CVE-2026-105642 high Ghost: Remote Code Execution via Bookmark Card Images since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-104714 high Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Stru since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-104712 high org.apache.struts/struts2-core: Apache Struts: Denial of Service via resource amplification in tag library since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-104711 high org.apache.struts/struts2-core: Apache Struts: Arbitrary code execution via expression injection in legacy RESTful action mapper since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93320 high github.com/moby/buildkit: BuildKit: Unintended host device access via special file inodes since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93318 high github.com/moby/buildkit: BuildKit: arbitrary code execution via cache poisoning from mismatched layer identifiers since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-101919 high hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-102282 high adm-zip: adm-zip: Privilege escalation via unfiltered permission bits in extracted archives since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-104891 high mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-104890 high Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-63277 high libreoffice: libreoffice: Arbitrary code execution via remote Java database driver since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-19395 high qt-mcu: qt: Denial of Service via empty image tag attribute in styled text since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105221 high gist: gist: Traffic interception and credential theft via improper TLS certificate validation since at least 24 Oct 2026 07:11 UTC build 4 Oct 2026 CVE-2026-71889 high org.bouncycastle/bcpkix-jdk18on: org.bouncycastle/bcpkix-fips: org.bouncycastle/bcpkix-jdk15on: org.bouncycastle/bcpkix-lts8on: bouncycastle: Bouncy Castle: Certificate validation bypass via missing name constraint checks since at least 24 Oct 2026 07:11 UTC build 3 Oct 2026 CVE-2026-71888 high bouncycastle: bouncycastle-fips: Bouncy Castle: Security bypass via unvalidated attributes in CMS AuthenticatedData parser since at least 24 Oct 2026 07:11 UTC build 3 Oct 2026 GHSA-x8gv-g2g3-65fj high SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-cjcg-cxmh-9wcr high Praxis affected by HTTP/2 Bomb since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-5rmq-chc7-m22f high Vibe-Trading file-read tools expose arbitrary server-readable files since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-9q4r-4842-93vw high Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-pqxw-g93w-hj9x high Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-5wf9-h793-w73c high Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-pp95-gc86-jq6q high Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR) since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104988 high pki-core: dogtag-pki: redhat-pki: pki: EST fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104873 high langgraph-sdk: langgraph-sdk: Authorization bypass via improper resource handler registration since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-xxv7-2vv3-h682 high Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-qxpp-qjg8-x4jv high Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write) since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-8mcx-5rqc-vhmf high Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-8w8g-wq8h-fq33 high Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-5fqc-mrg8-w798 high Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 GHSA-cm62-gvxx-vmxx high Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104861 high probe-image-size: probe-image-size: Denial of Service via crafted SVG input since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104859 high @nx/docker: OS command injection in the @nx/docker release pipeline since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104854 high nx: Nx: Arbitrary code execution via insecure socket permissions since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104851 high fsspec: fsspec: arbitrary code execution via unrestricted template rendering in ReferenceFileSystem since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104848 high tinypool: tinypool: arbitrary code execution via prototype pollution in worker options since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-67989 high Polynomial-Time Regular Expression Denial of Service (ReDoS) vulnerability since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104847 high ProseMirror has a XSS vulnerability in prosemirror-view's paste handling since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104846 high seroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104845 high seroval: seroval: Denial of Service via unbounded memory allocation during deserialization since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-104843 high uv: uv: Arbitrary code execution via malicious package extraction on Windows since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103631 high chromium-browser: Buffer overflow in WebRTC since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103630 high chromium-browser: Use after free in FedCM since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103629 high chromium-browser: skia: Integer overflow in Skia since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103628 high chromium-browser: Out of bounds write in WebGL since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103626 high chromium-browser: Incorrect authorization in FileSystem since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103625 high chromium-browser: Type confusion in V8 since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103624 high chromium-browser: Use after free in Contextual Tasks since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103623 high chromium-browser: Use after free in MediaStream since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103622 high chromium-browser: Use after free in SVG since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103621 high chromium-browser: Integer overflow in Compositing since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 