CVE-2026-109716 medium Incorrect boundary conditions in the JavaScript Engine component. This ... since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109715 medium Incorrect boundary conditions in the JavaScript Engine component. This ... since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109713 medium Use-after-free in the Crash Reporting component. This vulnerability wa ... since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109712 medium Sandbox escape due to uninitialized memory in the Graphics component. ... since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109711 medium Use-after-free in the Graphics: Canvas2D component. This vulnerability ... since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109709 medium Information disclosure, privilege escalation in the Security: Process ... since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109708 medium Sandbox escape due to incorrect boundary conditions in the Networking ... since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109704 medium ELSA-2026-89758: firefox security, bug fix, and enhancement update (IMPORTANT) since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109156 medium mlserver: MLServer: Arbitrary file write via path traversal in environment archive extraction since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109152 medium scp: scp.py: Arbitrary file overwrite via path traversal since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-9268 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-92528 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-85529 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-84284 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-7767 medium URL Redirection to Untrusted Site ('Open Redirect') in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-78335 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-6567 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-5954 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-16275 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-14552 medium Incorrect Authorization in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-14210 medium Insufficient Granularity of Access Control in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-105458 medium Reliance on Untrusted Inputs in a Security Decision in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-104661 medium Incorrect Privilege Assignment in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-101168 medium Insertion of Sensitive Information into Log File in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-100755 medium Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab since at least 24 Oct 2026 07:11 UTC build 13 Oct 2026 CVE-2026-109597 medium hugo: Hugo: Stored cross-site scripting via crafted heading identifiers since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109596 medium hugo: Hugo: Information disclosure via improper link resolution in nested mounts since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109595 medium hugo: Hugo: Information disclosure via path traversal during asset compilation since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109574 medium hugo: Hugo: Information disclosure via Sass import path traversal since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-84321 medium Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-84320 medium Nginx UI: Auto backup name allows path traversal outside validated storage path since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-41508 medium Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-41504 medium Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fields since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109561 medium goose: goose: Authorization bypass via uncleared read-only tool annotations since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-106495 medium Backstage: Improper access control in backend action invocation since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-104774 medium Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-85471 medium quay: quay: Webhook notification SSRF -- hostname-string blocklist trivially bypassable since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-83536 medium openstack-network-exporter: http.Server has no ReadHeaderTimeout / ReadTimeout (Slowloris) since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-83535 medium openstack-network-exporter: Basic-auth uses plaintext password storage and non-constant-time comparison since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-107226 medium The AsyncHttpClient (AHC) library allows Java applications to easily e ... since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-104355 medium go.temporal.io/server: Temporal Server: Unauthorized modification of local namespaces via inbound replication tasks since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-104102 medium copyparty FTP: upload outside defined volumes (limited path traversal) since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-77364 medium obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109448 medium postgresql-odbc: postgresql-odbc: Denial of Service via integer wraparound in SQLBindParameter since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-94451 medium quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: Information Disclosure and DoS via Unvalidated Sort Parameter in REST Data Panache since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109351 medium gix-pack: gix-pack: Denial of Service via crafted pack-header object count since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109350 medium gix-pack: gix-pack: Denial of Service via malformed packfile delta entries since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109349 medium gix-pack: gix-pack: Denial of Service via crafted pack header since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109345 medium dompurify: DOMPurify: Cross-site scripting via unsanitized raw text in in-place mode since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 CVE-2026-109344 medium dompurify: DOMPurify: Cross-Site Scripting via unneutralized elements detached during in-place sanitization since at least 24 Oct 2026 07:11 UTC build 12 Oct 2026 