Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694302 source statements · aliases may refer to the same vulnerability

CVE-2026-83387Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83386Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83384Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83383Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

GHSA-px68-xx5g-48q5Published

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

osv · CVE-2026-46350

npm: dcmjs

LOWSource modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83382Published

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with n…

cve-program ·

Vendor product: Oracle Report Manager

CVSS 3.1 4.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83381Published

Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle Graa…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83380Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83378Published

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 4.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113713Published

virtualenv: Temporary app-data can leave dangling seed package links

cve-program ·

Vendor product: virtualenv

CVSS 4.0 4.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83377Published

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Mobile Applications). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (US)

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113718Published

virtualenv: Xonsh activation literals depend on the script decoding codec

cve-program ·

Vendor product: virtualenv

CVSS 4.0 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83366Published

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker wit…

cve-program ·

Vendor product: Oracle Shipping Execution

CVSS 3.1 7.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113723Published

virtualenv: Bash prompt values can change meaning under older compatibility modes

cve-program ·

Vendor product: virtualenv

CVSS 4.0 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-60882Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-7025Published

Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery

cve-program ·

Vendor product: Typecho

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-116371Published

Akuvox Akubela HyPanel PS51 login improper authentication

cve-program ·

Vendor product: Akubela HyPanel PS51

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-60745Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 4.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113728Published

Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

cve-program ·

Vendor product: webmail

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-113732Published

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83376Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83375Published

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attack…

cve-program ·

Vendor product: PeopleSoft Enterprise HCM Human Resources

CVSS 3.1 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83374Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-95610Published

WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: us-core

CVSS 3.1 8.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83373Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network acc…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 3.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83372Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network acces…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91655Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 9.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91654Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Succe…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 6.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83371Published

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…

cve-program ·

Vendor product: Oracle HRMS (UK)

CVSS 3.1 5.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91653Published

Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Ess…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 8.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91652Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-44829Published

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename cont…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 27 Oct 2026Recorded 29 Oct 2026

CVE-2026-45741Published

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002::/16 6to4 prefix, the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, the fec0::…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-45742Published

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart downloadFrom entry and allows those goroutines to…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-49253Published

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmod…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-49255Published

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-52834Published

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::with_alloc_tracker and related grid and subgrid ar…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-76234Published

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91650Published

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essb…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 3.7Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83370Published

Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP…

cve-program ·

Vendor product: Sourcing

CVSS 3.1 7.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91649Published

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase ex…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 6.0Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91648Published

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83367Published

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker wit…

cve-program ·

Vendor product: Oracle Shipping Execution

CVSS 3.1 7.4Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91646Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.6Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91645Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Succ…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-83360Published

Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (component: Korean Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker w…

cve-program ·

Vendor product: Oracle HRMS (Republic of Korea)

CVSS 3.1 6.5Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91644Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Whil…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 9.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91643Published

Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbas…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91642Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Succ…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 7.3Source modified 27 Oct 2026Recorded 27 Oct 2026

CVE-2026-91641Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.0Source modified 27 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.