Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694472 source statements · aliases may refer to the same vulnerability

CVE-2026-91424Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91423Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91422Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network …

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91421Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91420Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network ac…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91419Published

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the …

cve-program ·

Vendor product: Oracle HTTP Server

CVSS 3.1 7.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91415Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91414Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91413Published

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with networ…

cve-program ·

Vendor product: Siebel CRM Development

CVSS 3.1 6.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91412Published

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to…

cve-program ·

Vendor product: Siebel CRM End User

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91411Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle Gr…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-57208Published

Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.2Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-91409Published

Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compro…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 3.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91407Published

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged att…

cve-program ·

Vendor product: Oracle Identity Manager

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91406Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91405Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91404Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 4.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91402Published

Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Or…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle JavaFX · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111312Published

OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

cve-program ·

Vendor product: OpenHealth

CVSS 4.0 9.2 · CVSS 3.1 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91399Published

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-…

cve-program ·

Vendor product: Primavera P6 Enterprise Project Portfolio Management

CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111332Published

OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie

cve-program ·

Vendor product: OxiCloud

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115754Published

serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controllin…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.3 · CVSS 3.1 · [email protected] · Secondary 4.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-111352Published

ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

cve-program ·

Vendor product: ThinkCMF

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111384Published

Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

cve-program ·

Vendor product: nezha

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2025-59529Published

Avahi: simple protocol server ignores accepts unlimited connections and logs failures without limit

cve-program ·

Vendor product: avahi

CVSS 3.1 5.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95718Published

Authentication Bypass Vulnerability in the PAPI Protocol of AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-90648Published

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2…

cve-program ·

Vendor product: wabt

CVSS 4.0 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95721Published

Authenticated Local Memory Corruption Vulnerability in AOS-8 Web-Based Management Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 3.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95720Published

Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 4.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95719Published

Authenticated Arbitrary File Deletion Vulnerability leads to Denial-of-Service in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 4.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95717Published

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 5.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95716Published

Authentication Bypass in the PAPI Protocol of AOS-10 allows Unauthorized Configuration Changes

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95715Published

Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 6.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95713Published

Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95712Published

Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-95710Published

Unauthenticated Adjacent Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-10 or AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79955Published

Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79895Published

Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79894Published

Unauthenticated Denial-of-Service (DoS) Vulnerability in the PAPI Protocol of AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79893Published

Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79851Published

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79850Published

Authentication Bypass Leading to Remote Code Execution in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79849Published

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79848Published

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79847Published

Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79844Published

Authentication Bypass Leading to Remote Code Execution in AOS-10

cve-program ·

Vendor product: ArubaOS (AOS)

CVSS 3.1 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-18676Published

The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is reachable from their browser. Due to a CORS misconfiguration a cross-origin fetc…

nvd ·

CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary 5.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-18678Published

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection.

nvd ·

CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary 5.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-18679Published

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the dataplane authentication token is sent over that unverified connecti…

nvd ·

CVSS 4.0 · 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb · Secondary 5.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-45819Published

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

nvd ·

CVSS 4.0 · 22e2d327-25fe-45d7-9f0c-dcd23b7108df · Secondary 6.6Source modified 23 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.