Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

688674 source statements · aliases may refer to the same vulnerability

CVE-2026-116235Published

Oray Pugongying X5 Pro L2TP Authentication crlf injection

cve-program ·

Vendor product: Pugongying X5 Pro

CVSS 4.0 9.4 · CVSS 3.1 9.1 · CVSS 3.0 9.1 · CVSS 2.0 8.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115907Published

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

cve-program ·

Vendor product: zip2

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116253Published

DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection

cve-program ·

Vendor product: DedeCMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116256Published

geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery

cve-program ·

Vendor product: RhaPHP

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115906Published

zip: AES Entry HMAC Authentication Bypass on Premature EOF

cve-program ·

Vendor product: zip2

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110733Published

Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

cve-program ·

https://repo.maven.apache.org/maven2: org.apache.sis.storage:sis-sqlstore

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2020-37282Published

office-converter through 1.0.2 OS Command Injection via fileName in generatePdf

cve-program ·

https://www.npmjs.com/package/office-converter: office-converter

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115680Published

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data Retransmission

cve-program ·

Vendor product: MDK-Middleware

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115905Published

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

cve-program ·

Vendor product: zip2

CVSS 4.0 10.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110259Published

OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

cve-program ·

https://repo1.maven.org/maven2/: ASM

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110270Published

OW2 ASM 3.0 before 9.11 Exponential Memory Allocation in JSRInlinerAdapter

cve-program ·

https://repo1.maven.org/maven2/: ASM

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-71456Published

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.

cve-program ·

Vendor product: Kantech Entrapass

CVSS 4.0 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110595Published

BottleCRM 0.45 through 1.14.5 Memory Exhaustion via Contact and Case CSV Import

cve-program ·

https://pypi.org: BottleCRM

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115679Published

Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer

cve-program ·

Vendor product: MDK-Middleware

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-71455Published

Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows Retrieve Embedded Sensitive Data.

cve-program ·

Vendor product: Kantech Entrapass

CVSS 4.0 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116259Published

libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption

cve-program ·

Vendor product: libimobiledevice

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116596Published

CVE-2026-116596

cve-program ·

Vendor product: Pyrus Sync

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115678Published

Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP processing

cve-program ·

Vendor product: MDK-Middleware

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110605Published

libschrift through 0.10.2 Divide by Zero via unitsPerEm in draw_line

cve-program ·

https://github.com/tomolt/libschrift: libschrift

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115718Published

Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

cve-program ·

Vendor product: builder

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110870Published

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.3Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116262Published

libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow

cve-program ·

Vendor product: libimobiledevice

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116275Published

AllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection

cve-program ·

Vendor product: AllenNLP

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116213Published

Webasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks

cve-program ·

Vendor product: Webasyst Framework

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74860Published

Libxml2: double-free/uaf in libxml2 python bindings

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: libxml2 · https://access.redhat.com/downloads/content/package-browser/: libxml2 · https://access.redhat.com/downloads/content/package-browser/: libxml2

CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116486Published

Objenesis before 3.6 Type Confusion via Class Name Instantiator Cache

cve-program ·

Vendor product: objenesis

CVSS 4.0 2.0 · CVSS 3.1 4.5Source modified 26 Oct 2026Recorded 26 Oct 2026

GHSA-v76p-62qx-wwq2Published

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

osv · CVE-2026-106118

NuGet: SixLabors.ImageSharp · NuGet: SixLabors.ImageSharp

HIGHSource modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116282Published

Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure

cve-program ·

Vendor product: Kameleo

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116339Published

iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

cve-program ·

Vendor product: astron-agent

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116540Published

netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

cve-program ·

https://repo1.maven.org/maven2/io/netty/netty-tcnative/: io.netty:netty-tcnative

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116544Published

Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output

cve-program ·

Vendor product: open5gs

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110610Published

ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl

cve-program ·

https://github.com: ruoyi-vue-pro

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-78801Published

An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitive information via the hidden_factory_switch.gch

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110620Published

Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

cve-program ·

https://github.com/formbricks/formbricks: formbricks

CVSS 4.0 6.1 · CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115797Published

Tenda F6 Web Management cleartext transmission

cve-program ·

Vendor product: F6

CVSS 4.0 6.3 · CVSS 3.1 3.7 · CVSS 3.0 3.7 · CVSS 2.0 2.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110635Published

webp-converter before 3.0.0 OS Command Injection via File Names and Options

cve-program ·

https://www.npmjs.com/package/webp-converter: webp-converter

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115796Published

Tenda F6 Web Management cross-site request forgery

cve-program ·

Vendor product: F6

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-78002Published

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: rsyslog · https://access.redhat.com/downloads/content/package-browser/: rsyslog · https://access.redhat.com/downloads/content/package-browser/: rsyslog

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-2708Published

zhijiantianya ruoyi-vue-pro Backend File Upload upload path traversal

cve-program ·

Vendor product: ruoyi-vue-pro

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-2707Published

zhijiantianya ruoyi-vue-pro Front-End Store upload path traversal

cve-program ·

Vendor product: ruoyi-vue-pro

CVSS 4.0 5.3 · CVSS 3.1 5.4 · CVSS 3.0 5.4 · CVSS 2.0 5.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-5147Published

YunaiV yudao-cloud get-by-website sql injection

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110640Published

Whisper-node through 1.1.1 OS Command Injection via filePath and language

cve-program ·

https://registry.npmjs.org: whisper-node

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-107091Published

An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code via the HUION driver installer DLL-loading logic

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110845Published

n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation

cve-program ·

Vendor product: n8n

CVSS 4.0 7.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116369Published

Sunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection

cve-program ·

Vendor product: github-kanban-mcp-server

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-93846Published

Team admin can escalate a team member's permissions via the team member roles endpoint

cve-program ·

Vendor product: Mattermost

CVSS 3.1 3.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-52356Published

An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters.

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2025-65200Published

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, t…

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65218Rejected

The reported issue is tracked under CVE-2026-18451. This CVE ID is rejected as a duplicate.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-65216Rejected

The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate.

cve-program ·

Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.