Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694472 source statements · aliases may refer to the same vulnerability

CVE-2026-13599Published

ABB Ability Edgenius | Missing Authentication in Edgenius AuthDB

cve-program ·

Vendor product: Ability Edgenius

CVSS 3.1 7.8 · CVSS 4.0 5.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-15396Published

IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-15412Published

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Open Redirect

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-15634Published

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-11548Published

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 4.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-11549Published

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-11722Published

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 4.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-106462Published

Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.4Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-10841Published

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling

cve-program ·

Vendor product: WebSphere Application Server · Vendor product: WebSphere Application Server - Liberty

CVSS 3.1 4.8Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-106463Published

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enabl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-101359Published

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST D…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101394Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via …

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101720Published

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulne…

cve-program ·

Vendor product: MySQL Server · Vendor product: MySQL Cluster

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91332Published

Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM E…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91361Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91451Published

Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalV…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91452Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91453Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91497Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101569Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-concurrency-limits). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Helidon

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101581Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-dns-resolver-round-robin). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthentica…

cve-program ·

Vendor product: Helidon

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-83395Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91395Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91396Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1; Oracle…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91468Published

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: QAS). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access …

cve-program ·

Vendor product: PeopleSoft Enterprise PeopleTools

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91541Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Brazil

CVSS 3.1 6.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101399Published

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via …

cve-program ·

Vendor product: Siebel Apps - Marketing

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101587Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with n…

cve-program ·

Vendor product: Helidon

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-83400Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91352Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91373Published

Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Ente…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91410Published

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM…

cve-program ·

Vendor product: Oracle Java SE

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91417Published

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91418Published

Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle JavaFX · Vendor product: Oracle GraalVM for JDK

CVSS 3.1 5.3Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101508Published

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to…

cve-program ·

Vendor product: Siebel CRM Integration

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101520Published

Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and …

cve-program ·

Vendor product: Oracle Global Lifecycle Management NextGen OUI Framework

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101572Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with n…

cve-program ·

Vendor product: Helidon

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101679Published

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.…

cve-program ·

Vendor product: MySQL Server · Vendor product: MySQL Cluster

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-101810Published

Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple pr…

cve-program ·

Vendor product: MySQL Router

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87369Published

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo…

cve-program ·

Vendor product: Oracle Service Bus

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87395Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-87398Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with net…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91254Published

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…

cve-program ·

Vendor product: Oracle Solaris

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91255Published

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…

cve-program ·

Vendor product: Oracle Solaris

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91344Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91345Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91350Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-91664Published

Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Succe…

cve-program ·

Vendor product: Oracle Essbase

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

CVE-2026-106487Published

Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalo…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.5 · CVSS 3.1 · [email protected] · Primary 5.0Source modified 22 Oct 2026Recorded 25 Oct 2026

CVE-2026-91349Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.5Source modified 22 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.