Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677588 source statements · aliases may refer to the same vulnerability

CVE-2026-59727Published

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59728Published

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-chara…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59729Published

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_C…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59730Published

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64641Published

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64642Published

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can b…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Primary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64643Published

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64644Published

Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64645Published

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64646Published

Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to exces…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64647Published

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64648Published

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-64649Published

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbou…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65600Published

Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controll…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.8 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65607Published

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request pa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65898Published

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally al…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 7.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65899Published

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller tha…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65900Published

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) insid…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65901Published

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65902Published

DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allow…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65903Published

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also ad…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65912Published

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag comb…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65913Published

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-65914Published

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payload…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-66010Published

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attribut…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.1 · CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-66394Published

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags wi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-76226Published

Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies tha…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.8 · CVSS 3.1 · [email protected] · Secondary 6.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-116020Published

BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages

cve-program ·

Vendor product: BookStack

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116019Published

Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116018Published

ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint

cve-program ·

Vendor product: community-platform

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116017Published

Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

cve-program ·

Vendor product: xiaozhi-esp32-server

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116016Published

yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 7.1 · CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116015Published

yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint

cve-program ·

Vendor product: yudao-cloud

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116014Published

open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType

cve-program ·

Vendor product: open62541

CVSS 4.0 9.2 · CVSS 3.1 8.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116013Published

OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing

cve-program ·

Vendor product: lua-resty-dns

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116012Published

Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser

cve-program ·

Vendor product: ghidra

CVSS 4.0 2.0 · CVSS 3.1 3.6Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116011Published

Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()

cve-program ·

Vendor product: Crow

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116010Published

RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers

cve-program ·

Vendor product: RosarioSIS

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116009Published

Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action

cve-program ·

Vendor product: camaleon-cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-116008Published

DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign

cve-program ·

Vendor product: DaybydayCRM

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110018Published

aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute

cve-program ·

Vendor product: aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

CVSS 3.1 8.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115998Published

IDOR: User reads and modifies findings from other people's projects

cve-program ·

Vendor product: cervantes

CVSS 3.1 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115994Published

BOLA Allows Cross-Project Target Tampering

cve-program ·

Vendor product: cervantes

CVSS 3.1 5.4Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115993Published

Stored XSS in the “Notes” field of project checklists

cve-program ·

Vendor product: cervantes

CVSS 3.1 6.8Source modified 24 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0384Published

Race condition in `tokio::time::Interval` on Tokio v1.54.0

osv · CVE-2026-115567 · GHSA-5wjr-9356-4wc8

crates.io: tokio

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115975Published

Broken access control in JiraController

cve-program ·

Vendor product: cervantes

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112067Published

Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)

cve-program ·

https://packagist.org/: blueways/bw-captcha

CVSS 4.0 6.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112064Published

SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

cve-program ·

https://packagist.org/: sgalinski/sg-cookie-optin

CVSS 4.0 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115803Published

Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization

cve-program ·

Vendor product: Scada-LTS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 24 Oct 2026Recorded 24 Oct 2026

RUSTSEC-2026-0379Published

Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

osv · CVE-2026-115893 · GHSA-mghf-wjfp-p5xm

crates.io: wasmtime

Source modified 24 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.