openpanel

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116818Published

OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

cve-program ·

Vendor product: openpanel

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116822Published

YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter

cve-program ·

Vendor product: yeswiki

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116826Published

YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.2 · CVSS 3.1 6.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116604Published

SourceCodester Online Food Ordering System delete_admin.php missing authentication

cve-program ·

Vendor product: Online Food Ordering System

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116620Published

Tencent RapidJSON Regex stream.h Take out-of-bounds

cve-program ·

Vendor product: RapidJSON

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2024-58400Published

llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116840Published

llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116640Published

Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting

cve-program ·

Vendor product: HR-Payroll-Management-System

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-92885Published

Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login

cve-program ·

Vendor product: Qode Membership

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116874Published

SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83394Published

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with netw…

cve-program ·

Vendor product: Oracle Demand Planning

CVSS 3.1 6.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116878Published

Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116882Published

Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 4.0 4.8 · CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116886Published

Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116890Published

Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

cve-program ·

Vendor product: SemanticMediaWiki

CVSS 4.0 6.9 · CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116894Published

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

cve-program ·

Vendor product: core

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116898Published

REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

cve-program ·

Vendor product: core

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117533Published

REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

cve-program ·

Vendor product: core

CVSS 4.0 2.1 · CVSS 3.1 4.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117537Published

REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

cve-program ·

Vendor product: core

CVSS 4.0 2.1 · CVSS 3.1 4.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117541Published

svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

cve-program ·

Vendor product: svg-sanitizer

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-90730Published

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …

cve-program ·

Vendor product: PowerProtect Data Domain

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83392Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 3.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83391Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83390Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 4.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83385Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83389Published

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (UK)

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83388Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with …

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 2.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118027Published

Frame poisoning in the Layout component

cve-program ·

Vendor product: Firefox

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118018Published

Spoofing issue in the Downloads component in Firefox for Android

cve-program ·

Vendor product: Firefox

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109708Published

Sandbox escape due to incorrect boundary conditions in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109707Published

Sandbox escape due to use-after-free in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109705Published

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83387Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83386Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117504Published

a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service

cve-program ·

Vendor product: a2a-go

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83384Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107067Published

An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information

cve-program ·

Vendor product: n/a

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83383Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117503Published

a2aproject a2a-go REST SSE handler rest.go resource consumption

cve-program ·

Vendor product: a2a-go

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-px68-xx5g-48q5Published

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

osv · CVE-2026-46350

npm: dcmjs

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-47hv-j4px-h3c9Published

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

osv · CVE-2026-34157

Go: github.com/wailsapp/wails/v2

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83382Published

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Report Manager

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.