🌅 Vulert Morning Vulnerability Digest — 06 Oct 2026

110 new vulnerabilities in the last 16 hours

🔴 Critical: 28
🟠 High: 24
🟡 Medium: 37
🟢 Low: 3
⚪ Unrated: 18

☠️ Malicious packages detected: 11

Flagged packages:
• documenclient
• serpacksven
• serpacksven1
• serpacksven2
• erc7730-hackathon

- 6 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-100721: vm2 Critical Authorization Bypass Vulnerability ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 10
Affected: < 3.12.2
Fixed version: 3.12.2

2. CVE-2026-92955: vm2 Sandbox Escape Vulnerability ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 10
Affected: < 3.11.8
Fixed version: 3.11.8

3. CVE-2026-92953: vm2 Package Vulnerability Allowing Host TypedArray and ArrayBuffer Intrinsics Mutation ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 10
Affected: < 3.11.8
Fixed version: 3.11.8

4. CVE-2026-92946: vm2 Critical RCE Vulnerability via Unrestricted Host Filesystem Access ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 10
Affected: < 3.11.7
Fixed version: 3.11.7

5. CVE-2026-92947: vm2 Package Vulnerability Allows Sandboxed Code to Access Host Memory ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 10
Affected: < 3.11.7
Fixed version: 3.11.7

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 07 Oct 2026

269 new vulnerabilities in the last 16 hours

🔴 Critical: 5
🟠 High: 2
🟡 Medium: 2
🟢 Low: 0
⚪ Unrated: 260

☠️ Malicious packages detected: 5

Flagged packages:
• css-jptvix-polyfill
• lore-cs
• browser-metrics-plugin.contrib
• troubleshooting
• personio-pipeline-projen

Top vulnerabilities to review:

1. CVE-2026-86540: knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json ↗

Ecosystem: npm
Severity: HIGH
CVSS: 7.8
Affected: < 0.30.0
Fixed version: 0.30.0

2. CVE-2026-41510: Coraza WAF Argument Limit Bypass Vulnerability ↗

Ecosystem: Go
Severity: HIGH
CVSS: 7.2
Affected: < 3.8.1
Fixed version: 3.8.1

3. CVE-2026-41508: Coraza Multipart Body Processing Bypass Vulnerability ↗

Ecosystem: Go
Severity: MODERATE
CVSS: 5.8
Affected: < 3.8.0
Fixed version: 3.8.0

4. CVE-2026-41504: Coraza Native Audit-Log CRLF Injection Vulnerability ↗

Ecosystem: Go
Severity: MODERATE
CVSS: 5.8
Affected: < 3.8.0
Fixed version: 3.8.0

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 08 Oct 2026

142 new vulnerabilities in the last 16 hours

🔴 Critical: 27
🟠 High: 47
🟡 Medium: 47
🟢 Low: 8
⚪ Unrated: 13

☠️ Malicious packages detected: 21

Flagged packages:
• animatecss-tailwind-adapter
• animatecss-tailwind-bridge
• tailwind-animatecss-uniform
• function-flag
• function-color

- 16 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-105857: Remote Code Execution Vulnerability in @payloadcms/plugin-form-builder ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 10
Affected: < 3.90.0
Fixed version: 3.90.0

2. CVE-2026-93605: vm2 Sandbox Escape Vulnerability Allows Host Command Execution ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 10
Affected: < 3.12.1
Fixed version: 3.12.1

3. CVE-2026-105697: Langflow OS Command Injection Vulnerability Leading to Remote Code Execution ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.9
Affected: >= 1.1.2 <= 1.9.6rc0
Fixed version: 1.10.3

4. CVE-2026-105859: Payload Package Allows Unauthorized Document Updates ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.8
Affected: < 3.90.0
Fixed version: 3.90.0

5. CVE-2026-106501: Sensitive Information Exposure in @backstage/plugin-scaffolder-backend ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.6
Affected: < 3.3.1
Fixed version: 3.3.1

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 09 Oct 2026

122 new vulnerabilities in the last 16 hours

🔴 Critical: 15
🟠 High: 24
🟡 Medium: 40
🟢 Low: 1
⚪ Unrated: 42

☠️ Malicious packages detected: 10

Flagged packages:
• @kxafunc/xbails
• kafka-roller
• kafka-helmsman
• css-overscroll-contain
• xblaxw

