CVE-2026-111763 medium A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112944 medium launch-editor: launch-editor: Arbitrary command execution via improper filename handling since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112940 medium filelock: filelock: Arbitrary file overwrite via insecure database file reopening since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112939 medium filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112937 medium filelock is a platform-independent file lock for Python. From 4.1.0 un ... since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112936 medium filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112935 medium filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112934 medium filelock: filelock: Denial of Service via insecure holder record refresh since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112915 medium filelock: filelock: Denial of Service via crafted SQLite lock database since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112914 medium filelock: filelock: Unauthorized file exposure via symbolic link manipulation in SoftFileLock since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112911 medium filelock: filelock: Lock bypass via pre-created shared protocol directory since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112909 medium filelock: filelock: arbitrary file truncation via lock path replacement since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112906 medium filelock: filelock: Mutual exclusion bypass via improper stale lock removal since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-111762 medium A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-111761 medium A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-93446 medium tomcat: Apache Tomcat: Possible TLS 1.3 connection failures since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-103119 medium tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101356 medium tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113470 medium firefox: Firefox: Website spoofing via failure to block compromised intermediate certificates since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113401 medium Denial-of-service in the PDF Viewer component. This vulnerability ... since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113400 medium Uninitialized memory in the Audio/Video: cubeb component. This vu ... since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113399 medium Incorrect boundary conditions in the SVG component. This vulnerab ... since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113351 medium expat: expat: Denial of Service via improper memory tracking in XML_ParserReset since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-92287 medium arrow: pyarrow: arrow: Information disclosure via unvalidated KMS URLs in Parquet files since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-110306 medium fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-110180 medium fast-uri: fast-uri: Security policy bypass via improper host canonicalization since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112898 medium pillow: Pillow: Information disclosure via empty palette quantization since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112300 medium configobj: configobj: Denial of Service via inefficient regular expression evaluation since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112259 medium gimp: gimp: NULL pointer dereference in SwatchBooker (SBZ) palette import since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111757 medium hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111755 medium follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2025-52290 medium ffmpeg: ffmpeg: Denial of Service via crafted media file since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111750 medium aiohttp: aiohttp: HTTP request smuggling via ambiguous request framing since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111749 medium aiohttp: aiohttp: Host-Only cookie protection bypass via untrusted subdomain since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111748 medium aiohttp: aiohttp: Security control bypass via request scheme spoofing since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111065 medium aiohttp: aiohttp: Denial of Service via Max-Age processing overflow since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111061 medium russh: russh: Denial of Service via resource exhaustion in SSH agent since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111059 medium Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 GHSA-953h-535j-jg2v medium agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 GHSA-pcc4-rvhr-2pr8 medium Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112282 medium libbluray: libbluray: Denial of Service via out-of-bounds read in clpi_access_point() since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112279 medium rdesktop: rdesktop: Denial of Service via crafted bitmap cache orders since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112278 medium rdesktop: rdesktop: Denial of Service via heap out-of-bounds read in process_raw_bmpcache since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112277 medium rdesktop: rdesktop: Denial of Service via malformed compressed bitmaps since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112272 medium libdisplay-info: libdisplay-info: Denial of Service via out-of-bounds read in DisplayID parser since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112271 medium libdisplay-info: libdisplay-info: Denial of Service via out-of-bounds read in DisplayID parser since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-111883 medium locust: locust: Denial of Service via Cross-Site Request Forgery in web interface since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112214 medium gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-84180 medium org.apache.camel/camel-knative: camel-knative: Information disclosure via error responses since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112027 medium cms: light0011 cms: Information disclosure via filename manipulation in Uploadify since at least 24 Oct 2026 07:11 UTC build 18 Oct 2026 