Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

678400 source statements · aliases may refer to the same vulnerability

CVE-2026-116055Published

SourceCodester Performance Indicator System deleteproduct.php sql injection

cve-program ·

Vendor product: Performance Indicator System

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116170Published

SiYuan before v3.8.7 SQL Injection via History Search op and query

cve-program ·

Vendor product: siyuan

CVSS 4.0 6.9 · CVSS 3.1 4.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116169Published

SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

cve-program ·

Vendor product: siyuan

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116168Published

SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool

cve-program ·

Vendor product: siyuan

CVSS 4.0 6.9 · CVSS 3.1 6.2Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116054Published

SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash

cve-program ·

Vendor product: SH3

CVSS 4.0 2.1 · CVSS 3.1 2.2 · CVSS 3.0 2.2 · CVSS 2.0 1.7Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-102786Published

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

cve-program ·

Vendor product: Phoca Gallery extension for Joomla

CVSS 4.0 8.6Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116186Published

OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId

cve-program ·

Vendor product: core

CVSS 4.0 2.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116185Published

OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos

cve-program ·

Vendor product: core

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116184Published

OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

cve-program ·

Vendor product: core

CVSS 4.0 2.1Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116211Published

YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create

cve-program ·

Vendor product: yeswiki

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116208Published

YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116206Published

YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.3 · CVSS 3.1 6.4Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116205Published

YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax

cve-program ·

Vendor product: yeswiki

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116204Published

YesWiki before 4.7.0 CSRF via despam Admin Action

cve-program ·

Vendor product: yeswiki

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116202Published

YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload

cve-program ·

Vendor product: yeswiki

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116201Published

Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

cve-program ·

Vendor product: snipe-it

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116200Published

Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

cve-program ·

Vendor product: snipe-it

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116198Published

Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

cve-program ·

Vendor product: snipe-it

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116197Published

Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

cve-program ·

Vendor product: contrast

CVSS 4.0 2.1 · CVSS 3.1 2.6Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116196Published

Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url

cve-program ·

Vendor product: rclone

CVSS 4.0 6.0 · CVSS 3.1 5.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116194Published

Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback

cve-program ·

Vendor product: rclone

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116193Published

Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

cve-program ·

Vendor product: rclone

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116192Published

rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

cve-program ·

Vendor product: rclone

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116190Published

rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

cve-program ·

Vendor product: rclone

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116189Published

rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS

cve-program ·

Vendor product: rclone

CVSS 4.0 7.7 · CVSS 3.1 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116188Published

rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

cve-program ·

Vendor product: rclone

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116182Published

phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching

cve-program ·

Vendor product: phpMyFAQ

CVSS 4.0 5.3 · CVSS 3.1 5.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116181Published

vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids

cve-program ·

Vendor product: vllm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116177Published

vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass

cve-program ·

Vendor product: vllm

CVSS 4.0 8.7 · CVSS 3.1 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116176Published

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

cve-program ·

Vendor product: vllm

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116174Published

vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate

cve-program ·

Vendor product: vllm

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116172Published

vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n

cve-program ·

Vendor product: vllm

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116166Published

SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

cve-program ·

Vendor product: siyuan

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116165Published

Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 8.8Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116164Published

Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 6.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116162Published

Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 2.1Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116161Published

Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 6.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116160Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116153Published

ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 2.0 · CVSS 3.1 2.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116152Published

ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116149Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 7.2 · CVSS 3.1 8.1Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116148Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.6Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116145Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 1.8 · CVSS 3.1 3.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116142Published

ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116141Published

ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder

cve-program ·

Vendor product: ImageMagick

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116140Published

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing

cve-program ·

Vendor product: ImageMagick · Vendor product: ImageMagick

CVSS 4.0 4.8 · CVSS 3.1 3.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116052Published

LinkStackOrg LinkStack cross-site request forgery

cve-program ·

Vendor product: LinkStack

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116137Published

adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

cve-program ·

Vendor product: adm-zip

CVSS 4.0 6.3 · CVSS 3.1 3.7Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116136Published

ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

cve-program ·

Vendor product: ProjectSend

CVSS 4.0 6.0 · CVSS 3.1 5.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116073Published

Leon before commit 50df142 Path Traversal via /download model Command

cve-program ·

Vendor product: leon

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.