Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694303 source statements · aliases may refer to the same vulnerability

CVE-2026-66043Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-66042Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91632Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 7.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91631Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91630Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase. Whil…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91629Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exp…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 4.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91628Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploit…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91627Published

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitab…

cve-program ·

Vendor product: Oracle Communications Billing and Revenue Management

CVSS 3.1 7.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91625Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows un…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 8.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91623Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows …

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 7.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-77216Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-77215Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91622Published

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows un…

cve-program ·

Vendor product: Oracle Agile Product Lifecycle Management for Process

CVSS 3.1 9.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91617Published

Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily…

cve-program ·

Vendor product: Oracle Middleware Common Libraries and Tools

CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91616Published

Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerabi…

cve-program ·

Vendor product: Oracle Middleware Common Libraries and Tools

CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91615Published

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having None privilege …

cve-program ·

Vendor product: Oracle Database Server

CVSS 3.1 6.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91614Published

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Communications Unified Inventory Management

CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91613Published

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Communications Unified Inventory Management

CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91612Published

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Communications Unified Inventory Management

CVSS 3.1 3.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91610Published

Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-28864Published

This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, iOS 26.7.2 and iPadOS 26.7.2, macOS Sequoia 15.7.5, macOS Sequoia 15.8.2, macOS Sonoma 14.8.5, macOS…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65409Published

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84559Published

A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to access restricted files.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-43741Published

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-28937Published

This issue was addressed through improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-86933Published

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-91609Published

Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle RES…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-86876Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. A sandboxe…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84518Published

This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determine what apps a user has installed.

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-20668Published

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.3, visionOS 26.3. An app may be able to acc…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84631Published

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65331Published

This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing maliciously crafted web content may …

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-20687Published

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, tvOS 26.4, watchOS 26.4. An app may be able to caus…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84563Published

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84534Published

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted a…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-64760Published

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive kerne…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-43690Published

A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84522Published

A race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-86909Published

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-43686Published

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Conne…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84575Published

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously cr…

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-43794Published

A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing mali…

cve-program ·

Vendor product: Safari · Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-86883Published

A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data.

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-28868Published

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. An app may …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: visionOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-64756Published

A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65393Published

A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.

cve-program ·

Vendor product: Xcode · Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65405Published

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. …

cve-program ·

Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84555Published

An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8. An app may be able to access sensitive user data.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65413Published

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause a denial of service.

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-84543Published

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may cause unexpected system termination or co…

cve-program ·

Vendor product: macOS

Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.