Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

690729 source statements · aliases may refer to the same vulnerability

CVE-2026-7600Published

A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/index.ts of the component MCP Interface. Executing a manipulation can lead to os command injection. The …

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 2.0 · [email protected] · Secondary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-7645Published

A vulnerability was found in ruvnet sublinear-time-solver 1.5.0. Affected by this vulnerability is the function export_state of the file src/consciousness-explorer/mcp/server.js of the component MCP Interface. The manipulation results in pa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 6.5 · CVSS 2.0 · [email protected] · Secondary 6.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8115Published

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the file src/server/routers/rest.ts of the component REST API. The manipulation of the argument req.params.tmpFile results in p…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Secondary 5.3 · CVSS 2.0 · [email protected] · Secondary 5.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-91539Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privile…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91537Published

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Ora…

cve-program ·

Vendor product: Oracle Solaris

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91536Published

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: Oracle SOA Suite

CVSS 3.1 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91535Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allo…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91534Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 8.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91532Published

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle Applications Manager

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91530Published

Vulnerability in Oracle GoldenGate (component: Admin Client Executable). Supported versions that are affected are 23.4-23.26.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromi…

cve-program ·

Vendor product: Oracle GoldenGate

CVSS 3.1 4.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91528Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91527Published

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core). The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP…

cve-program ·

Vendor product: Oracle ZFS Storage Appliance Kit

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-70382Published

Stored Cross-Site Scripting in Web Interface

cve-program ·

Vendor product: Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro · Vendor product: Cynap Pure (Next Gen), Cynap Bridge · Vendor product: Cynap Videobar

CVSS 4.0 5.1 · CVSS 3.1 4.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91526Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attack…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 4.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115728Published

@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing

cve-program ·

Vendor product: @hapi/content

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116144Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116146Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116150Published

ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116154Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91524Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91523Published

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Business Intelligence Enterprise Edition

CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91521Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows lo…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91520Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows lo…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65630Published

Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65632Published

ECDSA signature length is not validated in jose, allowing signature malleability

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 5.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65631Published

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 6.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91519Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65629Published

Weak PBKDF2 parameters for password-encrypted private-key export in jose

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 7.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65628Published

Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65627Published

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 6.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65626Published

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65625Published

Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

cve-program ·

https://repo.hex.pm: jose · https://github.com: potatosalad/erlang-jose

CVSS 4.0 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-70381Published

Unauthorized Access to Internal Web Resources

cve-program ·

Vendor product: Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro · Vendor product: Cynap Pure (Next Gen), Cynap Bridge · Vendor product: Cynap Videobar

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91518Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privilege…

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91517Published

Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin). Supported versions that are affected are 13.4.1.0.1-13.5.2.0.6. Easily exploitable vulnerability allows unauthenticated …

cve-program ·

Vendor product: Oracle Management Pack for Oracle GoldenGate

CVSS 3.1 8.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91515Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows …

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114055Published

vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116156Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116157Published

ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116158Published

ImageMagick before 7.1.2-33 Memory Leak in magick compare

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 2.0 · CVSS 3.1 2.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116173Published

vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids

cve-program ·

Vendor product: vllm

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116178Published

vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders

cve-program ·

Vendor product: vllm

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116180Published

vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors

cve-program ·

Vendor product: vllm

CVSS 4.0 8.3 · CVSS 3.1 7.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115720Published

Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect

cve-program ·

Vendor product: builder

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116541Published

netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

cve-program ·

https://repo1.maven.org/maven2/io/netty/netty-tcnative/: io.netty:netty-tcnative · https://repo1.maven.org/maven2/io/netty/netty-tcnative-boringssl-static/: io.netty:netty-tcnative-boringssl-static

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115909Published

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

cve-program ·

Vendor product: zip2

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115920Published

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

cve-program ·

Vendor product: onnx

CVSS 3.1 6.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91514Published

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle BI Publisher

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-109956Published

NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path

cve-program ·

Vendor product: nltk

CVSS 4.0 8.3 · CVSS 3.1 7.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91512Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows hi…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 7.2Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.