CVE-2026-114132 medium Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114131 medium Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114129 medium stream-json: stream-json: Denial of Service via deeply nested JSON documents since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114128 medium astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114127 medium astro: Astro: CSS injection via unvalidated view transition animation properties since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114121 medium Electron: openExternal permission requests can be attributed to the wrong origin since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113800 medium Electron: HID and USB permission checks can be attributed to the wrong origin since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113799 medium Slack Morphism verifier errors disclose valid HMACs in the logs since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113798 medium Electron: Pointer lock permission requests can be attributed to the wrong frame since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113796 medium Electron: SameSite cookie restrictions are not applied to windows opened from links since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113795 medium pypdf: pypdf: Denial of Service via crafted PDF streams with multiple filters since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113794 medium pypdf: pypdf: Denial of Service via incomplete cross-reference table since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113793 medium pypdf: pypdf: Denial of Service via crafted cyclic PDF tree since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113792 medium pypdf: pypdf: Denial of Service via infinite loop in PdfWriter.find_outline_item since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113791 medium pypdf: pypdf: Denial of Service via excessive memory consumption during content stream parsing since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113790 medium pypdf: pypdf: Denial of Service via crafted PDF arrays and dictionaries since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-113789 medium pypdf: pypdf: Denial of Service via crafted PDF form fields since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114437 medium github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114386 medium Pydantic AI Harness tool-call limit bypass in nested CodeMode calls since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-105923 medium qt6: qt6: Denial of Service via crafted SVG in VectorImage since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-17557 medium lm-evaluation-harness: lm-evaluation-harness: SSRF via job-spec model.url with bearer credential forwarding since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-93856 medium cinder: openstack-cinder: Information disclosure via Block Storage API message listing since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-92824 medium libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-92823 medium libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed YAML since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114118 medium vyper: Vyper: Deployment of empty smart contracts via integer underflow in create_from_blueprint since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114114 medium vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114110 medium uv: uv: Arbitrary file deletion via directory traversal in package RECORD metadata since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114105 medium adm-zip: adm-zip: Privilege escalation via unmasked permissions during archive extraction since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114104 medium adm-zip: adm-zip: Content validation bypass via duplicate archive entry names since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114103 medium adm-zip: adm-zip: Denial of Service via decompression bomb protection bypass in asynchronous extraction since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114095 medium dulwich: dulwich: Denial of Service via self-referential packfile delta objects since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114054 medium vllm: vllm: Denial of Service via cross-request cache key collision since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114047 medium freerdp: FreeRDP: proxy improper TLS certificate validation allows target impersonation since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114046 medium freerdp: FreeRDP: null pointer dereference in smartcard emulation via crafted reader name since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114044 medium freerdp: FreeRDP: Android client heap out-of-bounds read via graphics pipeline since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114043 medium freerdp: FreeRDP: heap out-of-bounds read in WinPR clipboard PNG-to-CF_DIB synthesis since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114042 medium freerdp: FreeRDP: use-after-free in drdynvc virtual channel PDU handling since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-114041 medium freerdp: FreeRDP: Windows RD Gateway consent message heap out-of-bounds read since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2025-71437 medium uv: uv: Arbitrary file write via crafted symlinks in source distribution extraction since at least 24 Oct 2026 07:11 UTC build 21 Oct 2026 CVE-2026-91487 medium openjdk: Enhance C2 comparisons (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91464 medium openjdk: Enhance Kerberos validation (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91463 medium openjdk: Enhance krb5 client (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91462 medium openjdk: Enhance krb5 tokens (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91453 medium openjdk: Improve HTTP headers (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91452 medium openjdk: Enhance HTTP server (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91451 medium openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91418 medium openjdk: Enhance GIF loading (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91417 medium openjdk: Enhance CORBA (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91411 medium openjdk: Enhance JGSS (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-91410 medium openjdk: Enhance zipfs (Oracle CPU 2026-10) since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 