CVE-2026-115570 high Electron: Mitigation for compromised eMudhra intermediate certificates since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-110975 high autotune: kruize/autotune: kruize/autotune: Datasources credential disclosure since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-106069 high nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-105482 high nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57845 high datasets: datasets: Arbitrary code execution via insecure pickle deserialization since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115478 high obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-115477 high obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57210 high Heimdall: IP Spoofing via Unvalidated Forwarding Headers since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57209 high Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57146 high PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57144 high PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57142 high PraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57121 high PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57117 high PraisonAI: Compute-bridged file tools allow shell command injection since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57114 high PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-57113 high PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56840 high PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56838 high PraisonAI recipe.run_stream skips dangerous-tool policy enforcement since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56837 high PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56836 high PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56835 high PraisonAI Slack app_mention bypasses configured user/channel authorization since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56834 high PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56833 high PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-56832 high PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals since at least 24 Oct 2026 07:11 UTC build 23 Oct 2026 CVE-2026-114616 high authlib: authlib: Authentication bypass via zero-length HMAC key since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114615 high authlib: Authlib: Authentication bypass via improper asymmetric key validation since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115419 high Strands Agents SDK: Exposure of data element to wrong session in the A2A Server since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115504 high cfitsio: cfitsio: arbitrary code execution via crafted FITS file since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115374 high github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115372 high github.com/lxc/incus: Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115355 high mistune: mistune: Arbitrary file read via path traversal in Include directive since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115352 high mistune: mistune: Denial of Service via unmatched brackets in inline link parser since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115349 high mistune: mistune: Denial of Service via deeply nested square brackets since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115348 high mistune: mistune: Denial of Service via unbalanced brackets in link parser since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-115347 high mistune: mistune: Denial of Service via unmatched square brackets since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114613 high msgpack: msgpack: Denial of Service via memory leak during map deserialization since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-75508 high graphql-core: graphql-core: Denial of Service via token limit bypass using comments since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-75507 high graphql-core: graphql-core: Denial of Service via nested inline fragments during query validation since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114605 high dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 GHSA-78g4-xqwv-q3g8 high Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 GHSA-mrv2-3pqr-j5jr high DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-94482 high next: Next.js: Denial of Service via crafted requests targeting Server Actions since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 GHSA-pxh4-856f-4h89 high PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-113872 high multer: multer: Denial of Service via aborted request during asynchronous file filtering since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-111181 high body-parser: body-parser: Denial of Service via unhandled decompression stream error since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-92709 high rsyslog: rsyslog: Path traversal via unsanitized dynaFile templates since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-111497 high brotli: Out-of-Bounds Write in Google Brotli Decoder since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-111079 high goose: goose: Shell History and Environment Leak via Terminal Integration since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-112085 high webpack-dev-server: webpack-dev-server: unauthorized backend access via unvalidated WebSocket proxy requests since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 CVE-2026-114730 high roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass since at least 24 Oct 2026 07:11 UTC build 22 Oct 2026 