Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

678600 source statements · aliases may refer to the same vulnerability

CVE-2026-73197Published

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: ipa · https://access.redhat.com/downloads/content/package-browser/: ipa · https://access.redhat.com/downloads/content/package-browser/: idm:client

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-19550Published

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

cve-program ·

CVSS 3.1 8.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-18147Published

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

cve-program ·

CVSS 3.1 8.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-13097Published

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

cve-program ·

CVSS 3.1 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-83596Published

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

cve-program ·

https://webkit.org/: webkit · https://webkitgtk.org/: webkitgtk · https://access.redhat.com/downloads/content/package-browser/: webkit2gtk3

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-78376Published

Webkitgtk: use-after-free of jscvalue function parameters

cve-program ·

https://webkit.org/: webkit · https://webkitgtk.org/: webkitgtk · https://access.redhat.com/downloads/content/package-browser/: webkit2gtk3

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74041Published

Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-41184Published

In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44543Published

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can mani…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44594Published

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45311Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45373Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45374Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45627Published

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-46509Published

deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain proto/constructor/prototype. The property path must not be exposed as user input. This vulnerabili…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116488Published

NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

cve-program ·

Vendor product: mcuxsdk-middleware-usb

CVSS 4.0 7.0 · CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116487Published

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

cve-program ·

Vendor product: mcuxsdk-middleware-usb

CVSS 4.0 5.1 · CVSS 3.1 4.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116485Published

danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

cve-program ·

Vendor product: danmu_api

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116216Published

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116215Published

MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116214Published

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116212Published

Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

cve-program ·

Vendor product: Webasyst Framework

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116210Published

Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

cve-program ·

Vendor product: Webasyst Framework

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-78850Published

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted …

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116281Published

Kameleo Profile Controller t.cs ListProfiles information disclosure

cve-program ·

Vendor product: Kameleo

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113874Published

SmileCDR HAPI FHIR trusted tenant partition override

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 8.1 · CVSS 4.0 8.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113876Published

SmileCDR HAPI FHIR unauthorized read

cve-program ·

Vendor product: HAPI FHIR

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113873Published

SmileCDR HAPI FHIR improper data decompression

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113875Published

SmileCDR HAPI FHIR unauthorized read via subscription

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 3.1 · CVSS 4.0 2.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115948Published

WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: media-library-assistant

CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115951Published

WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: lazy-load-for-videos

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115950Published

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: better-post-filter-widgets-for-elementor

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115954Published

WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115953Published

WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115608Published

WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

cve-program ·

https://crocoblock.com: jet-engine

CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115594Published

WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: media-library-assistant

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114707Published

WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-elements

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115961Published

WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: b-slider

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115956Published

WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: panorama

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115955Published

WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: advanced-post-block

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115960Published

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woosquare

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115959Published

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woosquare

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115595Published

WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: contact-form-by-supsystic

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114708Published

WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-smart-filters

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116280Published

Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery

cve-program ·

Vendor product: Kameleo

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110474Published

Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

cve-program ·

Vendor product: Agentic AI Call Centre

CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116492Published

Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

cve-program ·

Vendor product: crm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110475Published

Improper Authentication Vulnerability in CreditNirvana Collections Platform

cve-program ·

Vendor product: CreditNirvana Collections Platform (CollectionWorkz)

CVSS 4.0 9.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116274Published

JIZHICMS Front-end Order OrderController.php pay improper authorization

cve-program ·

Vendor product: JIZHICMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-44720Published

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.