{"advisories":[{"cves":[],"epss":null,"id":"GHSA-332p-7hrc-92wf","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Location: src/libImaging/TiffDecode.c:94 in _tiffWriteProc() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==========================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","url":"https://github.com/advisories/GHSA-332p-7hrc-92wf"},{"cves":[],"epss":null,"id":"GHSA-f2ph-cmg5-wxc8","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"**Summary:** A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of ex","technologies":[],"title":"Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites","url":"https://github.com/advisories/GHSA-f2ph-cmg5-wxc8"},{"cves":[],"epss":null,"id":"GHSA-w889-685w-c8fh","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary `PIL.EpsImagePlugin.Ghostscript()` builds the Ghostscript command line using the input file path (`fp.name`) **without sanitization**, placing it at `-f <infile>`. A filename beginning with `-` is interpreted by Ghostscript as an option, giving command-line argument injection; chainable","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","url":"https://github.com/advisories/GHSA-w889-685w-c8fh"},{"cves":[],"epss":null,"id":"CVE-2026-110264","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to exec","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9,","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110264"},{"cves":[],"epss":null,"id":"CVE-2026-114575","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has bee","technologies":[],"title":"A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/pro","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114575"},{"cves":[],"epss":null,"id":"CVE-2026-114661","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persis","technologies":[],"title":"OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop a","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114661"},{"cves":[],"epss":null,"id":"GHSA-22hg-r758-rrw9","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ Infinite loop in MIC n_frames when the embedded TIFF has 3+ IFDs Location: src/PIL/MicImagePlugin.py:86 in MicImageFile.tell() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ===========================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Infinite loop in MIC n_frames when the embedded TIFF","url":"https://github.com/advisories/GHSA-22hg-r758-rrw9"},{"cves":[],"epss":null,"id":"GHSA-27h8-gf7j-v5hc","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ NULL dereference in ImagingExpand via rank filters on zero-size images Location: src/libImaging/Filter.c:79 in ImagingExpand() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ===========================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images","url":"https://github.com/advisories/GHSA-27h8-gf7j-v5hc"},{"cves":[],"epss":null,"id":"GHSA-46r4-q7wv-32fc","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"## Summary The OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A `WorkflowRun`'s membership in a project and component is carr","technologies":[],"title":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs","url":"https://github.com/advisories/GHSA-46r4-q7wv-32fc"},{"cves":[],"epss":null,"id":"GHSA-5588-rp99-5fjh","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"Exclusive XML canonicalization (`http://www.w3.org/2001/10/xml-exc-c14n#`) in `github.com/moov-io/signedxml` copied the entire accumulated namespace map at every node during `ValidateReferences()`, before any reference digest or signature check. For a chain of nested elements that each declare many","technologies":[],"title":"Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization","url":"https://github.com/advisories/GHSA-5588-rp99-5fjh"},{"cves":[],"epss":null,"id":"GHSA-5vjq-rrrf-7h2q","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Impact zsh users activate an environment with the bash `activate` script, which puts the environment name into `PS1`. Since 21.13.0 the script escapes backslashes, dollar signs and backticks in that name, but only when `BASH_VERSION` is set, so zsh gets the raw value. With the `PROMPT_SUBST` opt","technologies":[],"title":"virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST","url":"https://github.com/advisories/GHSA-5vjq-rrrf-7h2q"},{"cves":[],"epss":null,"id":"GHSA-5xm2-6676-qcp9","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ APNG background disposal allocates full canvas before decompression bomb check Location: src/PIL/PngImagePlugin.py:1000 in PngImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==========================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: APNG background disposal allocates full canvas before decompression bomb check","url":"https://github.com/advisories/GHSA-5xm2-6676-qcp9"},{"cves":[],"epss":null,"id":"GHSA-7mwm-ghpf-9vrm","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ Double free in ImagingScaleAffine on calloc failure via Image.transform Location: src/libImaging/Geometry.c:866 in ImagingScaleAffine() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform","url":"https://github.com/advisories/GHSA-7mwm-ghpf-9vrm"},{"cves":[],"epss":null,"id":"GHSA-8rjx-v5ww-45pp","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Impact `ViaTemplateActivator.instantiate_template` replaces the placeholders in an activation template one key at a time, each across the whole text. When a value that it already substituted and quoted contains the name of a later placeholder, the later pass rewrites that name inside the quoted","technologies":[],"title":"virtualenv activation scripts run code from a path that contains a placeholder name","url":"https://github.com/advisories/GHSA-8rjx-v5ww-45pp"},{"cves":[],"epss":null,"id":"GHSA-c947-3pg5-gm8q","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Impact `FishActivator` defines no `quote()`, so it inherits `ViaTemplateActivator.quote`, which returns `shlex.quote(string)`. That function follows POSIX `sh` rules, where a backslash inside single quotes stays a literal character. fish reads `\\'` inside single quotes as an escaped quote and `\\","technologies":[],"title":"virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote","url":"https://github.com/advisories/GHSA-c947-3pg5-gm8q"},{"cves":[],"epss":null,"id":"GHSA-c978-59m8-c77v","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"## Summary A destination path supplied to virtualenv can be interpreted as shell syntax by a generated POSIX console launcher. The app-data seeder and pip delegate launcher generation to distlib but supply the interpreter path in a form that does not preserve it as literal data in the shell wrapper.","technologies":[],"title":"virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax","url":"https://github.com/advisories/GHSA-c978-59m8-c77v"},{"cves":[],"epss":null,"id":"GHSA-cp9v-662q-vvx9","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary `Image.merge()` checks the mode of every input band except band 0. If band 0 is a single-band `I` or `F` image, the native merge routine reads a pixel pointer that is NULL for those modes and the process crashes. The IPTC plugin reaches this from a plain `Image.open()` followed by a load","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","url":"https://github.com/advisories/GHSA-cp9v-662q-vvx9"},{"cves":[],"epss":null,"id":"GHSA-f2g6-542v-9j58","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle Location: src/PIL/PdfParser.py:505 in PdfParser.rewrite_pages() Commit: a707c6b21c313880d0771e54965d142dd42358b6 =======================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle","url":"https://github.com/advisories/GHSA-f2g6-542v-9j58"},{"cves":[],"epss":null,"id":"GHSA-gg2r-wvfm-q9rx","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary The MSP RLE decoder expands run-length data into an in-memory buffer with no cap tied to the declared image size. A small file that passes the pixel-count check can force hundreds of megabytes or more of allocation when the application loads pixels. ### Details The MSP decoder writes eac","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","url":"https://github.com/advisories/GHSA-gg2r-wvfm-q9rx"},{"cves":[],"epss":null,"id":"GHSA-j4m9-6w36-pw47","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary When text is drawn with a non-zero stroke width, Pillow creates a FreeType stroker and then loads each glyph. If `FT_Load_Glyph` fails for a glyph, the cleanup path calls `FT_Done_Glyph` on the `glyph` variable. That variable is not initialized before the first measurement loop, and in t","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Invalid free in FreeType glyph rendering when a stroker is active","url":"https://github.com/advisories/GHSA-j4m9-6w36-pw47"},{"cves":[],"epss":null,"id":"GHSA-jg86-v3jv-hrpm","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) Location: src/PIL/PdfParser.py:629 in next_object_id() Commit: a707c6b21c313880d0771e54965d142dd42358b6 =====================================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)","url":"https://github.com/advisories/GHSA-jg86-v3jv-hrpm"},{"cves":[],"epss":null,"id":"GHSA-vxj4-q4g9-crj7","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary The bash `activate` script escapes the environment name for only one of the two passes bash makes over `PS1`, so a backslash in the name undoes the escaping and a name containing `\\$(...)