- 5 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-61445: PraisonAI AICoder Arbitrary File Write and Command Execution Vulnerability ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.9
Affected: >= 0.0.1 <= 4.6.9
Fixed version: 4.6.78

2. CVE-2026-107722: fast-jwt Incomplete Patch Enables RSA to HS256 Algorithm Confusion ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.8
Affected: < 6.3.0
Fixed version: 6.3.0

3. CVE-2026-106446: Handlebars JavaScript Injection Vulnerability via AST Type Confusion ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.8
Affected: < 4.7.10
Fixed version: 4.7.10

4. CVE-2026-107726: Hazelcast Arbitrary Memory Access Vulnerability ↗

Ecosystem: Maven
Severity: CRITICAL
CVSS: 9.3
Affected: 5.6.0
Fixed version: 5.7.0

5. CVE-2026-106445: Handlebars JavaScript Injection Vulnerability Leading to Remote Code Execution ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.2
Affected: < 4.7.10
Fixed version: 4.7.10

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 10 Oct 2026

58 new vulnerabilities in the last 16 hours

🔴 Critical: 10
🟠 High: 18
🟡 Medium: 22
🟢 Low: 2
⚪ Unrated: 6

☠️ Malicious packages detected: 6

Flagged packages:
• kmf-bootstrap
• test-account-portal-fe
• kmf-i18n
• @myorder-frontend-commons/analytics
• cloud-baileys

- 1 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-108261: TinaCMS Admin Iframe Vulnerability Leading to Cross-Origin Attacks ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.3
Affected: < 3.14.0
Fixed version: 3.14.0

2. CVE-2026-107845: Contao Comments Bundle XSS Vulnerability ↗

Ecosystem: Packagist
Severity: CRITICAL
CVSS: 9.3
Affected: >= 4.0.0 <= 5.3.9
Fixed version: 5.3.50

3. CVE-2026-68582: Vikunja Package Vulnerability Allows Unauthorized Access to Kanban Buckets ↗

Ecosystem: Go
Severity: CRITICAL
CVSS: 9.3
Affected: < 2.4.0
Fixed version: 2.4.0

4. CVE-2026-107806: Nginx UI Authenticated Remote Code Execution via Backup Restore App Config Overwrite ↗

Ecosystem: Go
Severity: CRITICAL
CVSS: 9
Affected: < 1.9.10-0.20260728074146-a467ed652591
Fixed version: 1.9.10-0.20260728074146-a467ed652591

5. CVE-2026-91985: Vikunja Project Access Escalation via Link Share Hash Disclosure ↗

Ecosystem: Go
Severity: HIGH
Affected: < 2.6.0
Fixed version: 2.6.0

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 12 Oct 2026

2 new vulnerabilities in the last 16 hours

🔴 Critical: 2
🟠 High: 0
🟡 Medium: 0
🟢 Low: 0
⚪ Unrated: 0

☠️ Malicious packages detected: 2

Flagged packages:
• ap3-foundations-ui
• @s4yhiitestpoc/r2-https-b

🔎 Browse the Vulert Vulnerability Database

📊 Vulert Weekly Vulnerability Report — 05 Oct – 12 Oct 2026

This week Vulert added:

2147 new vulnerabilities

🔴 Critical: 289
🟠 High: 271
🟡 Medium: 256
🟢 Low: 29
⚪ Unrated: 1302

☠️ Malicious package advisories this week: 236

Flagged packages:
• @subql/common
• @diezyclutch/baileys
• dzyclutch
• dzyclutch-baileys
• dzyclutch-libsignal-node

- 231 more malicious packages ↗

✅ 1164 vulnerabilities have a known fixed version

Most affected ecosystems:

1. Debian:12 — 678
2. npm — 356
3. Bitnami — 176
4. Red Hat — 156
5. PyPI — 134

Packages with the most new vulnerability findings:

1. chromium — 247
2. linux — 219
3. thrift — 61
4. ghost — 54
5. imagemagick — 33

Critical vulnerabilities to review:

• CVE-2026-91135: Apache Thrift C++ THeaderTransport Heap Buffer Overflow Vulnerability ↗

Severity: Critical
Fixed version: 0.25.0

• CVE-2026-83632: Apache Thrift C++ THttpTransport Buffer Overflow Vulnerability ↗

