Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694495 source statements · aliases may refer to the same vulnerability

CVE-2026-113710Published

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

cve-program ·

Vendor product: apostrophe

CVSS 3.1 5.9Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91370Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113802Published

Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler

cve-program ·

Vendor product: WL-WN530BE1-A

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113709Published

Argo CD: A Kustomize Helm config home can run commands in the repo-server

cve-program ·

Vendor product: argo-cd

CVSS 3.1 9.9Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-100134Published

Acrobat for Edge | Out-of-bounds Write (CWE-787)

cve-program ·

Vendor product: Acrobat for Edge

CVSS 3.1 8.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113716Published

virtualenv: Builtin creation follows linked environment directories

cve-program ·

Vendor product: virtualenv

CVSS 3.1 4.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113720Published

virtualenv: Seeded files retain permissions from an older cache

cve-program ·

Vendor product: virtualenv

CVSS 4.0 4.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113725Published

virtualenv bash activate runs commands from an environment name with a backslash before $

cve-program ·

Vendor product: virtualenv

CVSS 3.1 7.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2014-125131Published

DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php

cve-program ·

Vendor product: DedeCMS

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2015-20124Published

Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php

cve-program ·

Vendor product: Aspose Importer & Exporter

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91371Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with ne…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 5.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2016-20102Published

JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter

cve-program ·

Vendor product: JavaMelody

CVSS 4.0 5.1 · CVSS 3.1 6.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113730Published

OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

cve-program ·

Vendor product: ognl

CVSS 3.1 5.6Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-93744Published

IBM i Improper Authentication

cve-program ·

Vendor product: i

CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-87800Published

IBM Cyber Fraud includes components with multiple known vulnerabilities

cve-program ·

Vendor product: Cyber Fraud

CVSS 3.1 6.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113704Published

a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery

cve-program ·

Vendor product: a2a-rs

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113735Published

D-Link DCS-6501LH aoni_ipc mydlink_set_root_pwd weak credentials

cve-program ·

Vendor product: DCS-6501LH

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2020-37288Published

Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

cve-program ·

Vendor product: vyper

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2025-71437Published

Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

cve-program ·

Vendor product: uv

CVSS 4.0 8.7 · CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114045Published

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

cve-program ·

Vendor product: FreeRDP

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91372Published

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with log…

cve-program ·

Vendor product: Siebel CRM Cloud Applications

CVSS 3.1 3.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114050Published

vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114060Published

SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

cve-program ·

Vendor product: kit

CVSS 4.0 2.1 · CVSS 3.1 4.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114065Published

Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114070Published

Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Records

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.1 · CVSS 3.1 3.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114075Published

Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114080Published

Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114085Published

Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

cve-program ·

Vendor product: trigger.dev

CVSS 4.0 8.8 · CVSS 3.1 7.9Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114090Published

Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server

cve-program ·

Vendor product: cli-v3

CVSS 4.0 7.6 · CVSS 3.1 7.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114095Published

Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

cve-program ·

Vendor product: dulwich

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114100Published

Coraza from 3.0.4 before 3.8.1 Request Body Inspection Bypass via Content-Type

cve-program ·

Vendor product: coraza

CVSS 4.0 6.9 · CVSS 3.1 5.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114105Published

Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits

cve-program ·

Vendor product: adm-zip

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114110Published

Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

cve-program ·

Vendor product: uv

CVSS 4.0 8.7 · CVSS 3.1 5.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114115Published

Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection

cve-program ·

Vendor product: vyper

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113740Published

itsourcecode Online Cake Ordering System deletecustomer.php sql injection

cve-program ·

Vendor product: Online Cake Ordering System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114039Published

projectworlds Advanced Library Management System report_search.php mysqli_query sql injection

cve-program ·

Vendor product: Advanced Library Management System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114389Published

Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade

cve-program ·

Vendor product: chamilo-lms

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114394Published

Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs

cve-program ·

Vendor product: trudesk

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114399Published

Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

cve-program ·

Vendor product: trudesk

CVSS 4.0 7.0 · CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114404Published

PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions

cve-program ·

Vendor product: PHPPresentation

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114245Published

dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization

cve-program ·

Vendor product: Insurance-Management-System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-111848Published

WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 7.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-111835Published

WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woo-swish-e-commerce

CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-113779Published

pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission

cve-program ·

Vendor product: pfSense-pkg-RESTAPI

CVSS 3.1 8.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-114251Published

itsourcecode Sales-and-Inventory-System cust_del.php sql injection

cve-program ·

Vendor product: Sales-and-Inventory-System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91374Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 4.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91376Published

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-…

cve-program ·

Vendor product: Primavera P6 Enterprise Project Portfolio Management

CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91377Published

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network acce…

cve-program ·

Vendor product: Siebel CRM Integration

CVSS 3.1 7.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-91378Published

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network acce…

cve-program ·

Vendor product: Siebel CRM Integration

CVSS 3.1 6.1Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-93442Published

IBM QRadar SIEM Out-of-bounds Read

cve-program ·

Vendor product: QRadar

CVSS 3.1 8.2Source modified 21 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.