Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

678633 source statements · aliases may refer to the same vulnerability

CVE-2026-113440Published

HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

cve-program ·

https://repo.hex.pm: hackney · https://github.com: benoitc/hackney

CVSS 4.0 6.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115700Published

SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

cve-program ·

https://repo.hex.pm: hackney · https://github.com: benoitc/hackney

CVSS 4.0 6.9Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116283Published

Kameleo Local API profiles information disclosure

cve-program ·

Vendor product: Kameleo

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-103634Published

Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch

cve-program ·

https://github.com: apache/datasketches-cpp

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-67249Published

Apache Answer: Email Code Purpose Confusion May Allow Account Takeover

cve-program ·

Vendor product: Apache Answer

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74757Published

Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count

cve-program ·

https://github.com: apache/brpc

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-111590Published

SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

cve-program ·

Vendor product: Harbor · Vendor product: Harbor · Vendor product: Harbor

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-90484Published

Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash

cve-program ·

https://github.com: apache/brpc

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-59107Published

Shared SSH Authentication Key in vSolution Matrix File Sharing

cve-program ·

Vendor product: Cynap Pro, Cynap Core Pro · Vendor product: Cynap, Cynap Core

CVSS 4.0 9.2 · CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110314Published

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

cve-program ·

https://repo.hex.pm: bandit · https://github.com: mtrudel/bandit

CVSS 4.0 6.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-79678Published

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: ipa · https://access.redhat.com/downloads/content/package-browser/: ipa · https://access.redhat.com/downloads/content/package-browser/: idm:client

CVSS 3.1 8.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-76578Published

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

cve-program ·

CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-73198Published

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

cve-program ·

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-73197Published

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

cve-program ·

CVSS 3.1 7.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-19550Published

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

cve-program ·

CVSS 3.1 8.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-18147Published

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

cve-program ·

CVSS 3.1 8.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-13097Published

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

cve-program ·

CVSS 3.1 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-83596Published

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

cve-program ·

https://webkit.org/: webkit · https://webkitgtk.org/: webkitgtk · https://access.redhat.com/downloads/content/package-browser/: webkit2gtk3

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-78376Published

Webkitgtk: use-after-free of jscvalue function parameters

cve-program ·

https://webkit.org/: webkit · https://webkitgtk.org/: webkitgtk · https://access.redhat.com/downloads/content/package-browser/: webkit2gtk3

CVSS 3.1 8.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-74041Published

Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch

cve-program ·

Vendor product: wazuh-manager

CVSS 4.0 8.6 · CVSS 3.1 7.2Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-41184Published

In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes th…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.0 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44543Published

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can mani…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44594Published

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45311Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45373Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45374Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45627Published

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-46509Published

deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain proto/constructor/prototype. The property path must not be exposed as user input. This vulnerabili…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116488Published

NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

cve-program ·

Vendor product: mcuxsdk-middleware-usb

CVSS 4.0 7.0 · CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116487Published

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

cve-program ·

Vendor product: mcuxsdk-middleware-usb

CVSS 4.0 5.1 · CVSS 3.1 4.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116485Published

danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

cve-program ·

Vendor product: danmu_api

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116216Published

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116215Published

MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116214Published

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116212Published

Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

cve-program ·

Vendor product: Webasyst Framework

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116210Published

Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

cve-program ·

Vendor product: Webasyst Framework

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-78850Published

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted …

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116281Published

Kameleo Profile Controller t.cs ListProfiles information disclosure

cve-program ·

Vendor product: Kameleo

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113874Published

SmileCDR HAPI FHIR trusted tenant partition override

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 8.1 · CVSS 4.0 8.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113876Published

SmileCDR HAPI FHIR unauthorized read

cve-program ·

Vendor product: HAPI FHIR

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113873Published

SmileCDR HAPI FHIR improper data decompression

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113875Published

SmileCDR HAPI FHIR unauthorized read via subscription

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 3.1 · CVSS 4.0 2.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115948Published

WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: media-library-assistant

CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115951Published

WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: lazy-load-for-videos

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115950Published

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: better-post-filter-widgets-for-elementor

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115954Published

WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115953Published

WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115608Published

WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

cve-program ·

https://crocoblock.com: jet-engine

CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115594Published

WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: media-library-assistant

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114707Published

WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-elements

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.