Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690320 source statements · aliases may refer to the same vulnerability

CVE-2021-48020Published

Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

cve-program ·

Vendor product: vyper

CVSS 4.0 8.3 · CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112911Published

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

cve-program ·

Vendor product: filelock

CVSS 3.1 6.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114091Published

Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-115402Published

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.

cve-program ·

Vendor product: ovpn-dco-win

CVSS 4.0 5.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2020-37287Published

Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

cve-program ·

Vendor product: vyper

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-93520Published

X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

cve-program ·

Vendor product: xorg-x11-server · Vendor product: xwayland

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113738Published

R6410418 Jackrong-llm-finetuning-guide MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads path traversal

cve-program ·

Vendor product: Jackrong-llm-finetuning-guide

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113707Published

a2aproject a2a-rs inmemory.rs update race condition

cve-program ·

Vendor product: a2a-rs

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113776Published

virtualenv activation scripts run code from a path that contains a placeholder name

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87397Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87396Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87394Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87393Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87392Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network acce…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87388Published

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Configurator

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87377Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87364Published

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle Service Bus

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87391Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker wi…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87390Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-93519Published

X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

cve-program ·

Vendor product: xorg-x11-server · Vendor product: xwayland

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87389Published

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Human Resources Management

CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87387Published

Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (component: Homebuilder Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Homebuilder

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87386Published

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with ne…

cve-program ·

Vendor product: JD Edwards EnterpriseOne General Ledger

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87385Published

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Human Resources Management

CVSS 3.1 4.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87384Published

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Human Resources Management

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-93518Published

X.Org Server XKB ResizeKeyType Numeric Truncation

cve-program ·

Vendor product: xorg-x11-server · Vendor product: xwayland

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87383Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker wi…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87382Published

Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Edwards (component: Operational Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Operational Sourcing

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87381Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87380Published

Vulnerability in the JD Edwards EnterpriseOne Sales Order Entry product of Oracle JD Edwards (component: Sales Order Entry). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Sales Order Entry

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87379Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87378Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87376Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87375Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87374Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged at…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112935Published

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

cve-program ·

Vendor product: filelock

CVSS 3.1 4.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114111Published

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114101Published

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with fil…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 4.0Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113665Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113659Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113654Published

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end it…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113650Published

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sani…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-112950Published

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/inte…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-87372Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87371Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112941Published

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

cve-program ·

Vendor product: filelock

CVSS 3.1 3.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111762Published

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87370Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged at…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112945Published

Vite: Cross origin script execution through Vite custom middleware

cve-program ·

Vendor product: vite · Vendor product: vite-plus

CVSS 4.0 2.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87367Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.