Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694240 source statements · aliases may refer to the same vulnerability

CVE-2026-113776Published

virtualenv activation scripts run code from a path that contains a placeholder name

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87397Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87396Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87394Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 8.2Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87393Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87392Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network acce…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87388Published

Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Configurator

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87377Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87364Published

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle Service Bus

CVSS 3.1 8.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87391Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker wi…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 5.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87390Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated att…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87389Published

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Human Resources Management

CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87387Published

Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (component: Homebuilder Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Homebuilder

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87386Published

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with ne…

cve-program ·

Vendor product: JD Edwards EnterpriseOne General Ledger

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87385Published

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Human Resources Management

CVSS 3.1 4.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87384Published

Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Human Resources Management

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87383Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker wi…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 6.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87382Published

Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Edwards (component: Operational Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Operational Sourcing

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87381Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.4Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87380Published

Vulnerability in the JD Edwards EnterpriseOne Sales Order Entry product of Oracle JD Edwards (component: Sales Order Entry). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Sales Order Entry

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87379Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87378Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87376Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87375Published

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wit…

cve-program ·

Vendor product: WebCenter Content: Imaging

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87374Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged at…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112935Published

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

cve-program ·

Vendor product: filelock

CVSS 3.1 4.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-114111Published

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.9Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-114101Published

Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with fil…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 4.0Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113665Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113659Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQuery when an authenticated victim loads a …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113654Published

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end it…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-113650Published

ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to sani…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-112950Published

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/inte…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 28 Oct 2026Recorded 29 Oct 2026

CVE-2026-87372Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87371Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated a…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.8Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112941Published

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

cve-program ·

Vendor product: filelock

CVSS 3.1 3.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-111762Published

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

cve-program ·

Vendor product: a2a-java

CVSS 4.0 5.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87370Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged at…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112945Published

Vite: Cross origin script execution through Vite custom middleware

cve-program ·

Vendor product: vite · Vendor product: vite-plus

CVSS 4.0 2.1Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87367Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.7Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87366Published

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker wit…

cve-program ·

Vendor product: Oracle Applications Framework

CVSS 3.1 4.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113672Published

Argo CD: A Jsonnet import can read files from the repo-server

cve-program ·

Vendor product: argo-cd

CVSS 3.1 9.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87365Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged atta…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87363Published

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle Payroll

CVSS 3.1 7.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87362Published

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network …

cve-program ·

Vendor product: Oracle Agile PLM

CVSS 3.1 6.5Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-112950Published

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

cve-program ·

Vendor product: vitest · Vendor product: mocker

CVSS 3.1 5.9Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113650Published

ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)

cve-program ·

Vendor product: apostrophe · Vendor product: sanitize-html

CVSS 3.1 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-87361Published

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with netw…

cve-program ·

Vendor product: Oracle WebCenter Content

CVSS 3.1 4.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113654Published

ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render

cve-program ·

Vendor product: apostrophe · Vendor product: sanitize-html

CVSS 4.0 5.3Source modified 28 Oct 2026Recorded 28 Oct 2026

CVE-2026-113659Published

ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users

cve-program ·

Vendor product: apostrophe

CVSS 3.1 6.1Source modified 28 Oct 2026Recorded 28 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.