Severity: Critical
Fixed version: 0.25.0

• CVE-2026-19445: python-min Use-After-Free Vulnerability in SSLContext Handling ↗

Severity: Critical
Fixed version: 3.10.22

• CVE-2026-19445: Python SSLContext Use-After-Free Vulnerability ↗

Severity: Critical
Fixed version: 3.10.22

• CVE-2026-19445: libpython - Use-After-Free Vulnerability in SSLContext Handling ↗

Severity: Critical
Fixed version: 3.10.22

🔎 Browse the Vulert Vulnerability Database

⭐ Add Vulert as a Preferred Source in Google

🌅 Vulert Morning Vulnerability Digest — 13 Oct 2026

1 new vulnerabilities in the last 16 hours

🔴 Critical: 1
🟠 High: 0
🟡 Medium: 0
🟢 Low: 0
⚪ Unrated: 0

☠️ Malicious packages detected: 1

Flagged packages:
• npp-ml

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 14 Oct 2026

69 new vulnerabilities in the last 16 hours

🔴 Critical: 16
🟠 High: 29
🟡 Medium: 8
🟢 Low: 0
⚪ Unrated: 16

☠️ Malicious packages detected: 13

Flagged packages:
• opencode2
• opencode2-darwin-arm64
• opencode2-windows-arm64
• opencode2-windows-x64
• opencode2-darwin-x64

- 8 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-105016: Microsoft.Native.Quic.MsQuic.Schannel Remote Code Execution Vulnerability ↗

Ecosystem: NuGet
Severity: CRITICAL
CVSS: 9.8
Affected: 2.5.11-ci.156755675
Fixed version: 2.5.11-ci.159417053

2. CVE-2026-88092: Microsoft.AspNetCore.App.Runtime Critical Security Feature Bypass Vulnerability ↗

Ecosystem: NuGet
Severity: CRITICAL
CVSS: 9.4
Affected: >= 8.0.0 <= 8.0.8
Fixed version: 8.0.32

3. CVE-2026-70188: Microsoft.AspNetCore.App.Runtime - ASP.NET Core Security Feature Bypass Vulnerability ↗

Ecosystem: NuGet
Severity: CRITICAL
CVSS: 9.1
Affected: < 11.0.0-rc.2
Fixed version: 11.0.0-rc.2

4. CVE-2026-70035: Microsoft.WindowsDesktop.App.Runtime Remote Code Execution Vulnerability ↗

Ecosystem: NuGet
Severity: HIGH
CVSS: 8.8
Affected: >= 10.0.0 <= 10.0.9
Fixed version: 10.0.13

5. CVE-2026-70007: Microsoft.WindowsDesktop.App.Runtime - High Severity Remote Code Execution Vulnerability ↗

Ecosystem: NuGet
Severity: HIGH
CVSS: 8.8
Affected: >= 9.0.0 <= 9.0.9
Fixed version: 9.0.21

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 15 Oct 2026

16 new vulnerabilities in the last 16 hours

🔴 Critical: 2
🟠 High: 1
🟡 Medium: 1
🟢 Low: 2
⚪ Unrated: 10

☠️ Malicious packages detected: 2

Flagged packages:
• @xxxfnbs21/hello-demo
• saeka

Top vulnerabilities to review:

1. CVE-2026-72923: Microsoft.OpenApi.YamlReader Denial of Service via YAML Alias Expansion ↗

Ecosystem: NuGet
Severity: HIGH
CVSS: 7.5
Affected: >= 3.0.0 <= 3.9.0
Fixed version: 3.10.0

2. CVE-2026-62847: Metalama Framework and Tool Local Code Execution Vulnerability ↗

Ecosystem: NuGet
Severity: MODERATE
CVSS: 8.2
Affected: >= 2026.1.0-preview <= 2026.1.9-preview
Fixed version: 2026.1.19

3. CVE-2026-14966: BBOT Symlink Guard Bypass Vulnerability in Unarchive Module ↗

Ecosystem: PyPI
Severity: LOW
CVSS: 3.1
Affected: >= 2.3.1 <= 2.8.6
Fixed version: 3.0.0

