CVE-2026-91012 high org.apache.karaf.config/org.apache.karaf.config.core: Apache Karaf: Privilege escalation via path traversal in configuration service since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-97024 high flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102422 high shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102281 high Nest: Remote process termination via a deeply nested microservice message pattern since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102278 high brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102276 high brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102275 high pyjwt: PyJWT: Token verification bypass via mismatched OKP key components since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102274 high pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102273 high pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102272 high pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102271 high pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101918 high pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101917 high pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101916 high grpc-js: grpc-js: Authentication bypass via improper peer certificate validation since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-96760 high authlib: authlib: Signature verification bypass via deserialize_json since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-93355 high litellm: LiteLLM: Privilege escalation via unverified email lookup in JWT authentication since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-97023 high flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-96740 high streamshub/console: console-operator: Streams for Apache Kafka Console: Unfiltered Kafka client properties → SA-token exfiltration via config.providers since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-55157 high Token Optimizer MCP: OS command injection in smart_user via username in get-user-info since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101909 high axios: axios: Denial of Service via prototype pollution gadget in form serialization since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101906 high axios: axios: Denial of Service via crafted redirect hostname since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101905 high axios: axios: Request socket hijacking via inherited createConnection property since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101903 high axios: Axios: Denial of Service via malformed data URLs since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101901 high axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-88815 high perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-87114 high kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-85644 high perl-XS-Parse-Keyword: perl-XS-Parse-Keyword: Denial of Service via improper array reference validation since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101894 high @xhmikosr/decompress: @xhmikosr/decompress: Path traversal via symlink chain since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-93348 high unsloth-zoo: unsloth: Unsloth Zoo: Arbitrary code execution via crafted model configuration since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 GHSA-456v-xq2p-r4cj high code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78) since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-86330 high noobaa-core: noobaa-core: OS command injection in cluster_internal_api.set_hostname_internal since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101292 high artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserialization since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-91006 high org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance options since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-94286 high libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101015 high opendmarc: OpenDMARC: DMARC policy bypass via Unicode dot character equivalence in policy.c Domain Handler since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101014 high opendmarc: OpenDMARC: Denial of Service via off-by-one error in opendmarc_util_cleanup since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-100888 high A weakness has been identified in Trusted Domain Project OpenDKIM up t ... since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101044 high pnpm: pnpm: Arbitrary file creation outside project directory via lockfile path traversal since at least 24 Oct 2026 07:11 UTC build 27 Sep 2026 CVE-2026-101043 high pnpm: pnpm: Information disclosure via environment variable expansion in proxy settings since at least 24 Oct 2026 07:11 UTC build 27 Sep 2026 CVE-2026-101042 high Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity since at least 24 Oct 2026 07:11 UTC build 27 Sep 2026 