Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

688674 source statements · aliases may refer to the same vulnerability

CVE-2026-93850Published

Unbounded memory consumption during PDF text extraction

cve-program ·

Vendor product: Mattermost

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-93848Published

Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator

cve-program ·

Vendor product: Mattermost

CVSS 3.1 2.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-77054Published

Cleartext Storage of Sensitive Information in boneIO

cve-program ·

https://pypi.python.org: boneio

CVSS 4.0 6.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-77056Published

Use of Default Credentials in boneIO

cve-program ·

Vendor product: black_debian_images

CVSS 4.0 7.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-77058Published

Cross-Site Request Forgery (CSRF) in boneIO

cve-program ·

https://pypi.python.org: boneio

CVSS 4.0 5.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2013-10077Published

OctoPrint API Key settings.py getSettings information disclosure

cve-program ·

Vendor product: OctoPrint

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18275Published

Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

osv · GHSA-4p22-gg56-8457

npm: @ppa-web-components/ppa-hotel-collection

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18274Published

Malicious code in @ppa-web-components/ppa-headerfooter (npm)

osv · GHSA-p3hf-95qq-mv56

npm: @ppa-web-components/ppa-headerfooter

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18272Published

Malicious code in @ppa-web-components/ppa-banner (npm)

osv · GHSA-mwcw-x8h4-mqcg

npm: @ppa-web-components/ppa-banner

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18319Published

Malicious code in @sxm-web/client-sdk-core (npm)

osv · GHSA-v3mw-7pg4-rp68

npm: @sxm-web/client-sdk-core

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18332Published

Malicious code in harlow-css-mixer (npm)

osv · GHSA-j658-c56g-qxh4

npm: harlow-css-mixer

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18316Published

Malicious code in @greenlake/auth (npm)

osv · GHSA-h6v3-2957-9j3g

npm: @greenlake/auth

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18317Published

Malicious code in @greenlake/context-pane (npm)

osv · GHSA-5pp4-pvpc-g2xv

npm: @greenlake/context-pane

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18318Published

Malicious code in @greenlake/mfe-login-url (npm)

osv · GHSA-6vg7-x7p2-c749

npm: @greenlake/mfe-login-url

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18252Published

Malicious code in @eforms/forms-api (npm)

osv · GHSA-39p9-96vf-fxjh

npm: @eforms/forms-api

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18282Published

Malicious code in @greenlake/common-context (npm)

osv · GHSA-mm6p-8j6f-9fch

npm: @greenlake/common-context

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18287Published

Malicious code in @ppa-web-components/ppa-searchform (npm)

osv · GHSA-9p3j-rrmc-jc4p

npm: @ppa-web-components/ppa-searchform

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18288Published

Malicious code in jshelperdependenceny (npm)

osv · GHSA-2gxp-q3vq-594r

npm: jshelperdependenceny

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18273Published

Malicious code in @ppa-web-components/ppa-builder (npm)

osv · GHSA-5q5w-4m9f-ppmg

npm: @ppa-web-components/ppa-builder

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18286Published

Malicious code in @ppa-web-components/ppa-navigation (npm)

osv · GHSA-vc6h-rv88-87j5

npm: @ppa-web-components/ppa-navigation

Source modified 26 Oct 2026Recorded 26 Oct 2026

MAL-2026-18283Published

Malicious code in @greenlake/session (npm)

osv · GHSA-499v-qcp5-gx7x

npm: @greenlake/session

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115910Published

Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

cve-program ·

Vendor product: social-core

CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116175Published

vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116179Published

vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116183Published

phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116187Published

Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads

cve-program ·

Vendor product: rclone

CVSS 4.0 6.1 · CVSS 3.1 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-13717Published

Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

cve-program ·

https://github.com/llm-d/llm-d: llm-d · https://catalog.redhat.com/software/containers/: rhoai/odh-rhel9-operator · https://catalog.redhat.com/software/containers/: rhoai/odh-maas-controller-rhel9

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116191Published

Rclone before 1.75.2 Path Traversal via serve webdav MKCOL

cve-program ·

Vendor product: rclone

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116195Published

Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

cve-program ·

Vendor product: rclone

CVSS 4.0 7.0 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116199Published

Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback

cve-program ·

Vendor product: snipe-it

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116203Published

YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.3 · CVSS 3.1 6.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116207Published

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

cve-program ·

Vendor product: yeswiki · Vendor product: yeswiki

CVSS 4.0 8.8 · CVSS 3.1 9.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116053Published

dbcli mycli Whitelist source.py source_special_command_is_safe os command injection

cve-program ·

Vendor product: mycli

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116056Published

KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery

cve-program ·

Vendor product: KodExplorer

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116060Published

SourceCodester Performance Indicator System adddealer.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116063Published

DedeCMS update_guide.php require_once code injection

cve-program ·

Vendor product: DedeCMS

CVSS 4.0 5.1 · CVSS 3.1 4.7 · CVSS 3.0 4.7 · CVSS 2.0 5.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-95127Published

An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116096Published

ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

cve-program ·

Vendor product: llama.cpp

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116099Published

Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write

cve-program ·

Vendor product: SCP Containment Breach Multiplayer

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116102Published

QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection

cve-program ·

Vendor product: docker-mcp

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116105Published

HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission

cve-program ·

Vendor product: HeyCyan App

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-106677Published

Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages, send messages, and mark messages as read for arbitrary conversation ids because the service does not…

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116108Published

openbq-org OpenBB Local API Server api_settings.py access control

cve-program ·

Vendor product: OpenBB

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116111Published

2K Games Civilization V Lua Sandbox loadstring type confusion

cve-program ·

Vendor product: Civilization V

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116114Published

Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission

cve-program ·

Vendor product: GM8135S Camera

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116117Published

halo-dev halo View Name Resolver DefaultViewNameResolver.java path traversal

cve-program ·

Vendor product: halo

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116120Published

NocoDB PublicApiLimiterGuard signup UserRefreshToken.deleteAllUserToken allocation of resources

cve-program ·

Vendor product: NocoDB

CVSS 4.0 6.3 · CVSS 3.1 5.6 · CVSS 3.0 5.6 · CVSS 2.0 5.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116123Published

NocoDB signup validatePassword excessive authentication

cve-program ·

Vendor product: NocoDB

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116224Published

fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery

cve-program ·

Vendor product: benotes

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116232Published

Oray Pugongying X5 Pro SNMP snmp_set crlf injection

cve-program ·

Vendor product: Pugongying X5 Pro

CVSS 4.0 9.4 · CVSS 3.1 9.9 · CVSS 3.0 9.9 · CVSS 2.0 9.0Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.