4. CVE-2026-59180: Apprise Package Auth Header Exposure via Cross-Origin Redirects ↗

Ecosystem: PyPI
Severity: LOW
CVSS: 3.1
Affected: >= 0.0.1 <= 1.9.9
Fixed version: 1.11.0

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 16 Oct 2026

121 new vulnerabilities in the last 16 hours

🔴 Critical: 13
🟠 High: 25
🟡 Medium: 26
🟢 Low: 4
⚪ Unrated: 53

☠️ Malicious packages detected: 7

Flagged packages:
• proxyrobika
• asistenyorstore
• @developmentyora/yorakids
• xmd-baileys
• fromthehotel-poems

- 2 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-94603: Podman Container Checkpointing Vulnerability Leading to Sandbox Bypass ↗

Ecosystem: Go
Severity: CRITICAL
CVSS: 10
Affected: < 5.8.8
Fixed version: 5.8.8

2. CVE-2026-104252: Vitess Reflected XSS Vulnerability in vttablet/twopcz Handler ↗

Ecosystem: Go
Severity: CRITICAL
CVSS: 9.8
Affected: < 0.23.5
Fixed version: 0.23.5

3. CVE-2026-102989: TanStack Router Unauthenticated Reflected XSS Vulnerability ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.3
Affected: < 1.169.39
Fixed version: 1.169.39

4. CVE-2026-102748: Dgraph Unauthenticated HTTP Admin Endpoint Vulnerability Leading to Denial of Service ↗

Ecosystem: Go
Severity: CRITICAL
CVSS: 9.2
Affected: < 25.4.0
Fixed version: 25.4.0

5. CVE-2026-77524: KEDA Privilege Escalation via TriggerAuthentication ↗

Ecosystem: Go
Severity: CRITICAL
CVSS: 9.9

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 17 Oct 2026

21 new vulnerabilities in the last 16 hours

🔴 Critical: 11
🟠 High: 4
🟡 Medium: 2
🟢 Low: 4
⚪ Unrated: 0

☠️ Malicious packages detected: 9

Flagged packages:
• @beloved-lenora/opencode-shell-guard
• @beloved-lenora/opencode-shared-rpc
• @beloved-lenora/opencode-todo
• @beloved-lenora/opencode-stats
• @beloved-lenora/opencode-orchestrator

- 4 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-105192: LMCache Remote Code Execution via Unsafe Deserialization in Multiprocess Mode Transport ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.8
Affected: >= 0.3.10 <= 0.5.6rc5
Fixed version: 0.5.6

2. CVE-2026-96620: Claude Agent SDK Arbitrary Command Execution via Argument Injection ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.2
Affected: >= 0.0.23 <= 0.2.99
Fixed version: 0.2.121

3. CVE-2026-96627: Arcane Package Allows Admin Account Takeover via Password Reset ↗

Ecosystem: Go
Severity: HIGH
CVSS: 8.8
Affected: < 2.6.0
Fixed version: 2.6.0

4. CVE-2026-100349: kin-openapi Nil-Pointer Panic in ValidateResponse for Response Headers ↗

Ecosystem: Go
Severity: HIGH
CVSS: 8.2
Affected: < 0.146.0
Fixed version: 0.146.0

5. GHSA-6fj4-rcr3-r7rr: Stack Overflow Vulnerability in lopdf: Unbounded Recursion in PDF Parsing ↗

Ecosystem: crates.io
Severity: HIGH
CVSS: 7.5
Affected: < 0.42.0
Fixed version: 0.42.0

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 18 Oct 2026

3 new vulnerabilities in the last 16 hours

🔴 Critical: 1
🟠 High: 0
🟡 Medium: 0
🟢 Low: 0
⚪ Unrated: 2

☠️ Malicious packages detected: 1

Flagged packages:
• leakdeep

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 19 Oct 2026

462 new vulnerabilities in the last 16 hours

🔴 Critical: 10
🟠 High: 0
🟡 Medium: 0
🟢 Low: 0
⚪ Unrated: 452

☠️ Malicious packages detected: 10

Flagged packages:
• @pkgship/frpc-linux-arm64
• @fluxionii/baileys
• fabtoolkit
• fabdeploycheck
• @fcsmc/commercial-analytics

- 5 more malicious packages ↗

🔎 Browse the Vulert Vulnerability Database

📊 Vulert Weekly Vulnerability Report — 12 Oct – 19 Oct 2026

This week Vulert added:

