CVE-2026-101781 high mysql: mysql: Server takeover via Group Replication GCS since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101775 high mysql: mysql: unauthorized data modification via replication component since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101773 high mysql: MySQL: Denial of Service via the Group Replication plugin since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101772 high mysql: mysql: unauthorized server takeover since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101771 high mysql: mysql: complete service takeover via network access since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101770 high mysql: mysql: System takeover via client programs since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101679 high mysql: mysql: Denial of Service via multiple protocols since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-111758 high markdown-it: markdown-it: Denial of Service via unclosed link reference definitions since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113869 high thunderbird: thunderbird: Use-after-free via S/MIME decryption password prompt since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113725 high virtualenv: virtualenv: arbitrary code execution via crafted environment name since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113723 high virtualenv: virtualenv: Arbitrary code execution via malicious prompt text since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113722 high virtualenv: virtualenv: arbitrary code execution via improperly quoted interpreter paths in script launchers since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113709 high github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: argocd: A Kustomize Helm config home can run commands in the repo-server since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113708 high github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: A Kustomize remote ref can run commands in the repo-server since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-111767 high @modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113711 high ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113672 high argo-cd: github.com/argoproj/argo-cd/v3: github.com/argoproj/argo-cd/v2: argo-cd: A Jsonnet import can read files from the repo-server since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113666 high ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-111756 high follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113658 high ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-111765 high A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-111764 high A2A Java SDK has a fail-open default task authorization since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-95168 high thefuck: thefuck: Arbitrary code execution via insecure rule loading since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112943 high launch-editor: launch-editor: Arbitrary code execution via improper argument escaping on Windows since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112942 high launch-editor: launch-editor: Command injection via improper file path validation since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-101296 high tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-105941 high kroxylicious-kms-provider-azure-key-vault-kms: Streams for Apache Kafka Kroxylicious: Azure Key Vault SSRF exfiltrates bearer token via untrusted EDEK vaultName since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-105949 high cruise-control: Streams for Apache Kafka Cruise Control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-105312 high console-operator: Streams for Apache Kafka Console: tenant-controlled container image on ClusterRole-bound pod enables namespace-to-cluster privilege escalation since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-105311 high console-operator: Streams for Apache Kafka Console: cross-namespace KafkaUser Secret exfiltration via confused deputy since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-113356 high dokuwiki: dokuwiki: Arbitrary code execution via insecure draft deserialization since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-112177 high ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8 since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-86922 high webkitgtk: WebKitGTK: Arbitrary code execution via type confusion since at least 24 Oct 2026 07:11 UTC build 20 Oct 2026 CVE-2026-53995 high mlflow: mlflow: Arbitrary file write via FileStore path traversal since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112896 high pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112895 high pillow: pillow: Denial of service via crafted PDF during append operations since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112894 high pillow: pillow: Denial of Service via crafted multi-frame image conversion since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112893 high pillow: Pillow: Denial of Service via invalid pointer free during font rendering since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112892 high pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112406 high pillow: pillow: Denial of Service via infinite loop during PDF page rewriting since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112405 high pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112404 high pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112402 high pillow: pillow: Denial of service via double free during image transformation since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112400 high pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112399 high pillow: pillow: Denial of service via crafted APNG image since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112397 high pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112392 high pillow: pillow: Denial of Service via zero-size images in rank filters since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112261 high gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112257 high gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 CVE-2026-112391 high pillow: Pillow: Denial of Service via unbounded recursion in PDF parser since at least 24 Oct 2026 07:11 UTC build 19 Oct 2026 