Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677855 source statements · aliases may refer to the same vulnerability

CVE-2026-109289Published

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.3 · CVSS 3.1 6.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109288Published

Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

cve-program ·

Vendor product: open-webui

CVSS 4.0 7.2 · CVSS 3.1 6.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109287Published

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109286Published

Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal

cve-program ·

Vendor product: open-webui

CVSS 4.0 8.6 · CVSS 3.1 8.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109285Published

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

cve-program ·

Vendor product: open-webui

CVSS 4.0 2.3 · CVSS 3.1 5.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109284Published

Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109283Published

Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

cve-program ·

Vendor product: open-webui

CVSS 4.0 5.3 · CVSS 3.1 5.4Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105944Published

Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life

cve-program ·

Vendor product: Apache Pulsar Manager

CVSS 4.0 10.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105945Published

Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

cve-program ·

Vendor product: Apache Pulsar

CVSS 4.0 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-19676Published

PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 7.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-78116Published

Double free of an RTIO submission in the Broadcom AFBR-S50 sensor driver data-evaluation error path

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 5.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-93479Published

NGINX map directive and regex matching vulnerability

cve-program ·

Vendor product: NGINX Plus · Vendor product: NGINX Open Source

CVSS 3.1 8.1 · CVSS 4.0 9.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115937Published

Unauthenticated payment reuse allows unpaid orders to be marked as paid

cve-program ·

https://packagist.org: craftcms/commerce-mollie

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115801Published

Kakao khaiii JSON Config File Linear.cpp open out-of-bounds

cve-program ·

Vendor product: khaiii

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 23 Oct 2026Recorded 23 Oct 2026

GHSA-xhq7-xmqj-769hPublished

fast-uri vulnerable to improper path equivalence in relative reference normalization

osv · CVE-2026-110095

npm: fast-uri · npm: fast-uri · npm: fast-uri

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-333x-w4r6-6crpPublished

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

osv · CVE-2026-110725

npm: fast-uri · npm: fast-uri · npm: fast-uri

LOWSource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-w74x-v6f9-j3xgPublished

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

osv · CVE-2026-110306

npm: fast-uri · npm: fast-uri · npm: fast-uri

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

GHSA-wjr9-j795-jxcrPublished

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

osv · CVE-2026-110180

npm: fast-uri · npm: fast-uri · npm: fast-uri

MODERATESource modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-115935Published

Control panel only API response emulation replaces "securityKey" and reaches server RCE

cve-program ·

https://packagist.org: craftcms/cms

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115897Published

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

cve-program ·

Vendor product: serialize-javascript

CVSS 4.0 2.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115895Published

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

cve-program ·

Vendor product: happy-dom

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-18748Published

Out-of-bounds read in Bluetooth Classic A2DP codec information element handling

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 3.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115893Published

Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

cve-program ·

Vendor product: wasmtime

CVSS 3.1 9.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-78117Published

Race condition on shared HCI TX descriptor in the Infineon PSOC 6 BLESS Bluetooth driver can leak adjacent memory over the air

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 4.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-78118Published

Race condition on kernel wait queues: unlocked z_waitq_head() read in the timer expiration handler can yield a stale or sentinel thread pointer on SMP

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-78119Published

Out-of-bounds write in the Nuvoton NPCX eSPI Target-Attached-Flash receive path from an unvalidated host-supplied packet length

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 6.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-79976Published

NULL pointer dereference in the MCTP I2C+GPIO target binding triggerable by a peer I2C controller

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115892Published

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

cve-program ·

Vendor product: wasmtime

CVSS 4.0 5.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-19947Published

Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer

cve-program ·

https://github.com/zephyrproject-rtos/zephyr: zephyr

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115889Published

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

cve-program ·

Vendor product: wasmtime

CVSS 3.1 9.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111804Published

Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 8.2 · CVSS 4.0 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111816Published

Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 9.3 · CVSS 4.0 9.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111805Published

Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 8.6 · CVSS 4.0 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111808Published

Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 8.6 · CVSS 4.0 7.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111810Published

Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-111817Published

Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 5.3 · CVSS 4.0 6.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-112381Published

Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response

cve-program ·

Vendor product: Apache Traffic Server

CVSS 3.1 5.9 · CVSS 4.0 8.2Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114375Published

leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal

cve-program ·

Vendor product: wiki-go

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114141Published

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

cve-program ·

Vendor product: toml-node

CVSS 4.0 8.7Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-115887Published

graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

cve-program ·

Vendor product: graphql-scalars

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114378Published

itsourcecode Online Cake Ordering System deleteproduct.php sql injection

cve-program ·

Vendor product: Online Cake Ordering System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-96643Published

Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time

cve-program ·

Vendor product: Pillow

CVSS 4.0 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-96637Published

Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS

cve-program ·

Vendor product: Pillow

CVSS 4.0 7.1Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114381Published

itsourcecode Online Cake Ordering System orderdetail.php sql injection

cve-program ·

Vendor product: Online Cake Ordering System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114508Published

Laravel relationship inclusion can trigger unauthorized data destruction

cve-program ·

Vendor product: framework

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114384Published

itsourcecode Online Cake Ordering System transactionsave.php sql injection

cve-program ·

Vendor product: Online Cake Ordering System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-58497Published

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating b…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115570Published

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium …

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 23 Oct 2026Recorded 25 Oct 2026

CVE-2026-115886Published

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

cve-program ·

Vendor product: mlflow

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-114441Published

oretnom23 php-travel-agency-system update.php sql injection

cve-program ·

Vendor product: php-travel-agency-system

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.