Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690463 source statements · aliases may refer to the same vulnerability

CVE-2026-16521Published

Supermicro BMC's syslog feature contains a command injection vulnerability

cve-program ·

Vendor product: MBD-X12STW-F

CVSS 3.1 7.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-115975Published

Broken access control in JiraController

cve-program ·

Vendor product: cervantes

CVSS 3.1 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-7678Published

YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-15098Published

YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-10277Published

YunaiV yudao-cloud submit improper authorization

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111461Published

SMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series

cve-program ·

Vendor product: OnCell G3150A-LTE Series

CVSS 4.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101034Published

Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials

cve-program ·

Vendor product: Symantec Ghost Solution Suite

CVSS 4.0 6.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111460Published

Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series

cve-program ·

Vendor product: OnCell G3150A-LTE Series

CVSS 4.0 7.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111459Published

Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)

cve-program ·

Vendor product: Moxa Remote Connect Suite (MRC Client)

CVSS 4.0 7.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-10278Published

YunaiV ruoyi-vue-pro transfer improper authorization

cve-program ·

Vendor product: ruoyi-vue-pro

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-10276Published

YunaiV ruoyi-vue-pro transfer improper authorization

cve-program ·

Vendor product: ruoyi-vue-pro

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-10275Published

YunaiV yudao-cloud transfer improper authorization

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-10988Published

YunaiV ruoyi-vue-pro transfer improper authorization

cve-program ·

Vendor product: ruoyi-vue-pro

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-10987Published

YunaiV yudao-cloud HTTP Request transfer improper authorization

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-28039Published

WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability

cve-program ·

https://wordpress.org/plugins: wpdatatables

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107656Published

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox Paa…

cve-program ·

Vendor product: FortiSandbox · Vendor product: FortiSandbox PaaS

CVSS 3.1 9.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105946Published

Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt

cve-program ·

Vendor product: qt

CVSS 4.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-8556Published

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-117468Published

Device-code claim permits restricted token escalation in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117472Published

URL prefix handling permits API key read-scope bypass in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117471Published

User-controlled Duo host permits authenticated SSRF in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117470Published

WebAuthn assertion replay permits second-factor bypass in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117469Published

File-transfer type confusion permits unauthorized repository writes in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116370Published

2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion

cve-program ·

Vendor product: Sid Meier's Civilization VI

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-8556Published

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

cve-program ·

https://github.com/cloudflare/circl/: circl · https://access.redhat.com/downloads/content/package-browser/: openshift-builds/openshift-builds-controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: openshift-builds/openshift-builds-git-cloner-rhel9

CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-14874Published

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2025-14874Published

Nodemailer: nodemailer: denial of service via crafted email address header

cve-program ·

https://github.com/nodemailer/nodemailer: nodemailer · https://access.redhat.com/downloads/content/package-browser/: rhacm2/acm-grafana-rhel9 · https://access.redhat.com/downloads/content/package-browser/: rhceph/grafana-rhel9

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-11395Published

Podman: arbitrary file write when importing oci archive

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: buildah · https://access.redhat.com/downloads/content/package-browser/: skopeo · https://access.redhat.com/downloads/content/package-browser/: buildah

CVSS 3.1 5.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2023-6717Published

Keycloak: xss via assertion consumer service url in saml post-binding flow

cve-program ·

https://github.com/keycloak/keycloak: keycloak · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: keycloak · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle

CVSS 3.1 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112484Published

This issue was addressed with improved file handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to execute arbitrary code with system privileges.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112651Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web cont…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-65327Published

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A local attacker may be able to elevate their privileges.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112427Published

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may be able to cause arbitrary code execution.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86929Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to arbitrary code execution.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-64759Published

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112438Published

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112623Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web cont…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112659Published

A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web conten…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112655Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing mal…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113947Published

This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86916Published

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitra…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91506Published

Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Workflow

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91323Published

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthe…

cve-program ·

Vendor product: Oracle WebLogic Server

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83379Published

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1…

cve-program ·

Vendor product: Oracle Weblogic Server Proxy Plug-in

CVSS 3.1 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101428Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101665Published

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle Mobile Field Service

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101672Published

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Call Center Technology

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101429Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-60885Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83427Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Multichannel Framework). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.6Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.