Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690450 source statements · aliases may refer to the same vulnerability

CVE-2026-116894Published

REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

cve-program ·

Vendor product: core

CVSS 4.0 2.3 · CVSS 3.1 4.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116898Published

REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

cve-program ·

Vendor product: core

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117533Published

REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

cve-program ·

Vendor product: core

CVSS 4.0 2.1 · CVSS 3.1 4.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117537Published

REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

cve-program ·

Vendor product: core

CVSS 4.0 2.1 · CVSS 3.1 4.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117541Published

svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()

cve-program ·

Vendor product: svg-sanitizer

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-90730Published

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …

cve-program ·

Vendor product: PowerProtect Data Domain

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83392Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 3.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83391Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83390Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 4.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83385Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83389Published

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (UK)

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83388Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with …

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 2.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118027Published

Frame poisoning in the Layout component

cve-program ·

Vendor product: Firefox

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-118018Published

Spoofing issue in the Downloads component in Firefox for Android

cve-program ·

Vendor product: Firefox

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109708Published

Sandbox escape due to incorrect boundary conditions in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109707Published

Sandbox escape due to use-after-free in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-109705Published

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

cve-program ·

Vendor product: Firefox · Vendor product: Thunderbird

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83387Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83386Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117504Published

a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service

cve-program ·

Vendor product: a2a-go

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83384Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83383Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117503Published

a2aproject a2a-go REST SSE handler rest.go resource consumption

cve-program ·

Vendor product: a2a-go

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-px68-xx5g-48q5Published

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

osv · CVE-2026-46350

npm: dcmjs

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-47hv-j4px-h3c9Published

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

osv · CVE-2026-34157

Go: github.com/wailsapp/wails/v2

HIGHSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83382Published

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Report Manager

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83381Published

Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle Graa…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83380Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83378Published

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113713Published

virtualenv: Temporary app-data can leave dangling seed package links

cve-program ·

Vendor product: virtualenv

CVSS 4.0 4.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83377Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Mobile Applications). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113718Published

virtualenv: Xonsh activation literals depend on the script decoding codec

cve-program ·

Vendor product: virtualenv

CVSS 4.0 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-90727Published

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …

cve-program ·

Vendor product: PowerProtect Data Domain

CVSS 3.1 3.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83366Published

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker wit…

cve-program ·

Vendor product: Oracle Shipping Execution

CVSS 3.1 7.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113723Published

virtualenv: Bash prompt values can change meaning under older compatibility modes

cve-program ·

Vendor product: virtualenv

CVSS 4.0 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-60882Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-7025Published

Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery

cve-program ·

Vendor product: Typecho

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116371Published

Akuvox Akubela HyPanel PS51 login improper authentication

cve-program ·

Vendor product: Akubela HyPanel PS51

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-60745Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 4.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113728Published

Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

cve-program ·

Vendor product: webmail

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113732Published

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-10537Published

Remote unauthenticated information disclosure and denial of service due to unauthenticated service access

cve-program ·

Vendor product: Control-M/Enterprise Manager · Vendor product: Control-M/Server

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83376Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-16307Published

IDOR in Netiket Information Technologies' EdoWEB

cve-program ·

Vendor product: EdoWEB

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83375Published

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attack…

cve-program ·

Vendor product: PeopleSoft Enterprise HCM Human Resources

CVSS 3.1 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83374Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-95610Published

WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: us-core

CVSS 3.1 8.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83373Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 3.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83372Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network acces…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91655Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.