2026-10-222026-10-22T15:11:23.434409+09:00OK135541250Only the verified public snapshot's current item set is provided. This endpoint is not an exhaustive CVE archive.Original advisory content and licensing remain with their publishers; no blanket redistribution license is claimed.Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO``` ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==========================================GitHub Advisoryhttps://github.com/advisories/GHSA-332p-7hrc-92wf2026-10-22CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonStorybook: Missing origin validation in Storybook preview allows code injection from malicious websites**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exGitHub Advisoryhttps://github.com/advisories/GHSA-f2ph-cmg5-wxc82026-10-22CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPillow: Argument Injection in Ghostscript call, potentially leading into RCE### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainableGitHub Advisoryhttps://github.com/advisories/GHSA-w889-685w-c8fh2026-10-22CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonAn issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9,An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1102642026-10-22CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabA flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/proA flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has beeNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1145752026-10-22CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDOpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop aOpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persisNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146612026-10-22CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDPillow: Infinite loop in MIC n_frames when the embedded TIFF``` ============================================================================ Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ===========================================GitHub Advisoryhttps://github.com/advisories/GHSA-22hg-r758-rrw92026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: NULL dereference in ImagingExpand via rank filters on zero-size images``` ============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ===========================================GitHub Advisoryhttps://github.com/advisories/GHSA-27h8-gf7j-v5hc2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonOpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs## Summary The OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A `WorkflowRun`'s membership in a project and component is carrGitHub Advisoryhttps://github.com/advisories/GHSA-46r4-q7wv-32fc2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryMoov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationExclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check. For a chain of nested elements that each declare manyGitHub Advisoryhttps://github.com/advisories/GHSA-5588-rp99-5fjh2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub Advisoryvirtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST### Impact zsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so zsh gets the raw value. With the `PROMPT_SUBST` optGitHub Advisoryhttps://github.com/advisories/GHSA-5vjq-rrrf-7h2q2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPillow: APNG background disposal allocates full canvas before decompression bomb check``` ============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==========================GitHub Advisoryhttps://github.com/advisories/GHSA-5xm2-6676-qcp92026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: Double free in ImagingScaleAffine on calloc failure via Image.transform``` ============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==================================GitHub Advisoryhttps://github.com/advisories/GHSA-7mwm-ghpf-9vrm2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonvirtualenv activation scripts run code from a path that contains a placeholder name### Impact `ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quotedGitHub Advisoryhttps://github.com/advisories/GHSA-8rjx-v5ww-45pp2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub Advisoryvirtualenv activate.fish runs commands from a path or prompt with a backslash before a quote### Impact `FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\'` inside single quotes as an escaped quote and `\GitHub Advisoryhttps://github.com/advisories/GHSA-c947-3pg5-gm8q2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub Advisoryvirtualenv: Generated POSIX console launchers interpret destination paths as shell syntax## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper.GitHub Advisoryhttps://github.com/advisories/GHSA-c978-59m8-c77v2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPillow: NULL pointer dereference in Image.merge via an unvalidated band 0### Summary `Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain `Image.open()` followed by a loadGitHub Advisoryhttps://github.com/advisories/GHSA-cp9v-662q-vvx92026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle``` ============================================================================ Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages() Commit: a707c6b21c313880d0771e54965d142dd42358b6 =======================================GitHub Advisoryhttps://github.com/advisories/GHSA-f2g6-542v-9j582026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: MSP RLE decoder expands a tiny file into unbounded memory### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. ### Details The MSP decoder writes eacGitHub Advisoryhttps://github.com/advisories/GHSA-gg2r-wvfm-q9rx2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: Invalid free in FreeType glyph rendering when a stroker is active### Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If `FT_Load_Glyph` fails for a glyph, the cleanup path calls `FT_Done_Glyph` on the `glyph` variable. That variable is not initialized before the first measurement loop, and in tGitHub Advisoryhttps://github.com/advisories/GHSA-j4m9-6w36-pw472026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)``` ============================================================================ Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) Location: src/PIL/PdfParser.py:629 in next_object_id() Commit: a707c6b21c313880d0771e54965d142dd42358b6 =====================================================GitHub Advisoryhttps://github.com/advisories/GHSA-jg86-v3jv-hrpm2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonvirtualenv bash activate runs commands from an environment name with a backslash before $### Summary The bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a backslash in the name undoes the escaping and a name containing `\$(...)` runs as commands in the user's shell each time bash draws the prompt. ### Affected area `src/virtuaGitHub Advisoryhttps://github.com/advisories/GHSA-vxj4-q4g9-crj72026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags``` ============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImaging_LibTiffEncoderNew() Commit: a707c6b21c313880d0771e54965d142dd42358b6 =====================================GitHub Advisoryhttps://github.com/advisories/GHSA-xvh5-g6gv-559v2026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certaGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externaNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1122122026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuGitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interactNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-157232026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabWWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator acWWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and acNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146332026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTraefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. UnautTraefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client certNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146352026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTraefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthroTraefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry pNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146362026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDKubernetesNGINXTraefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/NTraefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connecNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146372026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTraefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tTraefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its owNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146382026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDKubernetesNGINXTraefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: NegTraefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separatNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146392026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTraefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied STraefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146402026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDKubernetesNGINXTraefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTranspTraefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146422026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGrav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain superGrav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the inNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146582026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGrav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directorGrav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. AuthenticateNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146592026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGrav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrGrav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStoraNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146602026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDObot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosinObot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the resNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146622026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDVyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their namesVyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-inflNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146632026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDFrappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to propeFrappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer queNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146642026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() usedRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part heaNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147162026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploitRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147202026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed withRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing thNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147242026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted aRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates wNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147272026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDHAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING fHAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot beNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1103532026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDHAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunHAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1103542026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcuRoundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified aNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147302026-10-22HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instanGitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egresNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1035152026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a mergGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could haveNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1057112026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under cerGitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal responsNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1057772026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certainGitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1123262026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain cGitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validaNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1123782026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabA security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the componentA security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1145742026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file basRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause filesNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147142026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certaGitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create woNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-126642026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could haveGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects acrNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-133192026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain cGitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access conNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-142882026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabGitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instaGitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-162552026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGitLabA vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation oA vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather highNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1145762026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDA vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component InseA vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1145772026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDPHPWWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirecWWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146342026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTraefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connecTraefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over oNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146412026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTraefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks becTraefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router ruleNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146562026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDGrav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials throughGrav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1146572026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password pluginRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a passwNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147152026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. TRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequenceNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147172026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by aRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such asNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147182026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The pluRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside thatNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147192026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the actionRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated aNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147212026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat anRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule werNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147222026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_imageRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147232026-10-22LOWfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters onRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated atNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147252026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decoRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147262026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtmlRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147282026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDInsertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affectsInsertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-166482026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This iImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-811632026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849102026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSSImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849112026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versioMissing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849122026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849132026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849142026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issueImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849152026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849162026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalIncorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 tIncorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849172026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment AImproper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849182026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal ImageImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849192026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDJavaScriptDrupalIncorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versIncorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849202026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions:Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849212026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows AuthenticaAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849232026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP VeImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-849242026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL InjecImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879362026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. ThisURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879372026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affecImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879382026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affecImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879392026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalUse of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control SecurityUse of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879402026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalVulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879412026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affecImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879422026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versionsMissing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879432026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - SeImproper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879442026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affectsURL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879452026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalObservable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versioObservable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879462026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO -Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879472026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-SiteImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879482026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-SiteImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879492026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalUse of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - SeUse of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879502026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalInsecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SInsecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879512026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalAuthentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affeAuthentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879522026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalServer-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - SeServer-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879532026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879542026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 tMissing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-879552026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform verImproper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963552026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 toIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963562026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affectsImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963572026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). ThiImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963582026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). ThiImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963592026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). ThiImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963602026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). ThiImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963612026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). ThiImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963622026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963632026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963642026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalAllocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: fromAllocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963652026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 toIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963662026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963672026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affectsImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963682026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalUse of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control SecurityUse of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963692026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalIncorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, fromIncorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963702026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalPrivilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963712026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalInsufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963722026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 toIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963732026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalCross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: fCross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963742026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963752026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. ThisImproper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963762026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalAllocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects CombinedAllocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963772026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection.Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963782026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affeImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963792026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963802026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This iImproper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963822026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalIncorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963842026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. ThAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963852026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963862026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affectsAuthentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963872026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalCross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - LCross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963882026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalPrivilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11yPrivilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963902026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalMissing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963912026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalImproper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEdImproper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963922026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 toIncorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-963982026-10-22UNASSESSEDfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDrupalRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attrRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user'sNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147292026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcssRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attackeNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147312026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a logNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1147322026-10-22MODERATEfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDPHP 8.2.35 Released!21 Oct 2026 PHP 8.2.35 Released! The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraPHPhttps://www.php.net/archive/2026.php2026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownPHPNVDPHPPHP 8.2.35 Released!21 Oct 2026 PHP 8.2.35 Released! The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraPHPhttps://www.php.net/archive/2026.php2026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownPHPNVDPHPcertifi bundles emSign root CAs with compromised intermediate CA keysCertifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue vaGitHub Advisoryhttps://github.com/advisories/GHSA-6q48-6c7w-9gw22026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPillow: Heap buffer overflow in ImagingJpegDecode## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.scaGitHub Advisoryhttps://github.com/advisories/GHSA-8g5g-8vmr-97822026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonuv's bundled CA store trusts an emSign root whose intermediate CA keys are compromisedBy default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attaGitHub Advisoryhttps://github.com/advisories/GHSA-hq85-5cpj-mr622026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryvLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clientvLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140532026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknown0.00462NVDTrigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass becaTrigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140872026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknown0.00346NVDDockerHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surfHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shellNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141082026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknown0.00357NVDBest Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installationsBest Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypaNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141192026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknown0.00428NVDSQL ServerA security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewaA security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attacNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1137442026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknown0.00622NVDIn OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorIn OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual ownerNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-711952026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknown0.00484NVDSensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-870952026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDPHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by suPHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1144032026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDPHPUnrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue aUnrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1118322026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDUnrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue afUnrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1118342026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows BliImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1118522026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDLagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allLagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the facNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1137882026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDKubernetesAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducteAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulneNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-200432026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDA vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco EA vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root. This vulnerability is due to the use of persistent cookies. AdditioNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-764662026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime CollaborationAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&ampNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-764732026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime CollaborationAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&ampNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-764742026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime CollaborationAs part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&ampNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-764752026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is inteApache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed thNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1058692026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApacheGStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary codeGStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depenNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1111832026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDLocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery confLocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those inteNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1144932026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDMikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by reMikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts withoutNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-890352026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but neverApache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, NVDhttps://nvd.nist.gov/vuln/detail/CVE-2025-316992026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApacheApache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HApache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the followinNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1059442026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApacheApache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuraApache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users aNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1118132026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApacheApache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-outApache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1118162026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApacheApache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affecApache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1118112026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDApacheMissing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creatiNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1124082026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDPythonSentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjsSentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path wNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141392026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDJavaScriptReactPillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode whilPillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-966392026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDPythonA security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the coA security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. ThNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1143822026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDA weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the componeA weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploiNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1143832026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDLaravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted nLaravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing aNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1145092026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDLaravelVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versiVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-914032026-10-21CRITICALfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDOracleJavaMCP TypeScript SDK: Experimental tasks were not tied to the session that created them### Summary In affected versions, the experimental tasks feature (`taskStore`) did not check which session created a task. Clients sharing one `InMemoryTaskStore` could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a redeGitHub Advisoryhttps://github.com/advisories/GHSA-22jm-h49p-29qw2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryJavaScriptMCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`. No credentials are neGitHub Advisoryhttps://github.com/advisories/GHSA-46jr-4wx8-v4532026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryJavaScriptA2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixThe GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connectioGitHub Advisoryhttps://github.com/advisories/GHSA-4fpj-g9jf-9rgg2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryJavaAndroidlaunch-editor: `fs.existsSync()` existence check can be bypassed on Windows### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious fGitHub Advisoryhttps://github.com/advisories/GHSA-587h-7wmj-h5pm2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryWindowsPillow: Out-of-bounds access in _imagingmorph on a zero-width image### Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process craGitHub Advisoryhttps://github.com/advisories/GHSA-58r4-6rv3-gfh82026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS``` ============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==================================GitHub Advisoryhttps://github.com/advisories/GHSA-65qm-jvmh-6pqg2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export## Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`. The affected import API routes invoke: `self.apos.http.bigUploadMiddleware()` before the actual import handler performs its authentication check. BeGitHub