Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

687790 source statements · aliases may refer to the same vulnerability

CVE-2026-44543Published

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can mani…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.7Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-44594Published

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45311Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, meaning it runs without any user approval prompt. cargo test compiles and…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45373Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work.…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.4Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45374Published

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell defaults to true (config.rs:1499: self.allow_shell.unwrap_or(true)) and…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45627Published

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, the unauthenticated GET /api/app-images/logo endpoint reflects a user-supplied color query parameter into the body of an SVG document via…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-46509Published

deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain proto/constructor/prototype. The property path must not be exposed as user input. This vulnerabili…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8779Published

A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack c…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8780Published

A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack ma…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8781Published

A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted element is the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched rem…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8782Published

A weakness has been identified in omec-project amf up to 2.1.3-dev. This affects an unknown function of the file ngap/handler.go of the component NGAP Message Handler. This manipulation causes null pointer dereference. Remote exploitation o…

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-8783Published

A security vulnerability has been detected in omec-project amf up to 2.1.3-dev. This impacts the function UERadioCapabilityCheckResponse of the file ngap/dispatcher.go. Such manipulation leads to null pointer dereference. The attack can be …

nvd ·

CVSS 4.0 · [email protected] · Secondary 2.1 · CVSS 3.1 · [email protected] · Secondary 4.3 · CVSS 2.0 · [email protected] · Secondary 4.0Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-116488Published

NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

cve-program ·

Vendor product: mcuxsdk-middleware-usb

CVSS 4.0 7.0 · CVSS 3.1 6.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116487Published

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

cve-program ·

Vendor product: mcuxsdk-middleware-usb

CVSS 4.0 5.1 · CVSS 3.1 4.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116485Published

danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

cve-program ·

Vendor product: danmu_api

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116216Published

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 6.9 · CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116215Published

MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116214Published

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

cve-program ·

Vendor product: maccms10 · Vendor product: maccms10

CVSS 4.0 9.3 · CVSS 3.1 9.1Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116212Published

Webasyst Framework through 4.4.0 Stored XSS via Photos Album URL

cve-program ·

Vendor product: Webasyst Framework

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116210Published

Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

cve-program ·

Vendor product: Webasyst Framework

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-78850Published

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted …

cve-program ·

Vendor product: n/a

Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116281Published

Kameleo Profile Controller t.cs ListProfiles information disclosure

cve-program ·

Vendor product: Kameleo

CVSS 4.0 4.8 · CVSS 3.1 3.3 · CVSS 3.0 3.3 · CVSS 2.0 1.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113874Published

SmileCDR HAPI FHIR trusted tenant partition override

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 8.1 · CVSS 4.0 8.6Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113876Published

SmileCDR HAPI FHIR unauthorized read

cve-program ·

Vendor product: HAPI FHIR

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113873Published

SmileCDR HAPI FHIR improper data decompression

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 7.5 · CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-113875Published

SmileCDR HAPI FHIR unauthorized read via subscription

cve-program ·

Vendor product: HAPI FHIR

CVSS 3.1 3.1 · CVSS 4.0 2.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115948Published

WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: media-library-assistant

CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115951Published

WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: lazy-load-for-videos

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115950Published

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: better-post-filter-widgets-for-elementor

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115954Published

WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 5.4Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115953Published

WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: geo-mashup

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115608Published

WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

cve-program ·

https://crocoblock.com: jet-engine

CVSS 3.1 8.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115594Published

WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: media-library-assistant

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114707Published

WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-elements

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115961Published

WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: b-slider

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115956Published

WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: panorama

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115955Published

WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: advanced-post-block

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115960Published

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woosquare

CVSS 3.1 4.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115959Published

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: woosquare

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-115595Published

WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: contact-form-by-supsystic

CVSS 3.1 5.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-114708Published

WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://crocoblock.com: jet-smart-filters

CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116280Published

Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery

cve-program ·

Vendor product: Kameleo

CVSS 4.0 5.1 · CVSS 3.1 5.5 · CVSS 3.0 5.5 · CVSS 2.0 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110474Published

Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

cve-program ·

Vendor product: Agentic AI Call Centre

CVSS 4.0 8.7Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116492Published

Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

cve-program ·

Vendor product: crm

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-110475Published

Improper Authentication Vulnerability in CreditNirvana Collections Platform

cve-program ·

Vendor product: CreditNirvana Collections Platform (CollectionWorkz)

CVSS 4.0 9.3Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-116274Published

JIZHICMS Front-end Order OrderController.php pay improper authorization

cve-program ·

Vendor product: JIZHICMS

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 26 Oct 2026Recorded 26 Oct 2026

CVE-2026-44720Published

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditio…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.9Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45137Published

Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to accept any program id when requiring the system program id, causing false a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-45152Published

uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c. Because the check fiel…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.8Source modified 26 Oct 2026Recorded 27 Oct 2026

CVE-2026-48779Published

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vuln…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5 · CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.5Source modified 26 Oct 2026Recorded 27 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.