Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

659854 source statements · aliases may refer to the same vulnerability

CVE-2026-91483Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with log…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91482Published

Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Bidder Registration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacke…

cve-program ·

Vendor product: PeopleSoft Enterprise SCM Strategic Sourcing

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91481Published

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Supplier Registration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with…

cve-program ·

Vendor product: PeopleSoft Enterprise SCM Purchasing

CVSS 3.1 5.4Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91480Published

Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise SCM Strategic Sourcing

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91479Published

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment att…

cve-program ·

Vendor product: Oracle Database Server

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91477Published

Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle JavaFX: 25.0.4 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network acces…

cve-program ·

Vendor product: Oracle JavaFX

CVSS 3.1 3.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91476Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker w…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Brazil

CVSS 3.1 5.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91475Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.6Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91474Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker w…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Brazil

CVSS 3.1 6.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91473Published

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the…

cve-program ·

Vendor product: Oracle HTTP Server

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91471Published

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: BAM Framework). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated att…

cve-program ·

Vendor product: PeopleSoft Enterprise CC Common Application Objects

CVSS 3.1 3.7Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91467Published

Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows physical access …

cve-program ·

Vendor product: Oracle Fusion Middleware Control

CVSS 3.1 6.6Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91466Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged att…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Argentina

CVSS 3.1 6.4Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91465Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Argentina

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-94422Published

xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

cve-program ·

https://github.com/flatpak/xdg-dbus-proxy: xdg-dbus-proxy · https://bodhi.fedoraproject.org/updates/?packages=xdg-dbus-proxy: xdg-dbus-proxy · https://access.redhat.com/downloads/content/package-browser/: xdg-dbus-proxy

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91464Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91463Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91462Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91461Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.7Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91460Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91459Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91458Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with log…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91457Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91455Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-xvq9-wjp8-hwqfPublished

i18next-http-backend incomplete URL validation permits SSRF

osv · CVE-2026-105800

npm: i18next-http-backend

LOWSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-pgx6-7jcq-2qffPublished

PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

osv · CVE-2026-82866

npm: @pdfme/common

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91450Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-v3f4-w7r7-v3hmPublished

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

osv · CVE-2026-58497

npm: @zenalexa/unicli

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-m5mm-p8h7-m29vPublished

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

osv · CVE-2026-115754 · CVE-2026-115897

npm: serialize-javascript

LOWSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-2h46-9x5w-4wf7Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind

osv · CVE-2026-57208 · GO-2026-5063

Go: github.com/entireio/cli

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

GO-2026-5063Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli

osv · CVE-2026-57208 · GHSA-2h46-9x5w-4wf7

Go: github.com/entireio/cli

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91449Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-jg4p-7fhp-p32pPublished

@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing

osv · CVE-2026-115728 · CVE-2026-35213

npm: @hapi/content

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91448Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91447Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

MAL-2026-18243Published

Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm)

osv · GHSA-8wf7-8825-99q7

npm: @k18k/entrypoint-sdk-darwin-arm64

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115929Published

MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs

cve-program ·

Vendor product: Compass

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110734Published

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the ima…

cve-program ·

Vendor product: Godot Engine

CVSS 3.1 2.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113378Published

mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

cve-program ·

Vendor product: mcp-ripgrep

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

MAL-2026-18245Published

Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm)

osv · GHSA-9fhg-r3w6-g7r4

npm: @k18k/entrypoint-sdk-linux-x64

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18244Published

Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

osv · GHSA-j58m-rwhr-923h

npm: @k18k/entrypoint-sdk-darwin-x64

Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-115931Published

Arbitrary file read and backend crash through unrestricted provider method calls

cve-program ·

Vendor product: postiz-app

CVSS 3.1 9.9Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-113877Published

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

cve-program ·

https://cpan.org/modules: HTTP-Headers-ActionPack

Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-102208Published

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-83862Published

Windows Network Load Balancing Remote Code Execution Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows Server 2012

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97781Published

Microsoft Office OneNote Remote Code Execution Vulnerability

cve-program ·

Vendor product: Microsoft 365 Apps for Enterprise

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105016Published

Microsoft QUIC Remote Code Execution Vulnerability

cve-program ·

Vendor product: .NET 10.0 runtime · Vendor product: .NET 11.0 runtime · Vendor product: .NET 8.0 runtime

CVSS 3.1 9.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97801Published

.NET Framework Tampering Vulnerability

cve-program ·

Vendor product: Microsoft .NET Framework 3.5 · Vendor product: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Vendor product: Microsoft .NET Framework 3.5 AND 4.7.2

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-80092Published

Microsoft Identity Web Elevation of Privilege Vulnerability

cve-program ·

Vendor product: microsoft-identity-web · Vendor product: microsoft-identity-web

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109461Published

Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability

cve-program ·

Vendor product: Microsoft Identity Client for NodeJS

CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.