` runs as commands in the user's shell each time bash draws the prompt. ### Affected area `src/virtua","technologies":[],"title":"virtualenv bash activate runs commands from an environment name with a backslash before $","url":"https://github.com/advisories/GHSA-vxj4-q4g9-crj7"},{"cves":[],"epss":null,"id":"GHSA-xvh5-g6gv-559v","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImaging_LibTiffEncoderNew() Commit: a707c6b21c313880d0771e54965d142dd42358b6 =====================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags","url":"https://github.com/advisories/GHSA-xvh5-g6gv-559v"},{"cves":[],"epss":null,"id":"CVE-2026-112212","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externa","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certa","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112212"},{"cves":[],"epss":null,"id":"CVE-2026-15723","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interact","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAu","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15723"},{"cves":[],"epss":null,"id":"CVE-2026-114633","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers can submit requests to confirmDeleteUser.json.php or userAddNew.json.php targeting administrators to delete their videos and ac","technologies":[],"title":"WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator ac","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114633"},{"cves":[],"epss":null,"id":"CVE-2026-114635","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client cert","technologies":[],"title":"Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unaut","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114635"},{"cves":[],"epss":null,"id":"CVE-2026-114636","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry p","technologies":[{"group":"infra","id":"kubernetes","label":"Kubernetes"},{"group":"infra","id":"nginx","label":"NGINX"}],"title":"Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthro","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114636"},{"cves":[],"epss":null,"id":"CVE-2026-114637","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connec","technologies":[],"title":"Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/N","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114637"},{"cves":[],"epss":null,"id":"CVE-2026-114638","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its ow","technologies":[{"group":"infra","id":"kubernetes","label":"Kubernetes"},{"group":"infra","id":"nginx","label":"NGINX"}],"title":"Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-t","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114638"},{"cves":[],"epss":null,"id":"CVE-2026-114639","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separat","technologies":[],"title":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Neg","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114639"},{"cves":[],"epss":null,"id":"CVE-2026-114640","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated ","technologies":[{"group":"infra","id":"kubernetes","label":"Kubernetes"},{"group":"infra","id":"nginx","label":"NGINX"}],"title":"Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied S","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114640"},{"cves":[],"epss":null,"id":"CVE-2026-114642","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend ","technologies":[],"title":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransp","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114642"},{"cves":[],"epss":null,"id":"CVE-2026-114658","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated, and register the in","technologies":[],"title":"Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114658"},{"cves":[],"epss":null,"id":"CVE-2026-114659","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or page-level permissions rules. Authenticate","technologies":[],"title":"Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only director","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114659"},{"cves":[],"epss":null,"id":"CVE-2026-114660","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ directives in page frontmatter. When a user with page edit rights opens the page, directives calling setStora","technologies":[],"title":"Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitr","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114660"},{"cves":[],"epss":null,"id":"CVE-2026-114662","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the res","technologies":[],"title":"Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosin","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114662"},{"cves":[],"epss":null,"id":"CVE-2026-114663","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-infl","technologies":[],"title":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114663"},{"cves":[],"epss":null,"id":"CVE-2026-114664","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer que","technologies":[],"title":"Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to prope","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114664"},{"cves":[],"epss":null,"id":"CVE-2026-114716","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part hea","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114716"},{"cves":[],"epss":null,"id":"CVE-2026-114720","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the ","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114720"},{"cves":[],"epss":null,"id":"CVE-2026-114724","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing th","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114724"},{"cves":[],"epss":null,"id":"CVE-2026-114727","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates w","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted a","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114727"},{"cves":[],"epss":null,"id":"CVE-2026-110353","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be","technologies":[],"title":"HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING f","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110353"},{"cves":[],"epss":null,"id":"CVE-2026-110354","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without ","technologies":[],"title":"HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chun","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110354"},{"cves":[],"epss":null,"id":"CVE-2026-114730","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified a","technologies":[],"title":"Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcu","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114730"},{"cves":[],"epss":null,"id":"CVE-2026-103515","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egres","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instan","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103515"},{"cves":[],"epss":null,"id":"CVE-2026-105711","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merg","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105711"},{"cves":[],"epss":null,"id":"CVE-2026-105777","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal