Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694174 source statements · aliases may refer to the same vulnerability

CVE-2026-57169Published

Dockhand: Unauthenticated container exec via WebSocket upgrade

cve-program ·

Vendor product: dockhand

CVSS 3.1 9.6Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114133Published

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114129Published

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full ke…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114125Published

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook developmen…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114121Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, requests to open external protocol URLs could be attributed to a document…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113797Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions that …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114377Published

leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal

cve-program ·

Vendor product: wiki-go

CVSS 4.0 5.1 · CVSS 3.1 3.8 · CVSS 3.0 3.8 · CVSS 2.0 4.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91321Published

Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with netwo…

cve-program ·

Vendor product: iProcurement

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91322Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 3.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91324Published

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure wher…

cve-program ·

Vendor product: Oracle Solaris

CVSS 3.1 4.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91325Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91320Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows high privileged attac…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 5.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114138Published

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

cve-program ·

Vendor product: django-rest-framework

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91319Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91318Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attack…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91317Published

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Databinding). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker…

cve-program ·

Vendor product: Oracle JDeveloper

CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91316Published

Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with net…

cve-program ·

Vendor product: iProcurement

CVSS 3.1 7.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-97380Published

MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

cve-program ·

Vendor product: server

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91315Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114374Published

leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery

cve-program ·

Vendor product: wiki-go

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91346Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-62362Published

PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for analysis endpoint

cve-program ·

Vendor product: PeerBanHelper

CVSS 3.1 4.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91347Published

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access vi…

cve-program ·

Vendor product: iSupport

CVSS 3.1 8.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91348Published

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure …

cve-program ·

Vendor product: Oracle Solaris

CVSS 3.1 8.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112356Published

GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

cve-program ·

Vendor product: GFI KerioConnect

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-59962Published

Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

cve-program ·

Vendor product: recipes

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91342Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91341Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 9.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91340Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114268Published

Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow

cve-program ·

Vendor product: BE3L Pro

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2020-37284Published

Sickbeard build-507 Reflected XSS via testNaming pattern Parameter

cve-program ·

Vendor product: Sickbeard

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-61726Published

Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content

cve-program ·

Vendor product: recipes

CVSS 3.1 8.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2018-25438Published

Intermesh Group-Office < 3.5.5 Path Traversal via compress.php

cve-program ·

Vendor product: Group-Office

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91339Published

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access vi…

cve-program ·

Vendor product: iSupport

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91338Published

Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access…

cve-program ·

Vendor product: iSupport

CVSS 3.1 7.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2017-20287Published

Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter

cve-program ·

Vendor product: Javo Spot

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-91337Published

Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: iProcurement

CVSS 3.1 7.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-103332Published

Payex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key

cve-program ·

Vendor product: Payex Payment Gateway for Woocommerce

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-103312Published

Payment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback

cve-program ·

Vendor product: Payment Integration Wompi

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-103372Published

Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure

cve-program ·

Vendor product: Payconiq

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-103382Published

Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation

cve-program ·

Vendor product: Casso Flow

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-103688Published

Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload

cve-program ·

Vendor product: Checkout Files Upload for WooCommerce

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-104694Published

Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter

cve-program ·

Vendor product: Thrive Automator

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-105972Published

WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute

cve-program ·

Vendor product: Menu Cart for WooCommerce

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-105997Published

Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient

cve-program ·

Vendor product: Booking Package

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-106002Published

Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion

cve-program ·

Vendor product: Court Reservation

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-106003Published

Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion

cve-program ·

Vendor product: Court Reservation

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-106647Published

Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision

cve-program ·

Vendor product: Royal Addons for Elementor

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-107097Published

Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe

cve-program ·

Vendor product: Royal Addons for Elementor

Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-107098Published

Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting

cve-program ·

Vendor product: Royal Addons for Elementor

Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.