Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

691929 source statements · aliases may refer to the same vulnerability

CVE-2026-28039Published

WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability

cve-program ·

https://wordpress.org/plugins: wpdatatables

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-107656Published

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox Paa…

cve-program ·

Vendor product: FortiSandbox · Vendor product: FortiSandbox PaaS

CVSS 3.1 9.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-105946Published

Out-of-bounds read vulnerability in NTLM authentication handling impacts Qt

cve-program ·

Vendor product: qt

CVSS 4.0 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-8556Published

A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-117468Published

Device-code claim permits restricted token escalation in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117472Published

URL prefix handling permits API key read-scope bypass in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117471Published

User-controlled Duo host permits authenticated SSRF in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117470Published

WebAuthn assertion replay permits second-factor bypass in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-117469Published

File-transfer type confusion permits unauthorized repository writes in Psono Server

cve-program ·

Vendor product: Psono

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-8556Published

Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results

cve-program ·

https://github.com/cloudflare/circl/: circl · https://access.redhat.com/downloads/content/package-browser/: openshift-builds/openshift-builds-controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: openshift-builds/openshift-builds-git-cloner-rhel9

CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2025-14874Published

A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2025-14874Published

Nodemailer: nodemailer: denial of service via crafted email address header

cve-program ·

https://github.com/nodemailer/nodemailer: nodemailer · https://access.redhat.com/downloads/content/package-browser/: rhacm2/acm-grafana-rhel9 · https://access.redhat.com/downloads/content/package-browser/: rhceph/grafana-rhel9

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2023-6717Published

Keycloak: xss via assertion consumer service url in saml post-binding flow

cve-program ·

https://github.com/keycloak/keycloak: keycloak · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: keycloak · https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle

CVSS 3.1 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112484Published

This issue was addressed with improved file handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to execute arbitrary code with system privileges.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112651Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web cont…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-65327Published

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A local attacker may be able to elevate their privileges.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112427Published

An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may be able to cause arbitrary code execution.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86929Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. Processing a maliciously crafted file may lead to arbitrary code execution.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-64759Published

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112438Published

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An unprivileged attacker may be able to execute arbitrary code as root.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112623Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web cont…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112659Published

A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web conten…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-112655Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing mal…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113947Published

This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution.

cve-program ·

Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-86916Published

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7.2. An app may be able to execute arbitra…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91506Published

Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Workflow

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91323Published

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthe…

cve-program ·

Vendor product: Oracle WebLogic Server

CVSS 3.1 9.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83379Published

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1…

cve-program ·

Vendor product: Oracle Weblogic Server Proxy Plug-in

CVSS 3.1 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101428Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101665Published

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle Mobile Field Service

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101672Published

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Call Center Technology

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101429Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 7.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-60885Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83427Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Multichannel Framework). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87349Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to t…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91466Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged att…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Argentina

CVSS 3.1 6.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91474Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker w…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Brazil

CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91505Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon t…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101700Published

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with n…

cve-program ·

Vendor product: Oracle Application Object Library

CVSS 3.1 8.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101704Published

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon t…

cve-program ·

Vendor product: Oracle Concurrent Processing

CVSS 3.1 8.2Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101684Published

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low p…

cve-program ·

Vendor product: Oracle E-Business Suite Integrated SOA Gateway

CVSS 3.1 8.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101648Published

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker …

cve-program ·

Vendor product: Oracle Partner Management

CVSS 3.1 8.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-87408Published

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Oracle Applications Framework

CVSS 3.1 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-101824Published

Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacke…

cve-program ·

Vendor product: Document Management and Collaboration

CVSS 3.1 8.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116612Published

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application…

cve-program ·

https://gstreamer.freedesktop.org/: gst-editing-services

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2024-1249Published

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

cve-program ·

CVSS 3.1 7.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111147Published

Libyal libesedb through 20260704 Heap Out-of-Bounds Read via libesedb_record_get_multi_value

cve-program ·

https://github.com: libesedb

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111135Published

libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_volume_values_read_data

cve-program ·

https://github.com: libfwsi

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-111134Published

libfwsi through 20260522 Heap Out-of-Bounds Read via libfwsi_mtp_file_entry_values_read_data

cve-program ·

https://github.com: libfwsi

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-110613Published

youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List

cve-program ·

Vendor product: youlai-mall

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.