Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677757 source statements · aliases may refer to the same vulnerability

GHSA-j6qf-3m9c-vwj3Published

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

osv · CVE-2026-114437

Go: github.com/go-chi/chi/v5

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-7cgw-qmxx-7fc2Withdrawn

Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

osv ·

Go: github.com/go-chi/chi/v5

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-pfhg-q3qv-9q6rPublished

SvelteKit: URL redirection to untrusted site via enhanced form submission

osv · CVE-2026-114060

npm: @sveltejs/kit

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-pvhg-7v4p-f5q9Withdrawn

Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

osv ·

npm: @sveltejs/kit

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-115247Published

subhajitkhan online-clinic-management-system patientregistration.php missing encryption

cve-program ·

Vendor product: online-clinic-management-system

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115883Published

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

cve-program ·

Vendor product: langgraph · Vendor product: langgraph-checkpoint-postgres · Vendor product: langgraph-checkpoint-sqlite

CVSS 4.0 6.0Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-5wjr-9356-4wc8Published

Tokio: Race condition in `tokio::time::Interval`

osv · CVE-2026-115567 · RUSTSEC-2026-0384

crates.io: tokio

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-48031Published

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public rep…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-48113Published

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-48154Published

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA sec…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-48790Published

Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1.0.26 persist the user's Turso platform JWT to `settings.json` using Viper's default `configPermissions` of `0o644`, leaving the credential …

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68584Published

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2 · CVSS 3.1 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68585Published

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous r…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9 · CVSS 3.1 · [email protected] · Secondary 5.8Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68586Published

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publis…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2 · CVSS 3.1 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68587Published

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access ch…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.2 · CVSS 3.1 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-68930Published

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, and t…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69083Published

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-con…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69084Published

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69085Published

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Secondary 10.0Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69086Published

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.3 · CVSS 3.1 · [email protected] · Secondary 7.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69152Published

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded se…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69185Published

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, whic…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69192Published

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and g…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-69198Published

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own s…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-75507Published

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

cve-program ·

Vendor product: graphql-core

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108358Published

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

cve-program ·

Vendor product: PhpSpreadsheet

CVSS 4.0 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108357Published

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

cve-program ·

Vendor product: PhpSpreadsheet

CVSS 4.0 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114613Published

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

cve-program ·

Vendor product: msgpack-python

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115348Published

Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

cve-program ·

Vendor product: mistune

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115352Published

Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

cve-program ·

Vendor product: mistune

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115360Published

OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

cve-program ·

Vendor product: openbao

CVSS 4.0 5.3 · CVSS 3.1 4.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115506Published

libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay

cve-program ·

Vendor product: libexpat

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-112330Published

Motor.NET < 0.19.0 RabbitMQ Denial of Service via CloudEvents Headers

cve-program ·

Vendor product: motornet

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115534Published

gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115537Published

gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect

cve-program ·

Vendor product: HospitalManagement

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-55835Published

Lookyloo: Potential sub-system DoS due to parameter missmatch in notification

cve-program ·

Vendor product: lookyloo

CVSS 4.0 6.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-56833Published

PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-56837Published

PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

cve-program ·

Vendor product: PraisonAI

CVSS 3.1 8.6Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-57849Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-q54r-jf2p-rfr2Published

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

osv ·

crates.io: gix

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-4v6f-7vjh-6x4mPublished

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

osv · CVE-2026-115419

PyPI: strands-agents · npm: @strands-agents/sdk

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-cxf3-9h37-7rr8Published

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

osv ·

Go: github.com/labstack/echo/v4 · Go: github.com/labstack/echo/v5

CRITICALSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-27r3-jxmh-p828Published

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

osv · CVE-2026-111181

npm: body-parser · npm: body-parser

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-f48p-c9v4-h7xvPublished

Echo: BodyDump captures request and response bodies without size limits in v4

osv ·

Go: github.com/labstack/echo/v4

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-85pr-xr59-r75hWithdrawn

Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

osv ·

npm: @sveltejs/kit

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-x9ff-22gv-65f4Published

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

osv ·

Go: github.com/labstack/echo/v5

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-2rqm-h6hv-g79vPublished

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

osv ·

npm: odf-kit

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-9969-6676-49h5Published

Echo: WebSocket proxy can retain connections and handlers after client disconnect

osv ·

Go: github.com/labstack/echo/v4 · Go: github.com/labstack/echo/v5

HIGHSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-27mw-82g8-phjjPublished

SvelteKit : XSS via untrusted cache-control header in prerendered page

osv · CVE-2026-114061

npm: @sveltejs/kit

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-h53f-rm2w-w7rgPublished

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

osv ·

Go: github.com/labstack/echo/v5

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.