Advisoryhttps://github.com/advisories/GHSA-86wm-68pq-5jwq2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryAIOHTTP: File descriptor exhaustion in multipart requests### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handler uses `Request.post()`, it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.GitHub Advisoryhttps://github.com/advisories/GHSA-9xw5-w5jj-pvcg2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels``` ============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in _decodeTile() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ====================================GitHub Advisoryhttps://github.com/advisories/GHSA-c6hw-5grf-ff962026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonmarkdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, coGitHub Advisoryhttps://github.com/advisories/GHSA-gfr2-rv44-r23c2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryMCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another### Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one `McpServer` or `Server` instance. Messages were matched to a connection by JSON-RPC `id` aloneGitHub Advisoryhttps://github.com/advisories/GHSA-jm63-cq47-j5jp2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryJavaScriptPillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)### Summary When an application appends to an existing PDF with `Image.save(..., format="PDF", append=True)`, Pillow parses that file with `PdfParser`. Two recursive parsers have no effective bound. `linearize_page_tree` follows `/Kids` with no visited set or depth limit, so a cyclic or duplicated pGitHub Advisoryhttps://github.com/advisories/GHSA-p4wg-p73j-c5282026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT valGitHub Advisoryhttps://github.com/advisories/GHSA-pchr-8j38-3x4p2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonPillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips``` ============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in _decodeStrip() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ======================================GitHub Advisoryhttps://github.com/advisories/GHSA-q45j-58j2-45rg2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryPythonA2A Java SDK has a fail-open default task authorizationDraft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships._ --- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-serverGitHub Advisoryhttps://github.com/advisories/GHSA-qw47-mcm5-934w2026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownGitHub AdvisoryJavaVyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear insVyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can returNVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-372862026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDVyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passeVyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compNVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-372872026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDVyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a funcVyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contNVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-480182026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDVyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are perforVyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can havNVDhttps://nvd.nist.gov/vuln/detail/CVE-2021-480202026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDAstral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of sAstral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim,NVDhttps://nvd.nist.gov/vuln/detail/CVE-2025-714372026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDImproper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security PlatformImproper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injectionNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1050442026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDA vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvaluA vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be iniNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1137362026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDFreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLeFreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the cNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140422026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDFreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocatesFreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP sNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140432026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDFreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format(FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small fNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140452026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDFreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChaFreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client prNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140462026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDFreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates whenFreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wronNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140472026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDvLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. UnauvLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140502026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDvLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread latevLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversizeNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140512026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDvLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct requevLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values toNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140522026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDvLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlledvLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match caNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140542026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDvLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor paramevLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, INVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140552026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to executeArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140592026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDSvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticateSvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnelNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140632026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDWindowsTrigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholderTrigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip tabNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140652026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do notTrigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140662026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token hTrigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation hisNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140672026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block rTrigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140682026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the envirTrigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key caNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140692026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authentTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's scheduNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140782026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a rNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140812026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 sTrigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140822026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenantsTrigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140832026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter iTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key witNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140842026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belongTrigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140852026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers toTrigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140882026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-codeTrigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then rNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140892026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaTrigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, cNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140902026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDTrigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runPTrigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment ofNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140922026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft aDulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code exeNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140942026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDWindowsDulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referentiDulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-fiNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140952026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary filDulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so reNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140962026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outsideDulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a dNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140972026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDDulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktDulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1140982026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDadm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP fileadm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processeNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141022026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDNode.jsadm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives wadm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causinNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141042026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLMHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141062026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as roHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subproceNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141072026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDuv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scruv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowiNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141092026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDAstral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversalAstral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to deleNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141102026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDsharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditionsharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may rNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141112026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDSharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplyiSharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141122026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDLinuxSharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CSharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to procNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141132026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVDVyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, iVyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrongNVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-1141172026-10-21HIGHfalseNOT_CONFIRMEDUNREVIEWEDunknownNVD