Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690695 source statements · aliases may refer to the same vulnerability

CVE-2026-43715Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing malic…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112707Published

A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to identify what other apps a user has installed.

cve-program ·

Vendor product: iOS and iPadOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112510Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause a denial-of-service.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84560Published

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may gain unauthorized access to Bluetooth.

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65349Published

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112639Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web cont…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84537Published

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination or corrupt kernel memory.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112681Published

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.

cve-program ·

Vendor product: iOS and iPadOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112551Published

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to read sensitive location information.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84521Published

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to caus…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112414Published

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a mali…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112697Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing mal…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84599Published

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be ab…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-112443Published

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84576Published

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113897Published

This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91579Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticate…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-109376Published

ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html

cve-program ·

Vendor product: ERPNext

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91577Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileg…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 6.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91576Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged a…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-109556Published

EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC

cve-program ·

Vendor product: EdgeEver

CVSS 4.0 7.3 · CVSS 3.1 8.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91574Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91573Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows un…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91568Published

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access vi…

cve-program ·

Vendor product: Oracle Database Server

CVSS 3.1 7.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91565Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows …

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 6.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91563Published

Vulnerability in the Oracle OLAP component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privi…

cve-program ·

Vendor product: Oracle OLAP

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91562Published

Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Inventory Brazil

CVSS 3.1 4.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91559Published

Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Manufacturing Brazil

CVSS 3.1 4.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91557Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged at…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91555Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91554Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via H…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91553Published

Vulnerability in the PeopleSoft Enterprise FIN Product Configurator Brazil product of Oracle PeopleSoft (component: Product Configurator). The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileg…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Product Configurator Brazil

CVSS 3.1 4.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116576Published

systeminformation: Windows command injection in services() through Unicode quotation marks

cve-program ·

Vendor product: systeminformation

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115909Published

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompr…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 29 Oct 2026

CVE-2026-115908Published

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 26 Oct 2026Recorded 29 Oct 2026

CVE-2026-115728Published

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-115385Published

Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that allows guests to abort the Unix host process. Guests with mutable preopened directory access c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 6.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-115381Published

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2 write-zeroes method of SinkOutputStream, the default stream used when stdout/stderr are not configur…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Secondary 4.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-115380Published

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 poll_oneoff adapter, which performs O(n) host work per subscription without consuming or …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-112955Published

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before docum…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-91552Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91550Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows lo…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116502Published

turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write

cve-program ·

Vendor product: ExLlamaV2

CVSS 4.0 4.8 · CVSS 3.1 4.4 · CVSS 3.0 4.4 · CVSS 2.0 3.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91549Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows una…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91547Published

Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: Oracle GoldenGate

CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-57196Published

Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages

cve-program ·

Vendor product: asterisk · Vendor product: certified-asterisk

CVSS 4.0 2.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91546Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91545Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows un…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91542Published

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle WebCenter Sites

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116671Published

Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder

cve-program ·

Vendor product: Xpdf

CVSS 4.0 2.1Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.