Search

ID	Vulnerability	Rated since	Published
openSUSE-SU-2026:12239-1 high	go1.27-1.27.3-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12240-1 high	google-guest-agent-20261015.00-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12241-1 high	kubevirt1.8-container-disk-1.8.4-7.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12242-1 high	kubevirt1.9-container-disk-1.9.1-2.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12253-1 high	tekton-cli-0.46.2-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12255-1 high	tomcat10-10.1.61-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12256-1 high	tomcat11-11.0.27-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:12258-1 high	zk-0.15.7-1.1 on GA media	24 Oct 202619:09 UTC build
openSUSE-SU-2026:22151-1 high	Security update for php8	24 Oct 202619:09 UTC build
openSUSE-SU-2026:22152-1 high	Security update for go1.26	24 Oct 202619:09 UTC build
openSUSE-SU-2026:22153-1 high	Security update for go1.27	24 Oct 202619:09 UTC build
openSUSE-SU-2026:22155-1 high	Security update for cpupower	24 Oct 202619:09 UTC build
CVE-2026-115895 high	happy-dom: happy-dom: Arbitrary code execution via unvalidated ECMAScript Module import alias	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-f2hq-32vh-53cc high	postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115778 high	twisted: twisted: Denial of Service via memory exhaustion during Telnet negotiation	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115776 high	twisted: Twisted: Denial of Service via unbounded IRC buffer	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115775 high	twisted: twisted: Denial of Service via memory exhaustion in XML stream parser	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-q54r-jf2p-rfr2 high	gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-9969-6676-49h5 high	Echo: WebSocket proxy can retain connections and handlers after client disconnect	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-h7wr-284f-5qvc high	Echo: Decompress permits unbounded gzip expansion in v4	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
GHSA-f48p-c9v4-h7xv high	Echo: BodyDump captures request and response bodies without size limits in v4	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115570 high	Electron: Mitigation for compromised eMudhra intermediate certificates	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-110975 high	autotune: kruize/autotune: kruize/autotune: Datasources credential disclosure	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-106069 high	nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-105482 high	nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57845 high	datasets: datasets: Arbitrary code execution via insecure pickle deserialization	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115478 high	obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-115477 high	obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57210 high	Heimdall: IP Spoofing via Unvalidated Forwarding Headers	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57209 high	Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57146 high	PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57144 high	PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57142 high	PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57121 high	PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57117 high	PraisonAI: Compute-bridged file tools allow shell command injection	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57114 high	PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-57113 high	PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56840 high	PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56838 high	PraisonAI recipe.run_stream skips dangerous-tool policy enforcement	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56837 high	PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56836 high	PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56835 high	PraisonAI Slack app_mention bypasses configured user/channel authorization	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56834 high	PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56833 high	PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-56832 high	PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals	since at least 24 Oct 202607:11 UTC build	23 Oct 2026
CVE-2026-114616 high	authlib: authlib: Authentication bypass via zero-length HMAC key	since at least 24 Oct 202607:11 UTC build	22 Oct 2026
CVE-2026-114615 high	authlib: Authlib: Authentication bypass via improper asymmetric key validation	since at least 24 Oct 202607:11 UTC build	22 Oct 2026
CVE-2026-115419 high	Strands Agents SDK: Exposure of data element to wrong session in the A2A Server	since at least 24 Oct 202607:11 UTC build	22 Oct 2026
CVE-2026-115504 high	cfitsio: cfitsio: arbitrary code execution via crafted FITS file	since at least 24 Oct 202607:11 UTC build	22 Oct 2026
CVE-2026-115374 high	github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs	since at least 24 Oct 202607:11 UTC build	22 Oct 2026

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.