CVE-2026-105866 high Payload: Unauthenticated account-lockout denial of service since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105865 high Payload: Incomplete validation during the upload file lifecycle since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105862 high Payload: Bypassed sanitization of user uploaded SVGs since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105861 high Payload external upload trust validation issue since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105860 high Payload has a tenant authorization bypass in Multi-Tenant Plugin since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105858 high Payload: Remote Code Execution through first-register since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105856 high Payload: SQL injection in SQLite/Postgres since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105855 high Payload didn't enforce field-level password update restrictions since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105854 high Payload: ReDoS in Multipart Content-Type Validation since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105852 high Payload relationship-query authorization bypass since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105850 high Payload Ecommerce has an order confirmation validation issue since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105849 high Payload vulnerable to API key disclosure through ordinary document reads since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104850 high @modelcontextprotocol/sdk: @modelcontextprotocol/client: MCP TypeScript SDK: Information disclosure via unbound OAuth credentials since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-26287 high github.com/external-secrets/external-secrets: external-secrets: Sensitive information disclosure via webhook generator label enforcement bypass since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105806 high Payload: Improper access control for MCP API keys since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105922 high vllm: vLLM: Denial of Service via crafted inference request with prompt embeddings since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105801 high openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105796 high Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105841 high lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105840 high lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 GHSA-wq5f-xc86-pv6w high sharp : Vulnerability in librsvg dependency CVE-2026-96889 since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98364 high kernel: xfrm: hold net_device reference under RCU in bundle creation since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98323 high kernel: RDMA/siw: Bound fragmented header copies by the remaining length since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98320 high kernel: netfilter: flowtable: hold reference on ct until flow is released since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98318 high kernel: smb: client: validate absolute native symlink targets before NT fixups since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98260 high kernel: exec: Cleanup POSIX timers right after de_thread() since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98256 high kernel: signal: Prevent exec() race since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98222 high kernel: KEYS: encrypted: fix integer overflow of datablob_len since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-98171 high In the Linux kernel, the following vulnerability has been resolved: s ... since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105782 high scrapy: Scrapy: Denial of Service via crafted Referrer-Policy header since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 GHSA-w2vw-w76x-qr89 high Nx: OS command injection via git revisions and remote refs since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105759 high vllm: vLLM: Denial of service via arbitrary HTTP method tokens in metrics tracking since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-104852 high @graphql-tools/utils: @graphql-tools/utils: Denial of Service (DoS) via prototype pollution in mergeDeep since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-6w6g-hm98-mhgm high hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS) since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-5j98-2g5x-46v6 high hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-g2v6-rqmx-r4w6 high @vue/server-renderer: XSS via missing CR in attribute-name blacklist since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-v853-p72q-4cfw high Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__ since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105751 high docling: docling: Information disclosure via crafted OpenDocument image reference since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105750 high docling: docling: Information disclosure via unrestricted local file requests in HTML rendering since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105745 high docling: docling: Arbitrary code execution via premature plugin loading since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105744 high docling: docling: Arbitrary file read and write via unrestricted TeX primitives in Tectonic engine since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105741 high Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105699 high Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105679 high Ghost: Stored XSS via File Uploads on Local Storage since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105677 high Ghost: Remote Code Execution via Theme Translation Files since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105675 high Ghost: Invite Token Disclosure in Ghost Admin API since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105651 high Ghost: Stored XSS via Bookmark Card Images since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105650 high Ghost: Stored XSS via oEmbed Photo Responses since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105649 high Ghost: Stored XSS via SVG Uploads Bypassing Sanitization since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105643 high Ghost: Stored XSS via Embed Card Previews since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 