CVE-2026-94633 high thrift: thrift: Denial of Service via excessive memory allocation in Dart bindings since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-93926 high thrift: thrift: Denial of Service via memory leak in THeaderTransport since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-93925 high thrift: thrift: Denial of Service via stack-based buffer overflow in THeaderProtocol since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-91137 high thrift: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-91135 high thrift: Apache Thrift: Arbitrary code execution via heap-based buffer overflow during frame compression since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-85494 high thrift: thrift: Denial of Service via improper message handling in language bindings since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-85493 high thrift: Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME) since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-94639 high improper handling of exceptional conditions, Allocation of resources w ... since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-94635 high thrift: thrift: Denial of Service via improper length parameter handling in Lua bindings since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-94634 high thrift: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103885 high org.apache.directory.api/api-ldap-model: Apache Directory LDAP API: Denial of Service via crafted telephone numbers since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103877 high org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-103552 high org.apache.directory.api/api-ldap-codec-core: Apache Directory LDAP API: Denial of Service via deeply nested search filter since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-102731 high org.apache.directory.api/api-asn1-ber: Apache Directory LDAP API: Denial of Service via excessive memory allocation since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-17507 high In Bouncy Castle for Java before 1.86, the MLS implementation (org.bou ... since at least 24 Oct 2026 07:11 UTC build 2 Oct 2026 CVE-2026-86344 high 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-PDU connection requeue since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-51886 high Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-96780 high figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-54049 high Sakai Conversations has a Stored XSS Issue since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-53964 high Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes) since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-103484 high pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-15911 high confluent-kafka: confluent-kafka: Information disclosure via improper TLS certificate validation in HashiCorp Vault integration since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-12542 high foreman: command injection in foreman-tail since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2023-54404 high zod: zod: Denial of service via unbounded array validation since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-96659 high foreman: Excessive Permissions for Viewer Role on Preview since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-96658 high foreman: Foreman: Arbitrary code execution via safemode sandbox bypass since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-73636 high httpd: httpd: Authentication bypass via credential replay in mod_auth_digest since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-63718 high httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-63686 high httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-63292 high httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-59685 high httpd: httpd: Denial of Service via out-of-bounds write during Windows path expansion since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-56154 high httpd: httpd: Denial of Service via mod_rewrite lookahead since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-56153 high httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-12544 high foreman: SSTI and insecure deserialization in foreman-rake configuration since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-12541 high foreman: command injection in foreman-rake database tasks since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-12540 high foreman: command injection in foreman-rake errors:fetch_log via request_id parameter since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-12423 high foreman: unauthenticated information disclosure via provisioning token validation flaw since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-12405 high rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-103921 high GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 GHSA-9cqf-hhrq-7v45 high SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-46729 high httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 GHSA-mcm9-63f2-9j32 high devalue: Repeated primitive strings cause quadratic expansion in uneval since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 GHSA-r9w8-h9r3-54w4 high devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 GHSA-x5rw-q4pp-hg5g high devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-94250 high Apache APISIX: Batch response aggregation can exhaust worker memory since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-103678 high A flaw was found in tnef. An attacker can exploit this vulnerability b ... since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-103292 high Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-103289 high Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-103286 high Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 CVE-2026-103283 high Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling since at least 24 Oct 2026 07:11 UTC build 1 Oct 2026 