Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690419 source statements · aliases may refer to the same vulnerability

CVE-2026-116691Published

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

cve-program ·

Vendor product: mlflow

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87308Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87307Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87306Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112351Published

Sunhillo SureLine OS Command Injection via networkDiag.cgi

cve-program ·

Vendor product: SureLine

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112350Published

Sunhillo SureLine Path Traversal via radarUpdater.cgi

cve-program ·

Vendor product: SureLine

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87301Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87290Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116688Published

CKEditor: Cross-site scripting (XSS) in the engine package

cve-program ·

Vendor product: ckeditor5

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116687Published

CKEditor: Cross-site scripting (XSS) in the engine package

cve-program ·

Vendor product: ckeditor5

CVSS 3.1 3.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-110910Published

qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

cve-program ·

https://npmjs.com/qs: qs

CVSS 3.1 3.7 · CVSS 4.0 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87305Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticat…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87304Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87303Published

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…

cve-program ·

Vendor product: Oracle VM VirtualBox

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87300Published

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1…

cve-program ·

Vendor product: Oracle Weblogic Server Proxy Plug-in

CVSS 3.1 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112355Published

MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API

cve-program ·

Vendor product: MembershipWorks

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-mgcc-cww5-fp2qPublished

Go JOSE: DoS when parsing JWKs that contain RSA keys

osv · CVE-2026-116587

Go: github.com/go-jose/go-jose/v4 · Go: github.com/go-jose/go-jose/v3

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-2m5v-pch6-74hxPublished

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

osv · CVE-2026-109383

npm: undici · npm: undici · npm: undici

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-4w7w-5xrc-9h26Published

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

osv · CVE-2026-109829

npm: undici · npm: undici

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-qrxm-fqhp-jwvmPublished

undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

osv · CVE-2026-87018

npm: undici · npm: undici · npm: undici

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-vg84-c5mg-76xhPublished

CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values

osv · CVE-2026-116683

Go: github.com/ctfer-io/terraform-provider-ctfd · Go: github.com/ctfer-io/terraform-provider-ctfd/v2

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-9fm3-97px-rjf6Published

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

osv · CVE-2026-109932

npm: undici · npm: undici · npm: undici

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-55wc-3pg8-jfw6Published

undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

osv · CVE-2026-87029

npm: undici · npm: undici

MODERATESource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-f897-62hf-6gxqPublished

MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length

osv ·

npm: @modelcontextprotocol/sdk · npm: @modelcontextprotocol/server · npm: @modelcontextprotocol/node

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87299Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87298Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116684Published

Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

cve-program ·

Vendor product: python-sdk

CVSS 3.1 6.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2024-22031Published

A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gain…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-87297Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitab…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 6.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87296Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87295Published

Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Indian Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to…

cve-program ·

Vendor product: Oracle HRMS (India)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87294Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87293Published

Vulnerability in Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87292Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87291Published

Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multipl…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87263Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows lo…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87255Published

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83426Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticat…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83409Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticat…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83407Published

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: Oracle Access Manager

CVSS 3.1 8.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83406Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitab…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 6.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83404Published

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multip…

cve-program ·

Vendor product: MySQL Connectors

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-102675Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProt…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-83403Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83402Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attack…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83401Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113869Published

Use-after-free in S/MIME decryption during a security device password prompt

cve-program ·

Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118004Published

Incorrect boundary conditions in the CSS Transitions and Animations component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118003Published

Information disclosure in the Networking: DNS component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118002Published

Information disclosure due to race condition in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.