respons","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under cer","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105777"},{"cves":[],"epss":null,"id":"CVE-2026-112326","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to impro","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112326"},{"cves":[],"epss":null,"id":"CVE-2026-112378","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side valida","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain c","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112378"},{"cves":[],"epss":null,"id":"CVE-2026-114574","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclos","technologies":[],"title":"A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114574"},{"cves":[],"epss":null,"id":"CVE-2026-114714","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file bas","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114714"},{"cves":[],"epss":null,"id":"CVE-2026-12664","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create wo","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certa","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12664"},{"cves":[],"epss":null,"id":"CVE-2026-13319","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects acr","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13319"},{"cves":[],"epss":null,"id":"CVE-2026-14288","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access con","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain c","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14288"},{"cves":[],"epss":null,"id":"CVE-2026-16255","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the ","technologies":[{"group":"devops","id":"gitlab","label":"GitLab"}],"title":"GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the insta","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16255"},{"cves":[],"epss":null,"id":"CVE-2026-114576","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high","technologies":[],"title":"A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation o","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114576"},{"cves":[],"epss":null,"id":"CVE-2026-114577","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql inj","technologies":[{"group":"runtime","id":"php","label":"PHP"}],"title":"A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Inse","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114577"},{"cves":[],"epss":null,"id":"CVE-2026-114634","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal G","technologies":[],"title":"WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114634"},{"cves":[],"epss":null,"id":"CVE-2026-114641","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over o","technologies":[],"title":"Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114641"},{"cves":[],"epss":null,"id":"CVE-2026-114656","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule","technologies":[],"title":"Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks bec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114656"},{"cves":[],"epss":null,"id":"CVE-2026-114657","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image ","technologies":[],"title":"Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114657"},{"cves":[],"epss":null,"id":"CVE-2026-114715","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the account search result returned by the Modoboa API instead of matching the authenticated user, so a passw","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114715"},{"cves":[],"epss":null,"id":"CVE-2026-114717","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequence","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. T","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114717"},{"cves":[],"epss":null,"id":"CVE-2026-114718","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114718"},{"cves":[],"epss":null,"id":"CVE-2026-114719","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plu","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114719"},{"cves":[],"epss":null,"id":"CVE-2026-114721","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated a","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114721"},{"cves":[],"epss":null,"id":"CVE-2026-114722","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule wer","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114722"},{"cves":[],"epss":null,"id":"CVE-2026-114723","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"LOW","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was process","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114723"},{"cves":[],"epss":null,"id":"CVE-2026-114725","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated at","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters on","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114725"},{"cves":[],"epss":null,"id":"CVE-2026-114726","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequ","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::deco","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114726"},{"cves":[],"epss":null,"id":"CVE-2026-114728","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for ","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114728"},{"cves":[],"epss":null,"id":"CVE-2026-16648","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16648"},{"cves":[],"epss":null,"id":"CVE-2026-81163","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This i","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81163"},{"cves":[],"epss":null,"id":"CVE-2026-84910","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84910"},{"cves":[],"epss":null,"id":"CVE-2026-84911","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84911"},{"cves":[],"epss":null,"id":"CVE-2026-84912","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versio","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84912"},{"cves":[],"epss":null,"id":"CVE-2026-84913","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84913"},{"cves":[],"epss":null,"id":"CVE-2026-84914","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84914"},{"cves":[],"epss":null,"id":"CVE-2026-84915","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Component blocks allows Stored XSS. This issue","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84915"},{"cves":[],"epss":null,"id":"CVE-2026-84916","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84916"},{"cves":[],"epss":null,"id":"CVE-2026-84917","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 t","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84917"},{"cves":[],"epss":null,"id":"CVE-2026-84918","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment A","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84918"},{"cves":[],"epss":null,"id":"CVE-2026-84919","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.","technologies":[{"group":"runtime","id":"javascript","label":"JavaScript"},{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84919"},{"cves":[],"epss":null,"id":"CVE-2026-84920","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions vers","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84920"},{"cves":[],"epss":null,"id":"CVE-2026-84921","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions:","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84921"},{"cves":[],"epss":null,"id":"CVE-2026-84923","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentica","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84923"},{"cves":[],"epss":null,"id":"CVE-2026-84924","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Email Verification / SMS Verification / OTP Ve","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84924"},{"cves":[],"epss":null,"id":"CVE-2026-87936","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87936"},{"cves":[],"epss":null,"id":"CVE-2026-87937","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87937"},{"cves":[],"epss":null,"id":"CVE-2026-87938","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87938"},{"cves":[],"epss":null,"id":"CVE-2026-87939","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Feed Block allows Stored XSS. This issue