2346 new vulnerabilities

🔴 Critical: 139
🟠 High: 130
🟡 Medium: 103
🟢 Low: 16
⚪ Unrated: 1958

☠️ Malicious package advisories this week: 119

Flagged packages:
• @zaka13/zakasite
• @ikanngeming/blubub
• @ikanngeming/npm
• ikanngeming
• nakkinpm

- 114 more malicious packages ↗

✅ 1448 vulnerabilities have a known fixed version

Most affected ecosystems:

1. Debian:12 — 787
2. Red Hat — 208
3. PyPI — 158
4. Bitnami — 151
5. Debian:13 — 122

Packages with the most new vulnerability findings:

1. linux — 482
2. freerdp2 — 62
3. firefox-esr — 61
4. chromium — 47
5. curl — 30

Critical vulnerabilities to review:

• CVE-2026-94603: Podman Container Checkpointing Vulnerability Leading to Sandbox Bypass ↗

Severity: CRITICAL
CVSS: 10
Fixed version: 5.8.8

• CVE-2026-105192: LMCache Remote Code Execution via Unsafe Deserialization in Multiprocess Mode Transport ↗

Severity: CRITICAL
CVSS: 9.8
Fixed version: 0.5.6

• CVE-2026-97229: GitLab Integer Overflow Vulnerability Leading to Arbitrary Code Execution ↗

Severity: Critical
Fixed version: 19.2.8

• CVE-2026-78663: Golang HTTP/2 Server Double Flow Control Refund Vulnerability ↗

Severity: Critical
Fixed version: 1.26.9

• CVE-2026-56857: Golang Root.Mkdir Vulnerability Allows Directory Creation Outside Root on Windows ↗

Severity: Critical
Fixed version: 1.26.9

🔎 Browse the Vulert Vulnerability Database

⭐ Add Vulert as a Preferred Source in Google

🌅 Vulert Morning Vulnerability Digest — 20 Oct 2026

150 new vulnerabilities in the last 16 hours

🔴 Critical: 21
🟠 High: 0
🟡 Medium: 0
🟢 Low: 0
⚪ Unrated: 129

☠️ Malicious packages detected: 21

Flagged packages:
• asurion
• @decoopus/chatgpt-setup
• @decoopus/claude-setup
• chatgpt-desktop-setup
• api-anthropic

- 16 more malicious packages ↗

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 21 Oct 2026

112 new vulnerabilities in the last 16 hours

🔴 Critical: 23
🟠 High: 19
🟡 Medium: 30
🟢 Low: 5
⚪ Unrated: 35

☠️ Malicious packages detected: 20

Flagged packages:
• nwfp-build-config
• semverr
• semmver
• semveer
• semvver

- 15 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-112403: Pillow Heap Buffer Overflow in ImagingJpegDecode ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.2
Affected: >= 1.0 <= 9.5.0
Fixed version: 13.0.0

2. GHSA-hq85-5cpj-mr62: Critical Vulnerability in uv Package: Compromised CA Store Trusting emSign Root ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.1
Affected: >= 0.0.5 <= 0.9.9
Fixed version: 0.13.4

3. GHSA-6q48-6c7w-9gw2: Critical Vulnerability in Certifi: Compromised Intermediate CA Keys ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.1
Affected: >= 2019.11.28 <= 2026.7.22
Fixed version: 2026.10.19

4. CVE-2026-112896: Pillow Heap Out-of-Bounds Read Due to TIFF Encoder ColorMap Mismatch ↗

Ecosystem: PyPI
Severity: HIGH
CVSS: 8.8
Affected: >= 1.0 <= 9.5.0
Fixed version: 13.0.0

5. CVE-2026-112404: Pillow OOB Read Vulnerability Leading to Heap Memory Disclosure ↗

Ecosystem: PyPI
Severity: HIGH
CVSS: 8.8
Affected: >= 10.0.0 <= 9.5.0
Fixed version: 13.0.0

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 22 Oct 2026

253 new vulnerabilities in the last 16 hours

🔴 Critical: 64
🟠 High: 11
🟡 Medium: 14
🟢 Low: 1
⚪ Unrated: 163

☠️ Malicious packages detected: 62

Flagged packages:
• log-sink-testmetest
• pixel-map-testmetest
• test-brotli-testmetest
• test-brotli2-testmetest
• journey-test-helloshell

