Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694472 source statements · aliases may refer to the same vulnerability

CVE-2026-112954Published

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

cve-program ·

Vendor product: apostrophe

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113683Published

VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename

cve-program ·

Vendor product: moodle-mod_vpl

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113678Published

Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron

cve-program ·

Vendor product: froxlor

CVSS 4.0 9.4 · CVSS 3.1 9.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113611Published

Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions

cve-program ·

Vendor product: outline

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113606Published

Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders

cve-program ·

Vendor product: Stirling-PDF

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113601Published

Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

cve-program ·

Vendor product: memos

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-113596Published

Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds

cve-program ·

Vendor product: webstudio

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-112949Published

Vitest: Code injection via unauthenticated manual mock registration

cve-program ·

Vendor product: vitest · Vendor product: mocker

CVSS 3.1 4.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2019-5645Published

Rapid7 Metasploit HTTP Handler Denial of Service

cve-program ·

Vendor product: Metasploit Framework

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-76462Published

Cisco Secure Client Privilege Escalation Vulnerability

cve-program ·

Vendor product: Cisco Secure Client

CVSS 3.1 5.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-76466Published

Cisco Expressway Series Remote Code Execution Vulnerability

cve-program ·

Vendor product: Cisco TelePresence Video Communication Server (VCS) Expressway

CVSS 3.1 9.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91305Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacke…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 9.1Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91265Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 9.1Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101590Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with networ…

cve-program ·

Vendor product: Helidon

CVSS 3.1 9.1Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101484Published

Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to co…

cve-program ·

Vendor product: Oracle Secure Backup

CVSS 3.1 9.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91665Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Succe…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 9.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101521Published

Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS t…

cve-program ·

Vendor product: Oracle APEX

CVSS 3.1 9.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-94300Published

Concurrent GSS-TSIG messages corrupt memory

cve-program ·

Vendor product: BIND 9

CVSS 3.1 8.1Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-93888Published

IBM Sterling Connect:Direct for Unix Buffer Overflow

cve-program ·

Vendor product: Sterling Connect Direct for Unix

CVSS 3.1 7.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-96960Published

Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96959Published

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96958Published

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96235Published

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96234Published

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96233Published

Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96232Published

Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96231Published

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96230Published

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96229Published

Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96225Published

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96224Published

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-96222Published

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-87697Published

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-85790Published

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-85363Published

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-84008Published

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-83520Published

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-70194Published

Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-70179Published

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-70174Published

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-70162Published

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-70159Published

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-70035Published

Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-70007Published

Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-69651Published

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-66822Published

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-58280Published

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-105016Published

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-47719Published

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlle…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-47721Published

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3Source modified 22 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.