affec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87939"},{"cves":[],"epss":null,"id":"CVE-2026-87940","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87940"},{"cves":[],"epss":null,"id":"CVE-2026-87941","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87941"},{"cves":[],"epss":null,"id":"CVE-2026-87942","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87942"},{"cves":[],"epss":null,"id":"CVE-2026-87943","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87943"},{"cves":[],"epss":null,"id":"CVE-2026-87944","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Se","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87944"},{"cves":[],"epss":null,"id":"CVE-2026-87945","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87945"},{"cves":[],"epss":null,"id":"CVE-2026-87946","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versio","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87946"},{"cves":[],"epss":null,"id":"CVE-2026-87947","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO -","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87947"},{"cves":[],"epss":null,"id":"CVE-2026-87948","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87948"},{"cves":[],"epss":null,"id":"CVE-2026-87949","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87949"},{"cves":[],"epss":null,"id":"CVE-2026-87950","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Se","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87950"},{"cves":[],"epss":null,"id":"CVE-2026-87951","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects S","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87951"},{"cves":[],"epss":null,"id":"CVE-2026-87952","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affe","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87952"},{"cves":[],"epss":null,"id":"CVE-2026-87953","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Se","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87953"},{"cves":[],"epss":null,"id":"CVE-2026-87954","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87954"},{"cves":[],"epss":null,"id":"CVE-2026-87955","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 t","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87955"},{"cves":[],"epss":null,"id":"CVE-2026-96355","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform ver","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96355"},{"cves":[],"epss":null,"id":"CVE-2026-96356","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96356"},{"cves":[],"epss":null,"id":"CVE-2026-96357","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Stored XSS. This issue affects","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96357"},{"cves":[],"epss":null,"id":"CVE-2026-96358","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). Thi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96358"},{"cves":[],"epss":null,"id":"CVE-2026-96359","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). Thi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96359"},{"cves":[],"epss":null,"id":"CVE-2026-96360","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). Thi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96360"},{"cves":[],"epss":null,"id":"CVE-2026-96361","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). Thi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96361"},{"cves":[],"epss":null,"id":"CVE-2026-96362","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). Thi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96362"},{"cves":[],"epss":null,"id":"CVE-2026-96363","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96363"},{"cves":[],"epss":null,"id":"CVE-2026-96364","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. This issue affects Webform versions: from 0.0.0 to 6","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96364"},{"cves":[],"epss":null,"id":"CVE-2026-96365","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96365"},{"cves":[],"epss":null,"id":"CVE-2026-96366","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96366"},{"cves":[],"epss":null,"id":"CVE-2026-96367","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96367"},{"cves":[],"epss":null,"id":"CVE-2026-96368","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Webform allows Stored XSS. This issue affects","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96368"},{"cves":[],"epss":null,"id":"CVE-2026-96369","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96369"},{"cves":[],"epss":null,"id":"CVE-2026-96370","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This issue affects Webform versions: from 0.0.0 to 6.2.12, from","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96370"},{"cves":[],"epss":null,"id":"CVE-2026-96371","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96371"},{"cves":[],"epss":null,"id":"CVE-2026-96372","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96372"},{"cves":[],"epss":null,"id":"CVE-2026-96373","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96373"},{"cves":[],"epss":null,"id":"CVE-2026-96374","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: from 0.0.0 to 2.0.3, from 2.1.0 to 2.1.5.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery. This issue affects Project Browser versions: f","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96374"},{"cves":[],"epss":null,"id":"CVE-2026-96375","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96375"},{"cves":[],"epss":null,"id":"CVE-2026-96376","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Special Elements used in an OS Command (\"OS Command Injection\") vulnerability in Drupal Cloud allows OS Command Injection. This","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96376"},{"cves":[],"epss":null,"id":"CVE-2026-96377","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined image style versions: from 0.0.0 to 1.0.7.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive Allocation. This issue affects Combined","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96377"},{"cves":[],"epss":null,"id":"CVE-2026-96378","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection. This issue affects Commerce Decoupled Checkout versions: from 1.0.0 to 1.8.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce Decoupled Checkout allows Object Injection.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96378"},{"cves":[],"epss":null,"id":"CVE-2026-96379","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affects CookieCuttr versions: from 2.0.0 to 2.0.3.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal CookieCuttr allows Stored XSS. This issue affe","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96379"},{"cves":[],"epss":null,"id":"CVE-2026-96380","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96380"},{"cves":[],"epss":null,"id":"CVE-2026-96382","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Diba carousel slider allows Stored XSS. This i","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96382"},{"cves":[],"epss":null,"id":"CVE-2026-96384","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96384"},{"cves":[],"epss":null,"id":"CVE-2026-96385","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3.2.0.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. Th","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96385"},{"cves":[],"epss":null,"id":"CVE-2026-96386","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue affects Smart Content versions: from 0.0.0 to 3.2.1.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96386"},{"cves":[],"epss":null,"id":"CVE-2026-96387","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96387"},{"cves":[],"epss":null,"id":"CVE-2026-96388","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - Live chat application versions: from 0.0.0 to 3.0.4.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request Forgery. This issue affects Tawk.to - L","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96388"},{"cves":[],"epss":null,"id":"CVE-2026-96390","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y Accessibility Checker versions: from 0.0.0 to 2.2.23, from 3.0.0 to 3.0.9.