Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694174 source statements · aliases may refer to the same vulnerability

CVE-2026-115786Published

Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion

cve-program ·

Vendor product: Zimbra Collaboration Suite

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-116797Published

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

cve-program ·

Vendor product: highcharts · Vendor product: grid-pro · Vendor product: dashboards

CVSS 4.0 8.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91302Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 3.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91301Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileg…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 3.6Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91300Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker wi…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 3.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91298Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91297Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticate…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91296Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91295Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged …

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91294Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91293Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91314Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91313Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91312Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91311Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91310Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

MAL-2026-18363Published

Malicious code in itsa-utils (npm)

osv · GHSA-x788-rmcm-4x49

npm: itsa-utils

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91309Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attack…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91308Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91307Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91306Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91304Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114142Published

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distin…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.8Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2023-25166Published

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known wo…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2023-54366Published

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 8.8Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-92812Published

Decap CMS < 3.11.0 Path Traversal via Sibling Directory Prefix Matching

cve-program ·

Vendor product: decap-cms

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111379Published

FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.0 · CVSS 3.1 7.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111381Published

FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 7.0 · CVSS 3.1 7.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114724Published

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitt…

cve-program ·

Vendor product: Webmail

CVSS 3.1 7.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114662Published

Obot before 0.26.0 API Key Theft via CLI Login Token Request

cve-program ·

Vendor product: obot

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114658Published

Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite

cve-program ·

Vendor product: grav-plugin-login

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-116171Published

SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

cve-program ·

Vendor product: siyuan

CVSS 4.0 5.9 · CVSS 3.1 4.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114641Published

Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper

cve-program ·

Vendor product: traefik · Vendor product: traefik

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114637Published

Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak

cve-program ·

Vendor product: traefik

CVSS 4.0 7.0 · CVSS 3.1 8.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114633Published

WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php

cve-program ·

Vendor product: AVideo

CVSS 4.0 7.0 · CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114575Published

TOTOLINK A950RG product.so UploadCustomModule command injection

cve-program ·

Vendor product: A950RG

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114440Published

oretnom23 php-travel-agency-system delete.php sql injection

cve-program ·

Vendor product: php-travel-agency-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114509Published

Laravel TokenGuard authentication bypass through non-string API credentials

cve-program ·

Vendor product: framework

CVSS 4.0 9.2Source modified 28 Oct 2026Recorded 28 Oct 2026

MAL-2026-18320Published

Malicious code in @walknpm/todo-cli (npm)

osv · GHSA-p6gj-69gx-r376

npm: @walknpm/todo-cli

Source modified 28 Oct 2026Recorded 28 Oct 2026

MAL-2026-18321Published

Malicious code in dsh-plugin-blender-3d (npm)

osv · GHSA-hw9g-f63g-4c8x

npm: dsh-plugin-blender-3d

Source modified 28 Oct 2026Recorded 28 Oct 2026

MAL-2026-18360Published

Malicious code in itsa-react-checkbox (npm)

osv · GHSA-46r9-rx5f-hqqf

npm: itsa-react-checkbox

Source modified 28 Oct 2026Recorded 28 Oct 2026

MAL-2026-10535Published

Malicious code in my-empty-package (npm)

osv · GHSA-39q9-338w-8vhv

npm: my-empty-package

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114383Published

TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow

cve-program ·

Vendor product: EX200

CVSS 4.0 10.0 · CVSS 3.1 10.0 · CVSS 3.0 10.0 · CVSS 2.0 10.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114380Published

itsourcecode Online Cake Ordering System inserttrans.php sql injection

cve-program ·

Vendor product: Online Cake Ordering System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-55543Published

TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

cve-program ·

Vendor product: tuxguitar

CVSS 4.0 8.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-57446Published

libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* handle

cve-program ·

Vendor product: libiec61850

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-96644Published

Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

cve-program ·

Vendor product: Pillow

CVSS 4.0 7.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-96638Published

Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode

cve-program ·

Vendor product: Pillow

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-102923Published

SparkyFitness: SSRF via unvalidated custom_url in AI service settings

cve-program ·

Vendor product: SparkyFitness

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114142Published

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

cve-program ·

Vendor product: toml-node

CVSS 4.0 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.