Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

678452 source statements · aliases may refer to the same vulnerability

CVE-2026-116136Published

ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

cve-program ·

Vendor product: ProjectSend

CVSS 4.0 6.0 · CVSS 3.1 5.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116073Published

Leon before commit 50df142 Path Traversal via /download model Command

cve-program ·

Vendor product: leon

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116071Published

rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption

cve-program ·

Vendor product: rotki

CVSS 4.0 8.2 · CVSS 3.1 5.9Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116070Published

Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config

cve-program ·

Vendor product: Docker-Proxy

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116069Published

NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field

cve-program ·

Vendor product: niubigeo

CVSS 4.0 6.9 · CVSS 3.1 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116067Published

Paisa before 0.7.8 Path Traversal via Editor and Sheet API

cve-program ·

Vendor product: paisa

CVSS 4.0 8.8 · CVSS 3.1 8.2Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116066Published

Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service

cve-program ·

Vendor product: Firecrawl

CVSS 4.0 7.0 · CVSS 3.1 6.8Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18268Published

Malicious code in tiktok-video-scraper (npm)

osv · GHSA-5xjv-xr86-9hrv

npm: tiktok-video-scraper

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18265Published

Malicious code in p12-pem (npm)

osv · GHSA-74xg-w33f-jpv3

npm: p12-pem

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18258Published

Malicious code in insta-reel-search (npm)

osv · GHSA-v2r2-x76j-6fcx

npm: insta-reel-search

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18263Published

Malicious code in ionic-youtube-streams (npm)

osv · GHSA-3cc7-77mx-rmj6

npm: ionic-youtube-streams

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18264Published

Malicious code in ocsp-hashes (npm)

osv · GHSA-9v69-fx5h-r6p6

npm: ocsp-hashes

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18267Published

Malicious code in sound-cloud-loader-api (npm)

osv · GHSA-5f99-52fc-5rc9

npm: sound-cloud-loader-api

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18256Published

Malicious code in cordova-plugin-geofence-appit (npm)

osv · GHSA-5pw8-3xv5-6cmg

npm: cordova-plugin-geofence-appit

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18262Published

Malicious code in ionic-youtube-search (npm)

osv · GHSA-7p9r-26fp-m47g

npm: ionic-youtube-search

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18259Published

Malicious code in ionic-insta-search (npm)

osv · GHSA-4fw4-xm5r-mh69

npm: ionic-insta-search

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18261Published

Malicious code in ionic-tiktok-scraper (npm)

osv · GHSA-wwj3-4v8w-w98j

npm: ionic-tiktok-scraper

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18254Published

Malicious code in appit-cordova-plugin-ionic (npm)

osv · GHSA-fr38-45mf-vcqf

npm: appit-cordova-plugin-ionic

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18255Published

Malicious code in cert-infos (npm)

osv · GHSA-8mjx-r4j6-3h6g

npm: cert-infos

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18269Published

Malicious code in youtube-info-streams (npm)

osv · GHSA-7mfw-r26v-9r9f

npm: youtube-info-streams

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18260Published

Malicious code in ionic-sound-cloud-loader-api (npm)

osv · GHSA-g89m-8c48-9x73

npm: ionic-sound-cloud-loader-api

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18270Published

Malicious code in youtube-search-without-api-key (npm)

osv · GHSA-f6m2-r9qr-44fx

npm: youtube-search-without-api-key

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18253Published

Malicious code in appit-cordova-admob (npm)

osv · GHSA-9w8h-674f-4x2j

npm: appit-cordova-admob

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18266Published

Malicious code in redis-dumper (npm)

osv · GHSA-8gg8-xq45-8fx5

npm: redis-dumper

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116050Published

krupalshah Employee Recruitment System Registration registerform3.php sql injection

cve-program ·

Vendor product: Employee Recruitment System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116048Published

krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection

cve-program ·

Vendor product: EmployeeRecruitmentSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116047Published

Privoce Vocechat Query Parameter widget.html cross site scripting

cve-program ·

Vendor product: Vocechat

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-105164Published

NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds

cve-program ·

Vendor product: cFS

CVSS 4.0 5.1 · CVSS 3.1 2.7 · CVSS 3.0 2.7 · CVSS 2.0 3.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116045Published

1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal

cve-program ·

Vendor product: designer-mcp

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116044Published

prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload

cve-program ·

Vendor product: TinyFileManager

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-114820Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 9.1Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116006Published

YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication

cve-program ·

Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116004Published

onyx-dot-app Onyx PreviewTab.tsx cross site scripting

cve-program ·

Vendor product: Onyx

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-115999Published

mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection

cve-program ·

Vendor product: Restaurant_IMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18251Published

Malicious code in tailwindcss-theme-kit (npm)

osv · GHSA-v5xr-xjx7-ggwf

npm: tailwindcss-theme-kit

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18250Published

Malicious code in tailwind-base-buttons (npm)

osv · GHSA-5j43-343m-gggg

npm: tailwind-base-buttons

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-115997Published

pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection

cve-program ·

Vendor product: pig

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-58661Published

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-111326Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-109111Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-89284Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-115995Published

Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection

cve-program ·

Vendor product: Unitree Go2

CVSS 4.0 9.4 · CVSS 3.1 9.6 · CVSS 3.0 9.6 · CVSS 2.0 10.0Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-27690Published

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-44745Published

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lea…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-56353Published

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 4.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-56764Published

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality ch…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 3.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-58500Published

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59801Published

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middle…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62187Published

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or p…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62188Published

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.