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege Escalation. This issue affects Editoria11y","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96390"},{"cves":[],"epss":null,"id":"CVE-2026-96391","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96391"},{"cves":[],"epss":null,"id":"CVE-2026-96392","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEd","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96392"},{"cves":[],"epss":null,"id":"CVE-2026-96398","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"UNASSESSED","source":"NVD","sources":["NVD"],"summary":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","technologies":[{"group":"cms","id":"drupal","label":"Drupal"}],"title":"Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96398"},{"cves":[],"epss":null,"id":"CVE-2026-114729","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attr","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114729"},{"cves":[],"epss":null,"id":"CVE-2026-114731","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacke","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114731"},{"cves":[],"epss":null,"id":"CVE-2026-114732","known_exploited":false,"published_date":"2026-10-22","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"MODERATE","source":"NVD","sources":["NVD"],"summary":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a log","technologies":[],"title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user log","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114732"},{"cves":[],"epss":null,"id":"CVE-2026-109618","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"PHP","sources":["PHP","NVD"],"summary":"21 Oct 2026 PHP 8.2.35 Released! The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encoura","technologies":[{"group":"runtime","id":"php","label":"PHP"}],"title":"PHP 8.2.35 Released!","url":"https://www.php.net/archive/2026.php"},{"cves":[],"epss":null,"id":"CVE-2026-109619","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"PHP","sources":["PHP","NVD"],"summary":"21 Oct 2026 PHP 8.2.35 Released! The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encoura","technologies":[{"group":"runtime","id":"php","label":"PHP"}],"title":"PHP 8.2.35 Released!","url":"https://www.php.net/archive/2026.php"},{"cves":[],"epss":null,"id":"GHSA-6q48-6c7w-9gw2","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. An attacker with one of the compromised keys can issue va","technologies":[],"title":"certifi bundles emSign root CAs with compromised intermediate CA keys","url":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2"},{"cves":[],"epss":null,"id":"GHSA-8g5g-8vmr-9782","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"## Summary `JpegImageFile.draft()` — which `Image.thumbnail()` calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks `self._size` and the tile extents to match, so `_setimage()` allocates a single-row decode buffer of `ceil(W/s)` samples. `ImagingJpegDecode()` sets `cinfo.sca","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Heap buffer overflow in ImagingJpegDecode","url":"https://github.com/advisories/GHSA-8g5g-8vmr-9782"},{"cves":[],"epss":null,"id":"GHSA-hq85-5cpj-mr62","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An atta","technologies":[],"title":"uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised","url":"https://github.com/advisories/GHSA-hq85-5cpj-mr62"},{"cves":[],"epss":0.00462,"id":"CVE-2026-114053","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in ","technologies":[],"title":"vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting client","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114053"},{"cves":[],"epss":0.00346,"id":"CVE-2026-114087","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then re","technologies":[{"group":"infra","id":"docker","label":"Docker"}],"title":"Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass beca","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114087"},{"cves":[],"epss":0.00357,"id":"CVE-2026-114108","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell","technologies":[],"title":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surf","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114108"},{"cves":[],"epss":0.00428,"id":"CVE-2026-114119","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypa","technologies":[{"group":"database","id":"sqlserver","label":"SQL Server"}],"title":"Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114119"},{"cves":[],"epss":0.00622,"id":"CVE-2026-113744","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attac","technologies":[],"title":"A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewa","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113744"},{"cves":[],"epss":0.00484,"id":"CVE-2026-71195","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner","technologies":[],"title":"In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers author","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71195"},{"cves":[],"epss":null,"id":"CVE-2026-87095","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.","technologies":[],"title":"Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87095"},{"cves":[],"epss":null,"id":"CVE-2026-114403","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enab","technologies":[{"group":"runtime","id":"php","label":"PHP"}],"title":"PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by su","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114403"},{"cves":[],"epss":null,"id":"CVE-2026-111832","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0.","technologies":[],"title":"Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue a","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111832"},{"cves":[],"epss":null,"id":"CVE-2026-111834","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4.","technologies":[],"title":"Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue af","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111834"},{"cves":[],"epss":null,"id":"CVE-2026-111852","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6.","technologies":[],"title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Bli","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111852"},{"cves":[],"epss":null,"id":"CVE-2026-113788","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fac","technologies":[{"group":"infra","id":"kubernetes","label":"Kubernetes"}],"title":"Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would all","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113788"},{"cves":[],"epss":null,"id":"CVE-2026-20043","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulne","technologies":[],"title":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducte","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20043"},{"cves":[],"epss":null,"id":"CVE-2026-76466","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root. This vulnerability is due to the use of persistent cookies. Additio","technologies":[],"title":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco E","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76466"},{"cves":[],"epss":null,"id":"CVE-2026-76473","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp","technologies":[],"title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76473"},{"cves":[],"epss":null,"id":"CVE-2026-76474","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp","technologies":[],"title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76474"},{"cves":[],"epss":null,"id":"CVE-2026-76475","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp","technologies":[],"title":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76475"},{"cves":[],"epss":null,"id":"CVE-2026-105869","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed th","technologies":[{"group":"infra","id":"apache","label":"Apache"}],"title":"Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is inte","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105869"},{"cves":[],"epss":null,"id":"CVE-2026-111183","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depen","technologies":[],"title":"GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111183"},{"cves":[],"epss":null,"id":"CVE-2026-114493","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those inte","technologies":[],"title":"LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery