Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677575 source statements · aliases may refer to the same vulnerability

CVE-2026-73293Published

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73294Published

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73299Published

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled …

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73411Published

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73412Published

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73413Published

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments when flagProtection is enabled, which is…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73414Published

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escapeAll APIs on Windows with shell set to cm…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73422Published

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73423Published

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code in…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73425Published

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's I…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73427Published

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback L…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73429Published

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEX_ECDH_REPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519K…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73430Published

Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSH_MSG_KEX_ECDH_INIT with a 32-byte all-zero Q_C value. Curve25519Kex::server_dh in russh/src/kex/curve255…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73483Published

Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.4 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73487Published

Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtable Agent nodes that allows unauthenticated attackers to inject malicious code via prompt injection. Attackers can exploit unblocked pandas functions l…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.0 · CVSS 3.1 · [email protected] · Primary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73488Published

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73489Published

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73499Published

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey() to receive …

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73500Published

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In cl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73501Published

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without che…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73505Published

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73506Published

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subje…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73561Published

Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-cl…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73562Published

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose updat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73564Published

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73565Published

@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the r…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73566Published

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73567Published

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73569Published

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passe…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73603Published

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio u…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73604Published

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensit…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73605Published

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute pa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73606Published

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73607Published

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any d…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73609Published

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73617Published

Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integration where user-supplied parameters are enriched with handlebars using noEscaping: true and parsed without operator filtering. Attackers can in…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 7.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73618Published

Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Att…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 8.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73643Published

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection us…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73645Published

OpenZeppelin Confidential Contracts is an experimental library for developing applications on the Zama fhEVM. Prior to 0.3.1, the ERC7984 contract tracked confidential total supply with an euint64 value, and an overflowing internal _mint op…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73647Published

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extend(true, targe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73649Published

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the #set assignment handler in src/compile/set.ts, …

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-73851Published

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-112855Published

WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: redy

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112859Published

WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: little-birdies

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112858Published

WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: rhodos

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112856Published

WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: vagabonds

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112852Published

WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: helion

CVSS 3.1 8.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112851Published

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: hotlock

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112846Published

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: save-life

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112847Published

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: zensoul

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.