CVE-2026-56866 medium net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107651 medium eog: eog: arbitrary code execution via heap buffer overflow in PNG metadata reader since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107721 medium fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache) since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107719 medium fast-jwt: Verifier cache accepts expired JWTs without iat. since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107718 medium http-server: http-server: Open redirect via unencoded route parameters since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107717 medium banks: banks: Chat role injection via untrusted template input since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107715 medium mechanize: mechanize: Information disclosure via cross-domain HTTP redirect since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107714 medium mechanize: mechanize: Information disclosure via improper redirect scheme and port handling since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107399 medium mechanize: mechanize: Information disclosure via cross-origin meta refresh since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107778 medium krb5: krb5: Denial of Service via crafted forwarded credentials since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107708 medium krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107397 medium Indico: Cross-Site-Scripting in minutes editor since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-106435 medium pymongo: pymongo: Denial of Service via out-of-bounds read during malformed BSON decoding since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107705 medium poppler: poppler: Denial of Service via stack-based buffer overflow in PDF decryption since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107396 medium Indico: Cross-Site-Scripting in link fields since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107395 medium Indico: Missing access check in legacy session export API since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107394 medium Indico: Incomplete Server-Side Request Forgery (SSRF) check since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107389 medium music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-106436 medium php-pecl-mongodb: php-pecl-mongodb: Denial of Service via oversized BSON encoding since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-95209 medium gnutls: gnutls: legitimate CA certificates incorrectly rejected causing denial of service since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-88648 medium gnutls: gnutls: Cross-domain certificate restriction bypass via incomplete X.509 validation since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-67693 medium gnutls: gnutls: Information disclosure via contradictory Key Usage and Extended Key Usage extensions since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107388 medium music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107387 medium music-metadata: Uncontrolled memory allocation in APEv2 parser since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107386 medium github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via excessive memory allocation during frame parsing since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107382 medium MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107325 medium go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via malformed BSON array input since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107324 medium go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via integer overflow in BSON processing since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-95210 medium gnutls: gnutls: certificates with invalid extensions incorrectly accepted since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-95184 medium gnutls: gnutls: legitimate user certificates incorrectly rejected causing denial of service since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-93861 medium openstack-mistral: mistral: workflow membership sub-delegation allows unauthorized access grant to private workflows since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-93860 medium openstack-mistral: mistral: Unauthenticated-project user can trigger global maintenance mode causing cross-tenant denial of service since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107698 medium ffmpeg: ffmpeg: Server-Side Request Forgery via unvalidated RTSP redirects since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107697 medium ffmpeg: ffmpeg: Security restriction bypass via crafted HLS master playlist since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107696 medium ffmpeg: ffmpeg: Denial of Service via unlimited RTSP redirects since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107695 medium ffmpeg: ffmpeg: Denial of Service via crafted HLS playlist since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107380 medium enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107379 medium enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 GHSA-w253-m66g-rx24 medium Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 GHSA-3wr7-993q-jrff medium Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 GHSA-g4qm-m288-5cp9 medium Coraza has Cookie Parser Confusion since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 GHSA-5gj4-9gm7-2fx2 medium Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-88647 medium gnutls: gnutls: Information disclosure via hostname verification bypass since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-61801 medium github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107301 medium msgpack5: Partial options disable prototype protection since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107299 medium msgpack5: Reserved byte can cause unbounded stream buffering since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107298 medium msgpack5: Deeply nested input can exhaust the decoder stack since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107297 medium msgpack5: Quadratic parsing in the streaming decoder since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107294 medium pydantic-ai: pydantic-ai: Denial of Service via unbounded HTTP response buffering since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 CVE-2026-107293 medium pydantic-ai: pydantic-ai: Information disclosure via OpenTelemetry retry prompt logging since at least 24 Oct 2026 07:11 UTC build 8 Oct 2026 