Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694472 source statements · aliases may refer to the same vulnerability

CVE-2026-101411Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker wit…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 8.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101390Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker wit…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 8.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91478Published

Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise SCM Strategic Sourcing

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101420Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access v…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 9.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-96376Published

Cloud - Critical - Remote code execution - SA-CONTRIB-2026-177

cve-program ·

https://www.drupal.org/project/cloud: Cloud

Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-76293Published

Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 7.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115253Published

WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering

cve-program ·

Vendor product: WatchGuard Agent

CVSS 4.0 7.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-76298Published

Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk Enterprise

cve-program ·

Vendor product: Splunk Enterprise

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-96355Published

Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175

cve-program ·

https://www.drupal.org/project/webform: Webform

Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113727Published

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the su…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 23 Oct 2026Recorded 25 Oct 2026

GO-2026-5938Published

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise in github.com/zhenorzz/goploy

osv · CVE-2026-114665 · CVE-2026-53553 · GHSA-4g5x-hcwm-82jw

Go: github.com/zhenorzz/goploy

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-17498Published

Malicious code in @kibt/www-nuxt-i18n (npm)

osv · GHSA-2c7v-rmgw-3xrp

npm: @kibt/www-nuxt-i18n

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18208Published

Malicious code in @ecg-internal/favourites-ui (npm)

osv · GHSA-g8hh-8pxg-jr3x

npm: @ecg-internal/favourites-ui

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18206Published

Malicious code in @ecg-internal/adobe-dmp-js (npm)

osv · GHSA-vcj4-3hxm-4rf3

npm: @ecg-internal/adobe-dmp-js

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18210Published

Malicious code in @ecg-internal/media-util-js-lib (npm)

osv · GHSA-hcw5-m6mm-qg3q

npm: @ecg-internal/media-util-js-lib

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18211Published

Malicious code in @ecg-internal/reviews-dialog-ui (npm)

osv · GHSA-r47j-grcr-p9h9

npm: @ecg-internal/reviews-dialog-ui

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18209Published

Malicious code in @ecg-internal/js-react-i18n (npm)

osv · GHSA-5x9g-7rj9-4xc8

npm: @ecg-internal/js-react-i18n

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18207Published

Malicious code in @ecg-internal/aurora-js-formatters (npm)

osv · GHSA-9976-3w38-mrmj

npm: @ecg-internal/aurora-js-formatters

Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-91398Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 6.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91397Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-91394Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: …

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK

CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101404Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infr…

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 3.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101403Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network acc…

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101402Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network acc…

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 3.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101400Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infr…

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 2.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113669Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A cli…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-113664Published

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal par…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-113658Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not re…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-113649Published

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cau…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-113648Published

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and …

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-112954Published

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort orderin…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-112949Published

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can regi…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-111756Published

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cooki…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-101401Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infr…

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 2.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101398Published

Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network…

cve-program ·

Vendor product: Oracle Capacity

CVSS 3.1 7.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-101397Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with network access vi…

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 2.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113727Published

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

cve-program ·

Vendor product: openchoreo

CVSS 3.1 7.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2016-20100Published

Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview

cve-program ·

Vendor product: Memphis Documents Library

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2014-125134Published

ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php

cve-program ·

Vendor product: ChurcHope

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2012-20004Published

K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter

cve-program ·

Vendor product: K-news

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113722Published

virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113715Published

virtualenv: Venv configuration readback can reinterpret path boundaries

cve-program ·

Vendor product: virtualenv

CVSS 4.0 2.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113712Published

Cachet has Stored XSS in Incident Component

cve-program ·

Vendor product: cachet

CVSS 4.0 4.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111756Published

follow-redirects array-form headers bypass cross-origin credential stripping

cve-program ·

Vendor product: follow-redirects

CVSS 4.0 8.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113669Published

ApostropheCMS: Cross-domain session token in URL confers session takeover

cve-program ·

Vendor product: apostrophe · Vendor product: passport-bridge

CVSS 4.0 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113507Published

aaPanel common.py GetClientIp access control

cve-program ·

Vendor product: aaPanel

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113664Published

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

cve-program ·

Vendor product: apostrophe · Vendor product: import-export

CVSS 4.0 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113658Published

ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory

cve-program ·

Vendor product: apostrophe

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113649Published

ApostropheCMS: Import API bypasses publication roles for protected content

cve-program ·

Vendor product: apostrophe · Vendor product: import-export

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113648Published

ApostropheCMS: Missing Authentication in `cleanExport` Route

cve-program ·

Vendor product: apostrophe · Vendor product: import-export

CVSS 3.1 3.1Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.