Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694346 source statements · aliases may refer to the same vulnerability

CVE-2026-91444Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.7Source modified 23 Oct 2026Recorded 23 Oct 2026

MAL-2026-18215Published

Malicious code in @grabcad/grabcad-shop-shared (npm)

osv · GHSA-cc6r-jh8f-6c76

npm: @grabcad/grabcad-shop-shared

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18217Published

Malicious code in @grabcad/user-license (npm)

osv · GHSA-6w2v-744r-g5j5

npm: @grabcad/user-license

Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-91443Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91442Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91441Published

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker wi…

cve-program ·

Vendor product: Siebel Apps - Customer Order Management

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91440Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91439Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to t…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91438Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91437Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 8.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91436Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon t…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 3.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91435Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91434Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91433Published

Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network acce…

cve-program ·

Vendor product: Siebel Apps - Field Service

CVSS 3.1 7.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91432Published

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t…

cve-program ·

Vendor product: Siebel CRM End User

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91431Published

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructur…

cve-program ·

Vendor product: Siebel CRM End User

CVSS 3.1 5.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91430Published

Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with…

cve-program ·

Vendor product: Siebel Apps - Financial Services

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91429Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91428Published

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t…

cve-program ·

Vendor product: Siebel CRM End User

CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91427Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 2.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91426Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to t…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-47249Published

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataType_HashArrayType d…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-48007Published

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` UR…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-48170Published

`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like `"proto.someProp"`. After one such patch,

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-91424Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91423Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91422Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91421Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91420Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91419Published

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the …

cve-program ·

Vendor product: Oracle HTTP Server

CVSS 3.1 7.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91415Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91414Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91413Published

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with networ…

cve-program ·

Vendor product: Siebel CRM Development

CVSS 3.1 6.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91412Published

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to…

cve-program ·

Vendor product: Siebel CRM End User

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91411Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle Gr…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-57208Published

Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.2Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-91409Published

Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compro…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 3.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91407Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged att…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91406Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91405Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91404Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 4.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91402Published

Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Or…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle JavaFX · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111312Published

OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

cve-program ·

Vendor product: OpenHealth

CVSS 4.0 9.2 · CVSS 3.1 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91399Published

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-…

cve-program ·

Vendor product: Primavera P6 Enterprise Project Portfolio Management

CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111332Published

OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie

cve-program ·

Vendor product: OxiCloud

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115754Published

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controllin…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 4.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-111352Published

ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

cve-program ·

Vendor product: ThinkCMF

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111384Published

Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

cve-program ·

Vendor product: nezha

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2025-59529Published

Avahi: simple protocol server ignores accepts unlimited connections and logs failures without limit

cve-program ·

Vendor product: avahi

CVSS 3.1 5.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95718Published

Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.