CVE-2026-106574 medium ImageMagick: ImageMagick: Denial of Service via heap buffer overwrite in distributed pixel cache server since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106572 medium ImageMagick: ImageMagick: Denial of Service via crafted CALS image since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106571 medium ImageMagick: ImageMagick: Denial of Service via heap buffer overflow in GetVirtualPixels since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106570 medium ImageMagick: ImageMagick: Denial of Service via connection exhaustion in distributed pixel cache since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106569 medium ImageMagick: ImageMagick: Denial of Service via crafted ASE image since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106568 medium ImageMagick: ImageMagick: Denial of Service via crafted XMP profile since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106566 medium ImageMagick: ImageMagick: File overwrite via improper delegate symlink cleanup since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106564 medium ImageMagick: ImageMagick: Denial of Service via crafted EXR image since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-62179 medium PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-46570 medium In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_inde ... since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-107174 medium source-to-image: source-to-image: Security boundary bypass via absolute symbolic link extraction since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-107169 medium m17n-lib: NULL-pointer write in read_mtext_element() on malformed UTF-8 since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-107167 medium m17n-lib: Heap use-after-free write in re_init_ic() since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106563 medium Backstage: Improper entity validation in deprecated Kubernetes services endpoint since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106562 medium plugin-search-backend: plugin-search-backend-module-elasticsearch: Backstage: Information disclosure via search permission filter bypass since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106561 medium plugin-kubernetes-backend: Backstage plugin-kubernetes-backend: Information disclosure in Kubernetes resource queries since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106560 medium Backstage: Improper repository path validation in a Scaffolder backend module since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106559 medium Backstage: Improper input validation in Confluence to Markdown scaffolder module since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-106064 medium GIMP: GIMP: heap buffer overflow in GIF export on oversized image dimensions since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-46572 medium In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_c ... since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-46571 medium In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_fi ... since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-46438 medium wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-46437 medium wger: API credentials remain valid after logout/password change since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-45161 medium wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-42618 medium In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_deco ... since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-42617 medium In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_t ... since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-98374 medium kernel: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-98373 medium kernel: mm/hugetlb: preserve mremap address delta when skipping page tables since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-42532 medium visidata: visidata: Arbitrary file write via path traversal in EmailSheet since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-41958 medium visidata: visidata: Arbitrary file write via path traversal in RemoteZipFile extraction since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-107168 medium m17n-lib: Parser infinite loop on malformed UTF-8 in count_utf_8_chars() since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-107151 medium rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-103435 medium claude-code: claude-code: Arbitrary file write via TOCTOU race condition since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-107121 medium keycloak-services: keycloak-services: SMTP STARTTLS plaintext credential and message downgrade since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-103870 medium pulp-rpm: Distribution tree publish creates directories from .treeinfo ids since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-103869 medium pulp-ansible: Bearer tokens are reused across remotes in a worker since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-103868 medium pulp-container: Registry credentials are reused across remotes in a worker since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-84897 medium src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_M since at least 24 Oct 2026 07:11 UTC build 7 Oct 2026 CVE-2026-97208 medium Gitea push mirror API bypass of DISABLE_NEW_PUSH policy since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-96594 medium Gitea repository media API stored XSS since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-89182 medium Gitea push-to-create bypass of FORCE_PRIVATE policy since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106508 medium Backstage has potential file exposure through local TechDocs publisher since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106506 medium plugin-scaffolder-backend: plugin-scaffolder-backend: Information disclosure via improper task list ordering since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106504 medium plugin-scaffolder-backend: plugin-scaffolder-backend: Sensitive information disclosure via task logs since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106502 medium plugin-scaffolder-backend: plugin-scaffolder-backend: Information disclosure via task failure events since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106499 medium plugin-scaffolder-backend: Backstage: Information disclosure via secret leakage in Scaffolder task logs since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106498 medium @backstage/plugin-catalog-backend: @backstage/plugin-catalog-backend: Information disclosure via improper URL validation in entity placeholders since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106497 medium plugin-catalog-backend: plugin-catalog-backend: Information disclosure via inconsistent permission evaluation since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-106496 medium plugin-catalog-backend: plugin-catalog-backend: Unintended file access via inconsistent location type enforcement since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-105268 medium code.gitea.io/gitea: Gitea: Unauthorized deletion and renaming of comment attachments via issue attachment API since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 