CVE-2026-112390 high pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112778 high Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespa ... since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112260 high gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111759 high markdown-it: markdown-it: Denial of Service via mismatched quote parsing since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111066 high aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111064 high aiohttp: aiohttp: Denial of Service via missing initial request timeout since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 GHSA-2g87-pp6c-29x5 high aiohttp: Multiple instances of excessive or unbounded memory/CPU use since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112366 high picomatch: picomatch: Denial of Service via single-branch repeated extglob patterns since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112307 high sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-103314 high stackrox: stackrox: SAML response replay allows multiple Central authentication tokens since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-88900 high org.apache.camel/camel-jgroups: camel-jgroups: Arbitrary code execution via untrusted data deserialization since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-88901 high org.apache.camel/camel-smooks: camel-smooks: Information disclosure via XML external entity injection since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-85251 high org.apache.camel/camel-http: camel-http: Information disclosure via improper credential handling during HTTP redirects since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-85250 high org.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML external entity references since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-80344 high org.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-80343 high org.apache.camel/camel-netty-http: Apache Camel Netty HTTP: Security constraint bypass via case sensitivity mismatch since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-79985 high org.apache.camel/camel-smb: camel-smb: Unauthorized file access via path traversal since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-79984 high org.apache.camel/camel-mina-sftp: Apache Camel Mina SFTP: Unauthorized file access via path traversal since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-79983 high org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-78165 high org.apache.camel/camel-spring-redis: camel-spring-redis: Arbitrary code execution via untrusted Java deserialization since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-78164 high org.apache.camel/camel-http-common: org.apache.camel/camel-http: org.apache.camel/camel-vertx-http: org.apache.camel/camel-undertow: org.apache.camel/camel-netty-http: Apache Camel: information disclosure via improper property placeholder evaluation in HTTP headers since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-71253 high org.apache.johnzon/johnzon-mapper: Apache Johnzon: Arbitrary code execution via unsafe class loading since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-16460 high bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112075 high unsloth: unsloth: Arbitrary code execution via unsafe class selection since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-98805 high kernel: tipc: prevent GCM nonce reuse on peer key changes since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98742 high kernel: kernel: Use-after-free via race condition in ALSA sequencer compatibility ioctls since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98741 high kernel: ALSA: ua101: reject mismatched capture/playback packet sizes since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98716 high kernel: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98573 high kernel: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98550 high kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98548 high kernel: sctp: discard the rest of the packet on a stale-cookie error since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98532 high kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98524 high kernel: rds: ib: Clear the sg list when mapping an MR fails since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98490 high kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-98442 high kernel: net/sched: act_ct: fix helper UAF due to extensions realloc since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 CVE-2026-111881 high freerdp: freerdp: Denial of Service via crafted clipboard bitmap image since at least 24 Oct 2026 07:11 UTC build 17 Oct 2026 CVE-2026-111880 high freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication since at least 24 Oct 2026 07:11 UTC build 17 Oct 2026 CVE-2026-96627 high Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-68498 high com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-62439 high gimp: gimp: file-pvr Plug-in PVR File Parsing Integer Overflow Heap-based Buffer Overflow Vulnerability since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-108372 high LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-102834 high JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 GHSA-6fj4-rcr3-r7rr high lopdf has a stack overflow via deeply nested PDF objects since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-109461 high MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-97380 high mariadb: mariadb: Privilege escalation via empty password in GRANT PROXY statement since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-86047 high mariadb: mariadb: SQL injection via improper identifier quoting since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-85748 high mariadb: mariadb: use-after-free in SYS_REFCURSOR during FETCH operations since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-102941 high github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via short URL parsing since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-105958 high A flaw was found in spice-server. Multiple migration data handlers use ... since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 CVE-2026-105959 high spice-server: spice: Heap buffer overflow via GLZ dictionary max_encoders integer truncation since at least 24 Oct 2026 07:11 UTC build 16 Oct 2026 