Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

678453 source statements · aliases may refer to the same vulnerability

CVE-2026-58500Published

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59801Published

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middle…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62187Published

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or p…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62188Published

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62327Published

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62328Published

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated re…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-115982Published

phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting

cve-program ·

Vendor product: phpIPAM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-15895Published

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument.

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.4 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-45737Published

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuratio…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-45738Published

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-46339Published

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47423Published

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <sel…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47428Published

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted br…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47429Published

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the proje…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · [email protected] · Primary 5.9Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47703Published

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a q…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48038Published

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() sc…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48068Published

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48069Published

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process tha…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48125Published

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By send…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48758Published

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48795Published

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.proto…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48801Published

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails because the …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Primary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48815Published

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certif…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48816Published

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even thoug…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-49352Published

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-49353Published

9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/, /api/tunnel/, and /api/cli-tools/*, allowing heade…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-49458Published

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructor…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-49459Published

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant n…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-49978Published

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled mark…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 6.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-49987Published

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.5 · CVSS 3.1 · [email protected] · Primary 8.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-49988Published

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, the Repomix MCP server attach_packed_output and read_repomix_output flow can register and read arbitrary local .json, .txt, .md, or .xml files without the fi…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.8 · CVSS 3.1 · [email protected] · Primary 5.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-53486Published

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write fil…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-53633Published

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allo…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-54052Published

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version h…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.9 · CVSS 3.1 · [email protected] · Primary 9.9Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-55445Published

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite('/open/*'…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-55608Published

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-s…

nvd ·

CVSS 3.1 · [email protected] · Secondary 4.2 · CVSS 3.1 · [email protected] · Primary 5.4Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-56678Published

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted reg…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.4Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-56679Published

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as …

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59254Published

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret valu…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59259Published

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59859Published

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through S…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59860Published

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59861Published

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema-derived strings through CodeMethodWriter.cs and SanitizeForQuotedLite…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59891Published

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contai…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62314Published

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check() trusted the client-controlled X-Origin…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-44974Published

@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retained the last occurrence of each duplicate parameter while Content.type() retained the first occurrence of duplicate charset and boundary param…

nvd ·

CVSS 4.0 · [email protected] · Secondary 7.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-44979Published

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwa…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-44981Published

CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watc…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-44982Published

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encod…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-45325Published

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts becaus…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.