CVEs published in October 2026

CVE-2026-106414High

Improper input validation in Mobile

CVE-2026-106408High

Protection mechanism failure in Mobile

CVE-2026-106196High

Missing authorization in Navigation

CVE-2026-106244High

Incorrect authorization in Permissions

CVE-2026-106185High

Improper input validation in Viz

CVE-2026-106393High

Use after free in Storage

CVE-2026-106426High

Race condition in Fonts

CVE-2026-84411Unrated

MikroTik: integer underflow in HTTP request body handling has been identified in the RouterOS web management service (the service behind WebFig, listening on the www and www-ssl ports)

CVE-2025-42611Unrated

MikroTik: issue has been published regarding how RouterOS services decide which certificate authorities (CAs) to trust

CVE-2026-93321Medium

Docker: malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon

CVE-2026-93315Medium

Docker: When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup

CVE-2026-103433Medium

Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs

CVE-2026-21589CriticalCISA KEV

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

CVE-2026-93326Medium

Security policy bypass via crafted Git source definition

CVE-2026-104714High

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts

CVE-2026-104713Medium

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin

CVE-2026-104712High

Denial of Service via resource amplification in tag library

CVE-2026-104711Critical

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts

CVE-2026-93323Medium

The Dockerfile frontend loaded the Dockerfile and.dockerignore files of a build context into memory without a size limit

CVE-2026-93322Medium

Docker: malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon

CVE-2026-93320High

Unintended host device access via special file inodes

CVE-2026-93319Medium

malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic

CVE-2026-93318High

arbitrary code execution via cache poisoning from mismatched layer identifiers

CVE-2026-93317Medium

Docker: unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest

CVE-2026-93316High

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices

CVE-2026-88779HighCISA KEV

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-71888High

Security bypass via unvalidated attributes in CMS AuthenticatedData parser

CVE-2026-71889High

Cryptographic Failure org.bouncycastle:bcpkix-jdk18on, org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

CVE-2026-102795High

Security restriction bypass via improper access control

CVE-2026-59265High

code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user

CVE-2026-90970Critical

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway

CVE-2026-66054High

Denial of Service via improper handling of compressed data

CVE-2026-61374High

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings

CVE-2026-63772High

Unauthenticated single-packet crash of Go Thrift servers via the THeader transform count

CVE-2026-66055High

Denial of Service via uncontrolled resource allocation

CVE-2026-66081High

Denial of Service via uninitialized pointer access in c_glib bindings

CVE-2026-66331Medium

Denial of Service via excessive resource allocation in Delphi buffered transport

CVE-2026-66837High

Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings

CVE-2026-66858High

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack

CVE-2026-66859High

NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings

CVE-2026-83632Critical

Denial of Service via crafted HTTP requests

CVE-2026-83663High

Uncontrolled Recursion vulnerability in Apache Thrift go bindings

CVE-2026-83745High

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings

CVE-2026-85476High

c_glib `read_all` spins when the underlying read returns 0

CVE-2026-96289High

php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard

CVE-2026-96287High

Perl `FramedTransport` reads and TLS socket writes re-slice the remaining buffer on every call (quadratic)

CVE-2026-96286High

Uncaught exception vulnerability in Apache Thrift Perl bindings

CVE-2026-96277High

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings

CVE-2026-94658High

Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings

CVE-2026-94657High

Denial of Service via improper resource allocation in JavaME bindings

CVE-2026-94656High

rb `TJsonProtocol`/`TJSONProtocol` has no string size bound

CVE-2026-94655High

Lua `TJsonProtocol` string/number readers have no size bound and are quadratic

CVE-2026-94654High

Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings

CVE-2026-94653High

PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)

CVE-2026-94652Medium

Missing release of memory after effective lifetime vulnerability in Apache Thrift c++ bindings

CVE-2026-94648High

dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

CVE-2026-94646High

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings

CVE-2026-94638Medium

Denial of Service via uncontrolled resource allocation in PHP bindings

CVE-2026-94637High

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings

CVE-2026-94636High

Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

CVE-2026-92834Medium

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server

CVE-2026-90440High

Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer

CVE-2026-87117High

PHP `thrift_protocol` accelerator dereferences a missing container-element spec

CVE-2026-86537High

Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings

CVE-2026-86536Medium

Prototype pollution in JavaScript bindings

CVE-2026-86535High

Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol

CVE-2026-85088High

Man-in-the-middle attacks via improper certificate validation

CVE-2026-85087High

Python ≥3.12 host-name check silently becomes a no-op

CVE-2026-85086High

Information disclosure via improper certificate validation in Perl bindings

CVE-2026-82459High

Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport

CVE-2026-82458High

Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings

CVE-2026-96288High

Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings

CVE-2026-96292High

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings

CVE-2026-96294High

nodejs web server: no `error` listener on an upgraded WebSocket connection

CVE-2026-96990High

Erlang thrift_json_protocol reads a whole message with no size bound

CVE-2026-94642High

Uncaught exception vulnerability in Apache Thrift PHP bindings

CVE-2026-94644High

PHP `TJSONProtocol` string/number readers have no size bound

CVE-2026-94645High

Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

CVE-2026-94650High

Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings

CVE-2026-94651High

Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error

CVE-2026-85483Medium

c_glib TZlibTransport reports a full read after a premature stream end

CVE-2026-85493High

Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings

CVE-2026-85494High

Denial of Service via improper message handling in language bindings

CVE-2026-91135Critical

Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport

CVE-2026-91137High

PHP `thrift_protocol` accelerator: zero-byte container elements

CVE-2026-93925High

Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol

CVE-2026-93926High

Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport

CVE-2026-94633High

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings

CVE-2026-94634High

Python `TJSONProtocol` has a string length limit that is off by default

CVE-2026-103885High

Denial of Service via crafted telephone numbers

CVE-2026-103877High

org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization

CVE-2026-103880Unrated

Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

CVE-2026-103878Unrated

Apache Directory LDAP API: Injection of plaintext responses during StartTLS

CVE-2026-103552High

org.apache.directory.api/api-ldap-codec-core: Apache Directory LDAP API: Denial of Service via deeply nested search filter

CVE-2026-94639High

CVE-2026-61373High

Denial of Service via unbounded resource allocation in TSaslNonblockingServer

CVE-2026-102731High

Denial of Service via excessive memory allocation

CVE-2026-94635High

Denial of Service via improper length parameter handling in Lua bindings

CVE-2026-96940High

Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2026-63686High

NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails