CVE-2026-104044 medium sssd: sssd: Denial of Service via crafted passkey Kerberos authentication request since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104043 medium sssd: sssd: Denial of Service via undersized packet parsing in NSS responder since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104042 medium sssd: sssd: Denial of Service via out-of-bounds read in PAM responder since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104041 medium sssd: sssd: Denial of Service via unbounded negative cache growth since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104040 medium sssd: sssd: Information disclosure via OData injection in Entra ID lookups since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104039 medium sssd: sssd: Denial of service via stale connection state reuse in PAM GSSAPI responder since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104037 medium sssd: sssd: Denial of Service via packet length underflow in autofs responder since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104035 medium sssd: sssd: Denial of Service via memory exhaustion in KCM responder since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 CVE-2026-104033 medium sssd: sssd: Access control bypass via improper LDAP shadow expiration check since at least 24 Oct 2026 07:11 UTC build 6 Oct 2026 GHSA-r4xh-jqrq-34v2 medium smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-2mjx-qc3c-rqvc medium Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-g7fw-3gjp-g5hf medium OpenClaw: Channel read actions could skip target allowlists since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105760 medium vllm: vllm: Denial of Service via excessive resource consumption in GLMGA video backend since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105758 medium vllm: vllm: Denial of Service via unbounded video frame parameters since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105757 medium vllm: vllm: Denial of Service via unhandled structured-output errors since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105756 medium vllm: vllm: Denial of Service via unvalidated cache salt in API requests since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105755 medium vllm: vllm: Scoring result corruption via user-controlled request identifier since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105754 medium vllm: vllm: Denial of Service via unvalidated multimodal parameters in scale-out endpoint since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105753 medium vllm: vllm: Denial of Service via multimodal cache desynchronization since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-6f2x-v7q7-m7m5 medium hickory-resolver follows irrelevant CNAME records since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 GHSA-jggr-w7fw-pc2j medium fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93321 medium github.com/moby/buildkit: BuildKit: Denial of Service via crafted low-level builder definition since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93315 medium github.com/moby/buildkit: BuildKit: Denial of Service via manipulated CA bundle during cleanup since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105749 medium docling: docling: Denial of Service via unbounded table span attributes since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105747 medium docling: docling: Denial of Service via excessive memory allocation in archive processing since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105746 medium docling: docling: Information disclosure via unenforced remote service restrictions since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105743 medium docling: docling: Server-Side Request Forgery via improper URL validation since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105742 medium docling: docling: Information disclosure via cross-origin header leakage during remote image fetching since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93326 medium github.com/moby/buildkit: BuildKit: Security policy bypass via crafted Git source definition since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105698 medium Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105447 medium quay: quay: global read-only superuser can access build trigger write credentials since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-71299 medium maestro: maestro: REST API write endpoints registered without authentication middleware since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-71298 medium maestro: SQL identifier injection via properties.* search filter and orderBy field since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-71297 medium maestro: maestro: gRPC broker has no auth interceptor and client mTLS is optional since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105681 medium Ghost: Authorization Bypass in Comments Feature since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105680 medium Ghost: Authorization Issue Allowed Author Role to Delete any Post since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105678 medium Ghost: Editors Could Promote Staff Users to Their Own Role since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105676 medium Ghost: Path Traversal via Locale Setting since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105648 medium Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105647 medium Ghost: Server-Side Request Forgery in Bookmark Fetching since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105646 medium Ghost: Regular Expression Denial of Service in Content Import since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105645 medium Ghost: Regular Expression Denial of Service in External Media Inliner since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-105644 medium Ghost : Stored XSS via SVG Files in Content Imports since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93323 medium github.com/moby/buildkit: BuildKit: Denial of Service via oversized build context files since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93322 medium github.com/moby/buildkit: BuildKit: Denial of Service via crafted LLB definition since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93319 medium github.com/moby/buildkit: buildkit: Denial of Service via data race triggered by external frontend since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93317 medium github.com/moby/buildkit: BuildKit: Build integrity compromise via unvalidated blob digest caching since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-93316 medium github.com/moby/buildkit: BuildKit: Denial of Service via CDI device requests when CDI is disabled since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-102576 medium quay: quay: DOM-based cross-site scripting via unvalidated redirect_url on signin page since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 CVE-2026-102295 medium quay: quay: DOM-based cross-site scripting via OAuth local callback format=json parameter since at least 24 Oct 2026 07:11 UTC build 5 Oct 2026 