Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677657 source statements · aliases may refer to the same vulnerability

CVE-2026-113877Published

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

cve-program ·

https://cpan.org/modules: HTTP-Headers-ActionPack

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18246Published

Malicious code in orqiva-runtime-win32-x64 (npm)

osv · GHSA-8j59-g9mq-7hf9

npm: orqiva-runtime-win32-x64

Source modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-xcx6-jx8p-x3h5Published

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

osv · CVE-2026-109461

npm: @azure/msal-node

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-xjj6-f33q-929cPublished

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

osv · CVE-2026-109869

npm: undici · npm: undici · npm: undici

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-4qv8-2p9j-2685Published

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

osv · CVE-2026-109924

npm: undici · npm: undici · npm: undici

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-f72v-6w45-q472Published

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

osv · CVE-2026-109841

npm: undici · npm: undici

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-897f-g5gm-fmxmPublished

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

osv · CVE-2026-115889 · RUSTSEC-2026-0380

crates.io: wasmtime · crates.io: wasmtime

CRITICALSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-9pvw-hwfg-92h5Published

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

osv · CVE-2026-115892 · RUSTSEC-2026-0378

crates.io: wasmtime · crates.io: wasmtime

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-110814Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108537Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108793Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115897Published

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influ…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115895Published

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating that it …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115893Published

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditio…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115892Published

Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value passes through guest code and returns t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115889Published

Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wa…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-114141Published

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tabl…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 23 Oct 2026Recorded 25 Oct 2026

GHSA-h4fr-cmh5-qr62Published

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

osv ·

npm: fallow · npm: @fallow-cli/fallow-node · crates.io: fallow-cli

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-jfwm-3p3c-6hx5Published

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

osv · CVE-2026-115569

npm: fallow · npm: @fallow-cli/fallow-node · crates.io: fallow-cli

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-q7qp-rjg7-q26mPublished

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

osv · CVE-2026-113872

npm: multer

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-834v-8h66-3h79Published

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

osv · CVE-2026-115895

npm: happy-dom

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-10141Published

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can m…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10139Published

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an au…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10138Published

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make …

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10137Published

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker ca…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10136Published

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10135Published

A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authe…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10133Published

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make a…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10132Published

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker c…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-10131Published

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-9869Published

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-9827Published

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can mak…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2025-11183Published

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2025-11573Published

An infinite loop issue in Amazon.IonDotnet library versions <v1.3.2 may allow a threat actor to cause a denial of service through a specially crafted text input.

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.7 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2025-54289Published

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.4 · CVSS 3.1 · [email protected] · Primary 8.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2025-61581Published

UNSUPPORTED WHEN ASSIGNED Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2025-66020Published

Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-18140Published

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.7 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-28736Published

UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a st…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-36045Published

picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54722Published

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-59952Published

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-65834Published

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-65835Published

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRa…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-67332Published

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.4Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-67550Published

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68499Published

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68581Published

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68582Published

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-72799Published

SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 23 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.