Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

662481 source statements · aliases may refer to the same vulnerability

GHSA-pgx6-7jcq-2qffPublished

PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

osv · CVE-2026-82866

npm: @pdfme/common

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91450Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-v3f4-w7r7-v3hmPublished

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

osv · CVE-2026-58497

npm: @zenalexa/unicli

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-m5mm-p8h7-m29vPublished

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

osv · CVE-2026-115754 · CVE-2026-115897

npm: serialize-javascript

LOWSource modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-2h46-9x5w-4wf7Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind

osv · CVE-2026-57208 · GO-2026-5063

Go: github.com/entireio/cli

MODERATESource modified 24 Oct 2026Recorded 24 Oct 2026

GO-2026-5063Published

Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli

osv · CVE-2026-57208 · GHSA-2h46-9x5w-4wf7

Go: github.com/entireio/cli

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91449Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.4Source modified 24 Oct 2026Recorded 24 Oct 2026

GHSA-jg4p-7fhp-p32pPublished

@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing

osv · CVE-2026-115728 · CVE-2026-35213

npm: @hapi/content

HIGHSource modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91448Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-91447Published

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network a…

cve-program ·

Vendor product: Siebel CRM Deployment

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

MAL-2026-18243Published

Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm)

osv · GHSA-8wf7-8825-99q7

npm: @k18k/entrypoint-sdk-darwin-arm64

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115929Published

MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs

cve-program ·

Vendor product: Compass

CVSS 4.0 7.6 · CVSS 3.1 6.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110734Published

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the ima…

cve-program ·

Vendor product: Godot Engine

CVSS 3.1 2.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113378Published

mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

cve-program ·

Vendor product: mcp-ripgrep

CVSS 4.0 4.8 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 4.3Source modified 24 Oct 2026Recorded 24 Oct 2026

MAL-2026-18245Published

Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm)

osv · GHSA-9fhg-r3w6-g7r4

npm: @k18k/entrypoint-sdk-linux-x64

Source modified 23 Oct 2026Recorded 24 Oct 2026

MAL-2026-18244Published

Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

osv · GHSA-j58m-rwhr-923h

npm: @k18k/entrypoint-sdk-darwin-x64

Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-113877Published

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

cve-program ·

https://cpan.org/modules: HTTP-Headers-ActionPack

Source modified 23 Oct 2026Recorded 24 Oct 2026

CVE-2026-102208Published

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-83862Published

Windows Network Load Balancing Remote Code Execution Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows Server 2012

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97781Published

Microsoft Office OneNote Remote Code Execution Vulnerability

cve-program ·

Vendor product: Microsoft 365 Apps for Enterprise

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-105016Published

Microsoft QUIC Remote Code Execution Vulnerability

cve-program ·

Vendor product: .NET 10.0 runtime · Vendor product: .NET 11.0 runtime · Vendor product: .NET 8.0 runtime

CVSS 3.1 9.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97801Published

.NET Framework Tampering Vulnerability

cve-program ·

Vendor product: Microsoft .NET Framework 3.5 · Vendor product: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Vendor product: Microsoft .NET Framework 3.5 AND 4.7.2

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-80092Published

Microsoft Identity Web Elevation of Privilege Vulnerability

cve-program ·

Vendor product: microsoft-identity-web · Vendor product: microsoft-identity-web

CVSS 3.1 5.3Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-109461Published

Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability

cve-program ·

Vendor product: Microsoft Identity Client for NodeJS

CVSS 3.1 5.9Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108463Published

Windows SmartScreen Security Feature Bypass Vulnerability

cve-program ·

Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2 · Vendor product: Windows 11 version 26H1

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108471Published

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1809 · Vendor product: Windows Server 2019 · Vendor product: Windows Server 2019 (Server Core installation)

CVSS 3.1 8.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108136Published

Microsoft Windows Search Component Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 7.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108135Published

Windows Backup Engine Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 21H2 · Vendor product: Windows 10 Version 22H2 · Vendor product: Windows 11 version 23H2

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108134Published

Windows Autopilot Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2 · Vendor product: Windows 11 Version 26H2

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108133Published

Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows Server 2022

CVSS 3.1 7.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108132Published

Windows Kerberos Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 7.0Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108131Published

Active Directory Federation Services (AD FS) Spoofing Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 7.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108130Published

Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

cve-program ·

Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2 · Vendor product: Windows 11 version 26H1

CVSS 3.1 7.8Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108129Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108128Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-108127Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97844Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97843Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97842Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97841Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97840Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97839Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97838Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97837Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97836Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97835Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97834Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97833Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97832Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

CVE-2026-97831Published

Role: DNS Server Information Disclosure Vulnerability

cve-program ·

Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2

CVSS 3.1 6.5Source modified 23 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.