conf","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114493"},{"cves":[],"epss":null,"id":"CVE-2026-89035","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without","technologies":[],"title":"MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by re","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89035"},{"cves":[],"epss":null,"id":"CVE-2025-31699","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, ","technologies":[{"group":"infra","id":"apache","label":"Apache"}],"title":"Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31699"},{"cves":[],"epss":null,"id":"CVE-2026-105944","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the followin","technologies":[{"group":"infra","id":"apache","label":"Apache"}],"title":"Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an H","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105944"},{"cves":[],"epss":null,"id":"CVE-2026-111813","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users a","technologies":[{"group":"infra","id":"apache","label":"Apache"}],"title":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configura","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111813"},{"cves":[],"epss":null,"id":"CVE-2026-111816","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-fram","technologies":[{"group":"infra","id":"apache","label":"Apache"}],"title":"Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111816"},{"cves":[],"epss":null,"id":"CVE-2026-111811","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgr","technologies":[{"group":"infra","id":"apache","label":"Apache"}],"title":"Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affec","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111811"},{"cves":[],"epss":null,"id":"CVE-2026-112408","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112408"},{"cves":[],"epss":null,"id":"CVE-2026-114139","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel path w","technologies":[{"group":"runtime","id":"javascript","label":"JavaScript"},{"group":"framework","id":"react","label":"React"}],"title":"Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114139"},{"cves":[],"epss":null,"id":"CVE-2026-96639","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the ","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode whil","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96639"},{"cves":[],"epss":null,"id":"CVE-2026-114382","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results in stack-based buffer overflow. It is possible to launch the attack remotely. Th","technologies":[],"title":"A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the co","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114382"},{"cves":[],"epss":null,"id":"CVE-2026-114383","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploi","technologies":[],"title":"A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the compone","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114383"},{"cves":[],"epss":null,"id":"CVE-2026-114509","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing a","technologies":[{"group":"framework","id":"laravel","label":"Laravel"}],"title":"Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted n","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114509"},{"cves":[],"epss":null,"id":"CVE-2026-91403","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"CRITICAL","source":"NVD","sources":["NVD"],"summary":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.","technologies":[{"group":"vendor","id":"oracle","label":"Oracle"},{"group":"runtime","id":"java","label":"Java"}],"title":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91403"},{"cves":[],"epss":null,"id":"GHSA-22jm-h49p-29qw","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary In affected versions, the experimental tasks feature (`taskStore`) did not check which session created a task. Clients sharing one `InMemoryTaskStore` could list, read and cancel each other's tasks. Experimental tasks are deprecated. The 2026-07-28 specification replaced them with a rede","technologies":[{"group":"runtime","id":"javascript","label":"JavaScript"}],"title":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","url":"https://github.com/advisories/GHSA-22jm-h49p-29qw"},{"cves":[],"epss":null,"id":"GHSA-46jr-4wx8-v453","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`. No credentials are ne","technologies":[{"group":"runtime","id":"javascript","label":"JavaScript"}],"title":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","url":"https://github.com/advisories/GHSA-46jr-4wx8-v453"},{"cves":[],"epss":null,"id":"GHSA-4fpj-g9jf-9rgg","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connectio","technologies":[{"group":"runtime","id":"java","label":"Java"},{"group":"os","id":"android","label":"Android"}],"title":"A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix","url":"https://github.com/advisories/GHSA-4fpj-g9jf-9rgg"},{"cves":[],"epss":null,"id":"GHSA-587h-7wmj-h5pm","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in `\\\\..:line:column`. This removes the requirement that the attacker be able to place a file with a malicious f","technologies":[{"group":"os","id":"windows","label":"Windows"}],"title":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","url":"https://github.com/advisories/GHSA-587h-7wmj-h5pm"},{"cves":[],"epss":null,"id":"GHSA-58r4-6rv3-gfh8","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary A PPM or PGM file can declare a width of 0, which Pillow accepts, producing an image of size `(0, N)`. Passing that image to `ImageMorph.MorphOp.apply()` makes the native morphology code index a row buffer at `outrow[width - 1]`, which is `outrow[-1]` when the width is 0. The process cra","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","url":"https://github.com/advisories/GHSA-58r4-6rv3-gfh8"},{"cves":[],"epss":null,"id":"GHSA-65qm-jvmh-6pqg","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ GIF seek keeps rejected size after DecompressionBombError, allowing DoS Location: src/PIL/GifImagePlugin.py:293 in GifImageFile._seek() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ==================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","url":"https://github.com/advisories/GHSA-65qm-jvmh-6pqg"},{"cves":[],"epss":null,"id":"GHSA-86wm-68pq-5jwq","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"## Summary A potential unauthenticated denial-of-service vulnerability exists in the chunked import upload path used by `@apostrophecms/import-export`. The affected import API routes invoke: `self.apos.http.bigUploadMiddleware()` before the actual import handler performs its authentication check. Be","technologies":[],"title":"ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export","url":"https://github.com/advisories/GHSA-86wm-68pq-5jwq"},{"cves":[],"epss":null,"id":"GHSA-9xw5-w5jj-pvcg","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary An attacker can exhaust file descriptors with specially crafted multipart requests. ### Impact If a handler uses `Request.post()`, it may be possible for an attacker to use an unlimited number of file descriptors, potentially resulting in resource exhaustion.","technologies":[],"title":"AIOHTTP: File descriptor exhaustion in multipart requests","url":"https://github.com/advisories/GHSA-9xw5-w5jj-pvcg"},{"cves":[],"epss":null,"id":"GHSA-c6hw-5grf-ff96","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels Location: src/libImaging/TiffDecode.c:483 in _decodeTile() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ====================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","url":"https://github.com/advisories/GHSA-c6hw-5grf-ff96"},{"cves":[],"epss":null,"id":"GHSA-gfr2-rv44-r23c","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary A link reference definition whose label or title is never closed is O(n²) in markdown-it 15.0.2 with default options. Continuation lines are pulled lazily with str += lineContent in src/rules_block/reference.ts, and the subsequent charCodeAt and slice calls flatten the V8 cons-string, co","technologies":[],"title":"markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)","url":"https://github.com/advisories/GHSA-gfr2-rv44-r23c"},{"cves":[],"epss":null,"id":"GHSA-jm63-cq47-j5jp","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications