Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677723 source statements · aliases may refer to the same vulnerability

CVE-2025-61581Published

UNSUPPORTED WHEN ASSIGNED Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2025-66020Published

Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 c…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-18140Published

Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, might allow remote unauthenticated users to cause a…

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.7 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-28736Published

UNSUPPORTED WHEN ASSIGNED Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a st…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-36045Published

picoclaw <=v0.1.2 and earlier is vulnerable to OS command injection via the ExecTool component (pkg/tools/shell.go). The guardCommand() function attempts to restrict shell command execution using a denylist of 8 regular expressions, but the…

nvd ·

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 7.3Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-54722Published

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-59952Published

Valibot helps validate data using a schema. Versions prior to 1.4.2 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-65834Published

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-65835Published

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including handleRa…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-67332Published

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Secondary 6.4Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-67550Published

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split,…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68499Published

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails to advance its native matching cursor in …

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.2Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68581Published

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68582Published

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view from…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-72799Published

SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-72809Published

SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1)…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.1 · CVSS 3.1 · [email protected] · Secondary 8.0Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-9817Published

A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker …

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-9814Published

An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker ca…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-9660Published

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code executi…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-42025Published

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary …

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-42026Published

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary …

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-42021Published

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitra…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-42022Published

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitra…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-42023Published

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitra…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-42024Published

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitra…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-35499Published

An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can mak…

cve-program ·

Vendor product: Totolink

CVSS 3.1 9.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114254Published

oretnom23 file-management-system-php admin_class.php login sql injection

cve-program ·

Vendor product: file-management-system-php

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114257Published

oretnom23 file-management-system-php File Download download.php readfile sql injection

cve-program ·

Vendor product: file-management-system-php

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114260Published

oretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication

cve-program ·

Vendor product: file-management-system-php

CVSS 4.0 6.9 · CVSS 3.1 6.5 · CVSS 3.0 6.5 · CVSS 2.0 6.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114263Published

ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection

cve-program ·

Vendor product: Advanced Library Management System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105932Published

Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 2.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105933Published

Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 2.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105934Published

Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 7.2Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-f2hq-32vh-53ccPublished

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

osv ·

npm: postal-mime

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-85x2-q946-cp5hPublished

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

osv ·

npm: nodemailer

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-8c8m-p3m8-cjg8Published

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

osv ·

npm: nodemailer

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-m943-m63m-w62wPublished

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

osv ·

npm: nodemailer

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-105935Published

Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 4.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105936Published

Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115938Published

Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

cve-program ·

https://packagist.org: craftcms/cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105937Published

Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 8.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105938Published

Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 2.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105942Published

Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109572Published

Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy

cve-program ·

Vendor product: open-webui

CVSS 4.0 7.2 · CVSS 3.1 7.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109299Published

Open WebUI 0.9.0 before 0.11.4 Denial of Service via Recurrence Rule Validation

cve-program ·

Vendor product: open-webui

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109298Published

Open WebUI 0.11.0 before 0.11.4 Memory Exhaustion via Knowledge Search Regex

cve-program ·

Vendor product: open-webui

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109297Published

Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules

cve-program ·

Vendor product: open-webui

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109296Published

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109295Published

Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109294Published

Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

cve-program ·

Vendor product: open-webui

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.