CVE-2026-101295 medium oc-mirror: oc-mirror: Path traversal / arbitrary file write in operator catalog image extraction since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 GHSA-96h4-vgxj-gvm2 medium Nest: Unbounded memory growth in the NestJS TCP microservice transport since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-103118 medium GraphicsMagick: GraphicsMagick: Denial of Service via uncontrolled recursion in WPG file handler since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-13720 medium grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-13719 medium github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-94029 medium org.apache.sshd/sshd-sftp: Apache MINA SSHD: Denial of Service via memory exhaustion in SFTP check-file extension since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102588 medium Moodle: csrf in xml grade import since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102586 medium Moodle: xss via password reset link due to insufficient username escaping since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102585 medium Moodle: group validation missing when enrolling user to course since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102584 medium Moodle: missing capability check allows unauthorised grade penalty recalculation since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102582 medium Moodle: manual enrolment page accessible when plugin disabled since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102581 medium Moodle: xss in forum post templates due to insufficient escaping since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102580 medium Moodle: arbitrary class instantiation via report builder audience classname since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102579 medium Moodle: user profile information disclosure via grade web service since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-102577 medium Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-92872 medium pgpool-II: pgpool-II: Information disclosure via log files since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-92869 medium pgpool-II: pgpool-II: Denial of Service via out-of-bounds write since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 CVE-2026-92868 medium pgpool-II: pgpool-II: Authentication bypass via improper certificate validation since at least 24 Oct 2026 07:11 UTC build 30 Sep 2026 GHSA-g57g-f23g-4646 medium Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 GHSA-p634-w6r4-rjp2 medium adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 GHSA-c6fg-446q-cg94 medium adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-74225 medium U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-74222 medium U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget i since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-74221 medium U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_r ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-74220 medium U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-71971 medium U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an ou ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-81842 medium grafana: grafana: Authorization bypass via missing destination folder permission check since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-81841 medium grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102938 medium virtualenv: virtualenv: Arbitrary code execution via configuration injection in prompt values since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102904 medium jupyterlab: JupyterLab: Information disclosure via extension uninstallation argument injection since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102620 medium poppler: poppler: Data corruption via integer overflow in FoFiTrueType::cvtSfnts since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102325 medium chromium-browser: skia: chromium-browser: Uninitialized resource in Skia since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102320 medium chromium-browser: chromium-browser: Missing authorization in CORS since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102312 medium chromium-browser: chromium-browser: UI misrepresentation in Omnibox since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102310 medium chromium-browser: chromium-browser: Missing authorization in Payments since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102305 medium chromium-browser: chromium-browser: UI misrepresentation in SignIn since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102303 medium chromium-browser: chromium-browser: Uninitialized resource in GPU since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102300 medium chromium-browser: chromium-browser: Uninitialized resource in WebGPU since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102830 medium jupyterlab: jupyterlite-core: JupyterLab: Arbitrary code execution via crafted language pack since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102824 medium russh: russh: Cryptographic fallback bypass via missing public key validation since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102821 medium russh: russh: Denial of Service via unbounded memory exhaustion during stalled key renegotiation since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102820 medium pageant: pageant: Denial of Service via untrusted response length in shared memory since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 GHSA-8vvx-rff5-p5rq medium Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95384 medium chromium-browser: Race condition in Transactions Platform since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95382 medium chromium-browser: Improper input validation in Auth since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95381 medium chromium-browser: Improper input validation in Printing since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95376 medium chromium-browser: Externally controlled reference in DevTools since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95375 medium chromium-browser: Incorrect authorization in BrowserTag since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95374 medium chromium-browser: Incorrect authorization in Network since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95371 medium chromium-browser: Missing authorization in Views since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 