to another client. This happened when clients shared one stateless transport, or one `McpServer` or `Server` instance. Messages were matched to a connection by JSON-RPC `id` alone","technologies":[{"group":"runtime","id":"javascript","label":"JavaScript"}],"title":"MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another","url":"https://github.com/advisories/GHSA-jm63-cq47-j5jp"},{"cves":[],"epss":null,"id":"GHSA-p4wg-p73j-c528","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"### Summary When an application appends to an existing PDF with `Image.save(..., format=\"PDF\", append=True)`, Pillow parses that file with `PdfParser`. Two recursive parsers have no effective bound. `linearize_page_tree` follows `/Kids` with no visited set or depth limit, so a cyclic or duplicated p","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","url":"https://github.com/advisories/GHSA-p4wg-p73j-c528"},{"cves":[],"epss":null,"id":"GHSA-pchr-8j38-3x4p","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"## Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 (ColorMap) with **768 SHORT val","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","url":"https://github.com/advisories/GHSA-pchr-8j38-3x4p"},{"cves":[],"epss":null,"id":"GHSA-q45j-58j2-45rg","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"``` ============================================================================ TiffDecode returns uninitialized memory as pixels for short JPEG strips Location: src/libImaging/TiffDecode.c:554 in _decodeStrip() Commit: a707c6b21c313880d0771e54965d142dd42358b6 ======================================","technologies":[{"group":"runtime","id":"python","label":"Python"}],"title":"Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips","url":"https://github.com/advisories/GHSA-q45j-58j2-45rg"},{"cves":[],"epss":null,"id":"GHSA-qw47-mcm5-934w","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"GitHub Advisory","sources":["GitHub Advisory"],"summary":"Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships._ --- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server","technologies":[{"group":"runtime","id":"java","label":"Java"}],"title":"A2A Java SDK has a fail-open default task authorization","url":"https://github.com/advisories/GHSA-qw47-mcm5-934w"},{"cves":[],"epss":null,"id":"CVE-2020-37286","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can retur","technologies":[],"title":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear ins","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37286"},{"cves":[],"epss":null,"id":"CVE-2020-37287","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the comp","technologies":[],"title":"Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passe","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37287"},{"cves":[],"epss":null,"id":"CVE-2021-48018","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the cont","technologies":[],"title":"Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a func","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48018"},{"cves":[],"epss":null,"id":"CVE-2021-48020","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can hav","technologies":[],"title":"Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are perfor","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48020"},{"cves":[],"epss":null,"id":"CVE-2025-71437","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim,","technologies":[],"title":"Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of s","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71437"},{"cves":[],"epss":null,"id":"CVE-2026-105044","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection","technologies":[],"title":"Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105044"},{"cves":[],"epss":null,"id":"CVE-2026-113736","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be ini","technologies":[],"title":"A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalu","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113736"},{"cves":[],"epss":null,"id":"CVE-2026-114042","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLength is smaller than the chunk size. A malicious RDP server can send a single well-formed Virtual Channel PDU to trigger the free and crash the c","technologies":[],"title":"FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocator when totalLe","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114042"},{"cves":[],"epss":null,"id":"CVE-2026-114043","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates a bit-packed buffer for PNGs with bit depth below 8, while winpr_bitmap_write_buffer() copies rows assuming one byte per pixel. A malicious RDP s","technologies":[],"title":"FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buffer() allocates","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114043"},{"cves":[],"epss":null,"id":"CVE-2026-114045","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small f","technologies":[],"title":"FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format(","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114045"},{"cves":[],"epss":null,"id":"CVE-2026-114046","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to crash the client pr","technologies":[],"title":"FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SCardGetStatusCha","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114046"},{"cves":[],"epss":null,"id":"CVE-2026-114047","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wron","technologies":[],"title":"FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114047"},{"cves":[],"epss":null,"id":"CVE-2026-114050","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving inst","technologies":[],"title":"vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unau","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114050"},{"cves":[],"epss":null,"id":"CVE-2026-114051","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread later dies on an uncaught VLLMValidationError while /health still returns 200. Unauthenticated remote attackers can send one request with an oversize","technologies":[],"title":"vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore input thread late","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114051"},{"cves":[],"epss":null,"id":"CVE-2026-114052","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct request-controlled mm_processor_kwargs value in an unbounded dictionary. Unauthenticated attackers can send distinct or oversized mel_config values to","technologies":[],"title":"vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every distinct reque","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114052"},{"cves":[],"epss":null,"id":"CVE-2026-114054","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match ca","technologies":[],"title":"vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114054"},{"cves":[],"epss":null,"id":"CVE-2026-114055","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parameters by supplying per-request mm_processor_kwargs. Attackers can set large image size, patch count, crop count, or frame count values in Isaac, I","technologies":[],"title":"vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor parame","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114055"},{"cves":[],"epss":null,"id":"CVE-2026-114059","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1","technologies":[],"title":"ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114059"},{"cves":[],"epss":null,"id":"CVE-2026-114063","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel","technologies":[{"group":"os","id":"windows","label":"Windows"}],"title":"SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticate","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114063"},{"cves":[],"epss":null,"id":"CVE-2026-114065","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip tab","technologies":[],"title":"Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114065"},{"cves":[],"epss":null,"id":"CVE-2026-114066","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/bat","technologies":[],"title":"Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114066"},{"cves":[],"epss":null,"id":"CVE-2026-114067","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token