GHSA-2rqm-h6hv-g79v medium odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 GHSA-mhf7-xp6r-6qrc medium Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 GHSA-h53f-rm2w-w7rg medium Echo: X-Real-IP extractor trusts the header value instead of the sending peer since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 GHSA-x9ff-22gv-65f4 medium Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115586 medium virtualenv: virtualenv: Arbitrary code execution via unescaped prompt in bash activation script since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115585 medium pypdf: pypdf: Denial of Service via malformed cross-reference streams since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115580 medium pypdf: pypdf: Denial of Service via excessive cross-reference table entries since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115572 medium pypdf: pypdf: Denial of Service via repeated nonexistent object references since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 GHSA-xp3q-r38w-vgqm medium SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115567 medium Tokio: Race condition in `tokio::time::Interval` since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115754 medium serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-90458 medium openstack-ironic: openstack-ironic: Redfish vendor_passthru subscription id path traversal since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-89419 medium openstack-ironic: openstack-ironic: maintenance state update bypasses set_maintenance policy via generic PATCH since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115486 medium open-iscsi: open-iscsi: IPv6 Neighbor Discovery missing option length validation in iscsiuio allows ARP table poisoning since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115485 medium open-iscsi: open-iscsi: DHCPv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115484 medium open-iscsi: open-iscsi: DHCPv4 option parser heap out-of-bounds read in iscsiuio parse_msg since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115424 medium oc: oc: Symlink/hardlink target validation bypass in oc image extract allows file write outside destination since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115221 medium ipa: freeIPA: FreeIPA uses subject CN as proof of certificate ownership since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114620 medium authlib: Authlib: Server-Side Request Forgery via unvalidated request URI since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114619 medium authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114618 medium authlib: Authlib: Unauthorized access via improper JWT audience validation since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114617 medium authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115391 medium wasmtime: wasmtime: Denial of Service via unbounded buffering in WASIp3 write streams since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115390 medium wasmtime: wasmtime: Denial of Service via fuel accounting flaw since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115383 medium wasmtime: wasmtime: Denial of Service via improper validation of WebAssembly tag imports since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115382 medium wasmtime: wasmtime: Denial of Service via zero timeout in HTTP request option since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115379 medium wasmtime: Wasmtime: Denial of Service via missing garbage collection rooting since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115378 medium github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115373 medium github.com/lxc/incus: Incus: Information disclosure via missing authorization check in operations endpoint since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115365 medium github.com/openbao/openbao: OpenBao: Privilege escalation via ACL policy cache namespace traversal since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115354 medium mistune: mistune: Information disclosure via path traversal in Include directive since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115351 medium mistune: mistune: Information disclosure via CSS injection in figure directive since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115350 medium mistune: mistune: Cross-site scripting via Include directive since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114608 medium pylint: pylint: Arbitrary code execution via untrusted cache deserialization since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114603 medium opentelemetry-api: opentelemetry-api: Denial of Service via regular expression backtracking in header parsing since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114348 medium webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114570 medium wordpress: WordPress: Stored Cross-Site Scripting via unescaped display names in Quick Edit since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114732 medium roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114722 medium roundcubemail: Roundcube Webmail: Interface spoofing via CSS scoping bypass in HTML messages since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114718 medium roundcubemail: roundcubemail: Cross-site scripting via unescaped password driver error messages since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114508 medium Laravel relationship inclusion can trigger unauthorized data destruction since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-96642 medium pillow: Pillow: Denial of Service via negative archive member size in TarIO since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-96641 medium pillow: pillow: Denial of Service via integer overflow in text-width calculation since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-96638 medium pillow: pillow: Denial of Service via crafted RLE BMP image since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-96637 medium pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-96636 medium pillow: pillow: Denial of Service via decompression bomb check bypass in multi-frame images since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-85518 medium openscap: openscap: Arbitrary file write via path traversal in Source DataStream decomposition since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114438 medium keycloak-services: keycloak-services: Required OTP enrollment bypassed via Update User Locale required action ordering since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-92205 medium busybox: busybox: Arbitrary file creation via directory traversal since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114133 medium Nuxt server islands render `useHeadSafe` input without sanitisation since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 