- 57 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-112393: Pillow Heap Buffer Overflow Vulnerability When Saving TIFF to BytesIO ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.2
Affected: >= 10.0.0 <= 9.5.0
Fixed version: 13.0.0

2. CVE-2026-112900: Pillow Command Injection Vulnerability Leading to Potential RCE ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.2
Affected: >= 10.0.0 <= 9.5.0
Fixed version: 13.0.0

3. CVE-2026-112902: Pillow Memory Disclosure and Segfault via Crafted TIFF Tags ↗

Ecosystem: PyPI
Severity: HIGH
CVSS: 8.8
Affected: >= 1.0 <= 9.5.0
Fixed version: 13.0.0

4. CVE-2026-112406: Pillow Infinite Loop Vulnerability in PdfParser ↗

Ecosystem: PyPI
Severity: HIGH
CVSS: 8.7
Affected: >= 10.0.0 <= 9.5.0
Fixed version: 13.0.0

5. CVE-2026-112399: Pillow Memory Allocation Vulnerability Due to APNG Background Disposal ↗

Ecosystem: PyPI
Severity: HIGH
CVSS: 8.7
Affected: >= 10.0.0 <= 9.5.0
Fixed version: 13.0.0

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 23 Oct 2026

179 new vulnerabilities in the last 24 hours

🔴 Critical: 35
🟠 High: 26
🟡 Medium: 20
🟢 Low: 7
⚪ Unrated: 91

☠️ Malicious packages detected: 30

Flagged packages:
• aanthropic
• 1h1
• agentic-awesome-skills
• opencode-skills-collection
• @pkgship/frpc-darwin-amd64

- 25 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-96639: Pillow multi-frame image loading can cause memory corruption and command execution ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.8
Affected: >= 11.0.0 <= 12.3.0
Fixed version: 13.0.0

2. GHSA-673q-mjm6-r5xr: Unauthenticated remote code execution in Next.js cache functions ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.5
Affected: < 16.4.1
Fixed version: 16.4.1

3. GHSA-2464-fhr4-w9xw: Unauthenticated RCE in Next.js Image Optimization API ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.5
Affected: < 15.5.28
Fixed version: 15.5.28

4. GHSA-cg2g-xh64-v4q7: DOMPurify template-expression bypass in attached shadow roots ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.2
Affected: < 3.4.17
Fixed version: 3.4.17

5. CVE-2026-114139: Middleware bypass in @sentry/nextjs tunnel routes ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.1
Affected: < 9.47.2
Fixed version: 9.47.2

🔎 Browse the Vulert Vulnerability Database

🌅 Vulert Morning Vulnerability Digest — 24 Oct 2026

624 new vulnerabilities in the last 24 hours

🔴 Critical: 36
🟠 High: 27
🟡 Medium: 36
🟢 Low: 13
⚪ Unrated: 512

☠️ Malicious packages detected: 30

Flagged packages:
• onsokets
• skillward
• kestreljob
• flintqueue
• juniperrun

- 25 more malicious packages ↗

Top vulnerabilities to review:

1. CVE-2026-115889: Wasmtime Cranelift miscompilation can enable sandbox escape ↗

Ecosystem: crates.io
Severity: CRITICAL
CVSS: 9.9
Affected: < 36.0.19
Fixed version: 36.0.19

2. CVE-2026-77366: obsidian-tc tokens can access arbitrary configured vaults ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.9
Affected: < 1.3.1
Fixed version: 1.3.1

3. CVE-2026-77363: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on ... ↗

Ecosystem: npm
Severity: CRITICAL
CVSS: 9.6
Affected: < 1.3.1
Fixed version: 1.3.1

4. CVE-2026-112398: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution ↗

Ecosystem: PyPI
Severity: CRITICAL
CVSS: 9.2
Affected: >= 1.0 <= 9.5.0
Fixed version: 13.0.0

5. CVE-2026-114509: Laravel TokenGuard authentication bypass via non-string credentials ↗

Ecosystem: Packagist
Severity: CRITICAL
CVSS: 9.2
Affected: >= v13.0.0 <= v13.9.0
Fixed version: 13.29.0

🔎 Browse the Vulert Vulnerability Database