holders to obtain presigned S3 write URLs. End users can overwrite their own session's durable chat snapshot to forge the agent's conversation his","technologies":[],"title":"Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session token h","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114067"},{"cves":[],"epss":null,"id":"CVE-2026-114068","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run ","technologies":[],"title":"Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block r","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114068"},{"cves":[],"epss":null,"id":"CVE-2026-114069","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key ca","technologies":[],"title":"Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the envir","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114069"},{"cves":[],"epss":null,"id":"CVE-2026-114078","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedu","technologies":[],"title":"Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authent","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114078"},{"cves":[],"epss":null,"id":"CVE-2026-114081","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a r","technologies":[],"title":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickH","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114081"},{"cves":[],"epss":null,"id":"CVE-2026-114082","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim ","technologies":[],"title":"Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 s","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114082"},{"cves":[],"epss":null,"id":"CVE-2026-114083","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to ","technologies":[],"title":"Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114083"},{"cves":[],"epss":null,"id":"CVE-2026-114084","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key wit","technologies":[],"title":"Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter i","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114084"},{"cves":[],"epss":null,"id":"CVE-2026-114085","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belonging to other deployments without ownership verification. Attackers with network access and a valid run/snapshot pair can call the attempts/start ","technologies":[],"title":"Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs belong","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114085"},{"cves":[],"epss":null,"id":"CVE-2026-114088","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or ","technologies":[],"title":"Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114088"},{"cves":[],"epss":null,"id":"CVE-2026-114089","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code/<code> mints a Personal Access Token without any consent step. Attackers mint an unauthenticated code, lure a logged-in user to that URL, then r","technologies":[],"title":"Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/authorization-code","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114089"},{"cves":[],"epss":null,"id":"CVE-2026-114090","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints. LAN attackers or malicious web pages can send MCP tools/call requests to invoke trigger-task, c","technologies":[],"title":"Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfa","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114090"},{"cves":[],"epss":null,"id":"CVE-2026-114092","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of","technologies":[],"title":"Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runP","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114092"},{"cves":[],"epss":null,"id":"CVE-2026-114094","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code exe","technologies":[{"group":"os","id":"windows","label":"Windows"}],"title":"Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114094"},{"cves":[],"epss":null,"id":"CVE-2026-114095","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-fi","technologies":[],"title":"Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referenti","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114095"},{"cves":[],"epss":null,"id":"CVE-2026-114096","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so re","technologies":[],"title":"Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary fil","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114096"},{"cves":[],"epss":null,"id":"CVE-2026-114097","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a d","technologies":[],"title":"Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114097"},{"cves":[],"epss":null,"id":"CVE-2026-114098","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-","technologies":[],"title":"Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the workt","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114098"},{"cves":[],"epss":null,"id":"CVE-2026-114102","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data processe","technologies":[{"group":"runtime","id":"nodejs","label":"Node.js"}],"title":"adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114102"},{"cves":[],"epss":null,"id":"CVE-2026-114104","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causin","technologies":[],"title":"adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives w","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114104"},{"cves":[],"epss":null,"id":"CVE-2026-114106","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak ","technologies":[],"title":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114106"},{"cves":[],"epss":null,"id":"CVE-2026-114107","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subproce","technologies":[],"title":"HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as ro","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114107"},{"cves":[],"epss":null,"id":"CVE-2026-114109","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowi","technologies":[],"title":"uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scr","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114109"},{"cves":[],"epss":null,"id":"CVE-2026-114110","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to dele","technologies":[],"title":"Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114110"},{"cves":[],"epss":null,"id":"CVE-2026-114111","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may r","technologies":[],"title":"sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific condition","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114111"},{"cves":[],"epss":null,"id":"CVE-2026-114112","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif deco","technologies":[{"group":"os","id":"linux","label":"Linux"}],"title":"Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplyi","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114112"},{"cves":[],"epss":null,"id":"CVE-2026-114113","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and CVE-2026-69242) in its GIF, TIFF and VIPS image decoders. Attackers can supply crafted GIF, TIFF or VIPS files to applications using sharp to proc","technologies":[],"title":"Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 and C","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114113"},{"cves":[],"epss":null,"id":"CVE-2026-114117","known_exploited":false,"published_date":"2026-10-21","resoarc_impact":"NOT_CONFIRMED","resoarc_response":"UNREVIEWED","response_difficulty":"unknown","severity":"HIGH","source":"NVD","sources":["NVD"],"summary":"Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong","technologies":[],"title":"Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, i","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114117"}],"available_records":250,"collection_limit_notice":"Only the verified public snapshot's current item set is provided. This endpoint is not an exhaustive CVE archive.","generated_at":"2026-10-22T15:11:23.434409+09:00","license":"Original advisory content and licensing remain with their publishers; no blanket redistribution license is claimed.","observed_total":5541,"quality":"OK","report_date":"2026-10-22","schema_version":"1.0","service":"ResoArc SWWW","source_count":13}