Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677622 source statements · aliases may refer to the same vulnerability

CVE-2026-91476Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker w…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Brazil

CVSS 3.1 5.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91475Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 6.6Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91474Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker w…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Brazil

CVSS 3.1 6.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91473Published

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the…

cve-program ·

Vendor product: Oracle HTTP Server

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91471Published

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: BAM Framework). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated att…

cve-program ·

Vendor product: PeopleSoft Enterprise CC Common Application Objects

CVSS 3.1 3.7Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91467Published

Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows physical access …

cve-program ·

Vendor product: Oracle Fusion Middleware Control

CVSS 3.1 6.6Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91466Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management). The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged att…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Argentina

CVSS 3.1 6.4Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91465Published

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker…

cve-program ·

Vendor product: PeopleSoft Enterprise FIN Common Objects Argentina

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-94422Published

xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

cve-program ·

https://github.com/flatpak/xdg-dbus-proxy: xdg-dbus-proxy · https://bodhi.fedoraproject.org/updates/?packages=xdg-dbus-proxy: xdg-dbus-proxy · https://access.redhat.com/downloads/content/package-browser/: xdg-dbus-proxy

CVSS 3.1 8.8 · CVSS 4.0 8.7Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91464Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91463Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91462Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 5.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91461Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 3.7Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91460Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91459Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91458Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with log…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91457Published

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attac…

cve-program ·

Vendor product: Oracle Outside In Technology

CVSS 3.1 7.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91455Published

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated a…

cve-program ·

Vendor product: JD Edwards EnterpriseOne Tools

CVSS 3.1 5.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-xvq9-wjp8-hwqfPublished

i18next-http-backend incomplete URL validation permits SSRF

osv · CVE-2026-105800

npm: i18next-http-backend

LOWSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-pgx6-7jcq-2qffPublished

PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

osv · CVE-2026-82866

npm: @pdfme/common

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91450Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-v3f4-w7r7-v3hmPublished

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

osv · CVE-2026-58497

npm: @zenalexa/unicli

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-m5mm-p8h7-m29vPublished

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

osv · CVE-2026-115754 · CVE-2026-115897

npm: serialize-javascript

LOWSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-2h46-9x5w-4wf7Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind

osv · CVE-2026-57208 · GO-2026-5063

Go: github.com/entireio/cli

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

GO-2026-5063Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli

osv · CVE-2026-57208 · GHSA-2h46-9x5w-4wf7

Go: github.com/entireio/cli

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91449Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-jg4p-7fhp-p32pPublished

@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing

osv · CVE-2026-115728 · CVE-2026-35213

npm: @hapi/content

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91448Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91447Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-106110Published

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row dat…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106111Published

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result that is shorter than the EXR block's required size. ZipExrCompression.Decompress reconstructs …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106112Published

ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106113Published

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumeri…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106114Published

ImageSharp is a 2D graphics library. From 1.0.0-beta0001 until 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared channel and grid dimensions before confirming that the profile contains the declared values. IccDataRe…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106115Published

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-106116Published

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ExifReader.ReadValue64 returns without adv…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

MAL-2026-18243Published

Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm)

osv · GHSA-8wf7-8825-99q7

npm: @k18k/entrypoint-sdk-darwin-arm64

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115929Published

MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs

cve-program ·

Vendor product: Compass

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110734Published

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the ima…

cve-program ·

Vendor product: Godot Engine

CVSS 3.1 2.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113378Published

mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

cve-program ·

Vendor product: mcp-ripgrep

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

MAL-2026-18245Published

Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm)

osv · GHSA-9fhg-r3w6-g7r4

npm: @k18k/entrypoint-sdk-linux-x64

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18244Published

Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

osv · GHSA-j58m-rwhr-923h

npm: @k18k/entrypoint-sdk-darwin-x64

Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2022-43760Published

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.4 · CVSS 3.1 · [email protected] · Primary 8.4Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2022-47762Published

In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.

nvd ·

CVSS 3.1 · [email protected] · Primary 7.5 · CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2023-22647Published

An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate Kubernetes secrets in the local

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Primary 8.0Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2023-30549Published

Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Primary 7.8Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2023-31135Published

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The la…

nvd ·

CVSS 3.1 · [email protected] · Secondary 3.3 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-10032Published

The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall actio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.1 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-34783Published

Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-34841Published

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 23 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.