Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694537 source statements · aliases may refer to the same vulnerability

CVE-2026-55872Published

GYM One admin user list is vulnerable to stored cross-site scripting

cve-program ·

Vendor product: GYM-One

CVSS 3.1 8.7Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-55239Published

Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

cve-program ·

Vendor product: tianji

CVSS 3.1 8.8Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-55876Published

Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

cve-program ·

Vendor product: platform

CVSS 3.1 3.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-104266Published

tinytag: Infinite loop when parsing certain M4A files containing invalid atoms

cve-program ·

Vendor product: tinytag

CVSS 3.1 6.5Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-16528Published

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security …

cve-program ·

Vendor product: Router

CVSS 4.0 8.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-93908Published

Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter

cve-program ·

Vendor product: Real Estate Manager – Property Listing and Agent Management

CVSS 3.1 6.4Source modified 21 Oct 2026Recorded 23 Oct 2026

CVE-2026-101146Published

Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure

cve-program ·

Vendor product: Quality Management

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101145Published

Eleveo Call Recording Software User Management userAddAction.do ldap injection

cve-program ·

Vendor product: Call Recording Software

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-105941Published

Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: kroxylicious-kms-provider-azure-key-vault-kms

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

MAL-2026-12076Published

Malicious code in tinkoff-cache-path (npm)

osv · GHSA-phw8-h49c-9v2q

npm: tinkoff-cache-path

Source modified 20 Oct 2026Recorded 24 Oct 2026

MAL-2026-11538Published

Malicious code in eacq-payform-core (npm)

osv · GHSA-gpp6-qxfg-2m7x

npm: eacq-payform-core

Source modified 20 Oct 2026Recorded 24 Oct 2026

MAL-2026-17653Published

Malicious code in abbishal-poc-as-dependency (npm)

osv · GHSA-pj66-3vwh-cgm2

npm: abbishal-poc-as-dependency

Source modified 20 Oct 2026Recorded 24 Oct 2026

MAL-2026-17666Published

Malicious code in animatecss-tailwind-bridge (npm)

osv · GHSA-3h7p-p7hr-fqf7

npm: animatecss-tailwind-bridge

Source modified 20 Oct 2026Recorded 24 Oct 2026

MAL-2026-17652Published

Malicious code in @ziedzzz/demo-canary (npm)

osv · GHSA-p7gq-mvm4-4cw4

npm: @ziedzzz/demo-canary

Source modified 20 Oct 2026Recorded 24 Oct 2026

CVE-2026-101144Published

Eleveo Call Recording Software Query Builder searchAction.do access control

cve-program ·

Vendor product: Call Recording Software

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101143Published

Eleveo Quality Management QMBODownload information disclosure

cve-program ·

Vendor product: Quality Management

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101142Published

Eleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal

cve-program ·

Vendor product: Quality Management

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-6945Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101141Published

Eleveo Call Recording Software Play Audio audio.jsp cross site scripting

cve-program ·

Vendor product: Call Recording Software

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-85409Published

Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal

cve-program ·

Vendor product: Quality Management

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-85408Published

Eleveo Quality Management Conversation events dynamically-determined object attributes

cve-program ·

Vendor product: Quality Management

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-85407Published

Eleveo Quality Management Conversation events denial of service

cve-program ·

Vendor product: Quality Management

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-85406Published

Eleveo Quality Management Conversation Review cross site scripting

cve-program ·

Vendor product: Quality Management

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2025-10099Published

Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting

cve-program ·

Vendor product: i-Educar

CVSS 4.0 4.8 · CVSS 3.1 2.4 · CVSS 3.0 2.4 · CVSS 2.0 3.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2025-10074Published

Portabilis i-Educar tipos cross site scripting

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2025-10071Published

Portabilis i-Educar cancelar-enturmacao-em-lote access control

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2025-10070Published

Portabilis i-Educar enturmacao-em-lote access control

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2025-10013Published

Portabilis i-Educar exportacao-para-o-seb access control

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2025-11554Published

Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions

cve-program ·

Vendor product: i-Educar

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-85405Published

Eleveo Call Recording Software roleAddAction.do cross site scripting

cve-program ·

Vendor product: Call Recording Software

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101604Published

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulner…

cve-program ·

Vendor product: Oracle Communications Unified Inventory Management

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101577Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HT…

cve-program ·

Vendor product: Helidon

CVSS 3.1 3.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101573Published

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-http-auth). Supported versions that are affected are 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows un…

cve-program ·

Vendor product: Helidon

CVSS 3.1 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101549Published

Vulnerability in Oracle Application Testing Suite (component: OpenScript). The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle A…

cve-program ·

Vendor product: Oracle Application Testing Suite

CVSS 3.1 7.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101548Published

Vulnerability in Oracle Application Testing Suite (component: OpenScript). The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle…

cve-program ·

Vendor product: Oracle Application Testing Suite

CVSS 3.1 7.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101522Published

Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen IMDB). Supported versions that are affected are 22.1-22.1.1.43.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure whe…

cve-program ·

Vendor product: Oracle TimesTen In-Memory Database

CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101507Published

Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Tr…

cve-program ·

Vendor product: Oracle Trusted Answer Search

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101506Published

Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise O…

cve-program ·

Vendor product: Oracle Trusted Answer Search

CVSS 3.1 7.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101505Published

Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise O…

cve-program ·

Vendor product: Oracle Trusted Answer Search

CVSS 3.1 8.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101504Published

Vulnerability in Oracle Trusted Answer Search (component: Application expert UI). The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise O…

cve-program ·

Vendor product: Oracle Trusted Answer Search

CVSS 3.1 7.6Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101498Published

Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise …

cve-program ·

Vendor product: Oracle Trusted Answer Search

CVSS 3.1 8.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101494Published

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Da…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 7.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101493Published

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Da…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101485Published

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure wher…

cve-program ·

Vendor product: Oracle Autonomous Health Framework

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101478Published

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure wher…

cve-program ·

Vendor product: Oracle Autonomous Health Framework

CVSS 3.1 7.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101477Published

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure wher…

cve-program ·

Vendor product: Oracle Autonomous Health Framework

CVSS 3.1 7.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101452Published

Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay). Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastru…

cve-program ·

Vendor product: Oracle Autonomous Health Framework

CVSS 3.1 7.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101372Published

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 3.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101371Published

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 3.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-101370Published

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST…

cve-program ·

Vendor product: Oracle REST Data Services

CVSS 3.1 3.1Source modified 20 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.