Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690366 source statements · aliases may refer to the same vulnerability

CVE-2026-67074Published

HCL BigFix AEX is affected by multiple security vulnerabilities.

cve-program ·

Vendor product: BigFix AEX

CVSS 3.1 9.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87324Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privilege…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87323Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87322Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical c…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 8.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87321Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87320Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87318Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privilege…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-102790Published

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12

cve-program ·

Vendor product: iCagenda extension for Joomla

CVSS 4.0 8.6Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114278Published

Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

cve-program ·

Vendor product: Eclipse Che

CVSS 3.1 9.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-102799Published

Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16

cve-program ·

Vendor product: iCagenda extension for Joomla

CVSS 4.0 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87316Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87317Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticat…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 4.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87315Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2023-5009Published

Incorrect Authorization in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2023-3932Published

Incorrect User Management in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2023-3399Published

Insertion of Sensitive Information Into Sent Data in GitLab

cve-program ·

Vendor product: GitLab

CVSS 3.1 8.5Source modified 28 Oct 2026Recorded 28 Oct 2026

MAL-2026-4365Withdrawn

Malicious code in @atlisp/mcp (npm)

osv · GHSA-65cr-mcfq-59hh

npm: @atlisp/mcp

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-118485Published

Axel Download Accelerator Path Traversal via URL Filename Decoding

cve-program ·

Vendor product: Axel

CVSS 4.0 7.0 · CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87314Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attack…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87313Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2025-26926Published

WordPress Booknetic plugin < 5.10.4 - Cross Site Request Forgery (CSRF) vulnerability

cve-program ·

https://codecanyon.net: booknetic

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-116229Published

ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting

cve-program ·

Vendor product: FFXIV Teamcraft

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117526Published

reduxjs redux-devtools Remotedev Server evalAction code injection

cve-program ·

Vendor product: redux-devtools

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87312Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privilege…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87311Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastruc…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 5.6Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87310Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-118477Published

KaliFast Project Management Platform ei_git_repo_url OS Command Injection

cve-program ·

Vendor product: Kalifast

CVSS 4.0 8.7 · CVSS 3.1 9.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87309Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-6064Published

Norton, Avast, and AVG local privilege escalation via link following in Data Shredder

cve-program ·

Vendor product: Norton Antivirus · Vendor product: Avast Antivirus · Vendor product: AVG Internet Security

CVSS 3.1 7.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117858Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117857Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117856Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117855Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117854Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117853Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117852Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117851Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117850Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117849Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117848Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117847Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117846Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117845Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117844Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117843Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117842Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117841Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117840Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117839Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-117838Rejected

Reserved in error; never associated with a vulnerability.

cve-program ·

Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.