A cross-site scripting (XSS) vulnerability identified as CVE-2026-114538 affects Microsoft product version 3.0. The vulnerability is categorized as moderately critical and relates to the Bootstrap component. No CVSS score or detailed technical impact information is provided.
CVE-2026-102554 is a high-severity vulnerability in Keycloak related to allocation of resources without limits or throttling during Java object deserialization in Google Guava versions 4. This flaw can lead to excessive resource consumption. Fixed versions 26.4.2-r4 and 26.7.5-r2 address this issue.
CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component of Keycloak. It affects multiple packages and allows for potential remote code execution or denial of service. The flaw exists in the c/dec/decode function of the Brotli decoder. Fixed versions 26.4.2-r4 and 26.7.5-r3 address this issue.
A security vulnerability (CVE-2026-39882) affects the kedacore-http-add-on package, which uses OpenTelemetry-Go, the Go implementation of OpenTelemetry. Versions prior to 0.13.0-r2 are affected. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts availability without affecting confidentiality or integrity. A patch is available in version 0.13.0-r2.
A security vulnerability identified as GHSA-gcjh-h69q-9w9g affects multiple versions of the kedacore-http-add-on package. The issue has been addressed in versions 0.14.0-r2 and 0.13.0-r2. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.3, indicating a network attack vector with low complexity and no privileges required. No known exploits are reported in the wild.
CVE-2026-84303 is a medium severity vulnerability affecting the Kedacore http add-on, specifically in the gRPC-Go implementation. It impacts versions prior to 0.13.0-r2 and 0.14.0-r2. A fix is available in versions 0.13.0-r2 and 0.14.0-r2. No known exploits are reported in the wild.
CVE-2026-53572 is a medium severity vulnerability affecting the kedacore-http-add-on, a Kubernetes-based Event Driven Autoscaling component (KEDA). The flaw impacts versions prior to 0.13.0-r2 and 0.14.0-r2. It has a CVSS 3.1 base score of 5.9, indicating network attack vector with high complexity and low privileges required. The vulnerability allows high confidentiality impact and low integrity impact without affecting availability. Fixed versions 0.13.0-r2 and 0.14.0-r2 are available.
A high-severity security vulnerability affecting the dex package was fixed in version 2.44.0-r12. The vulnerability does not impact confidentiality or integrity but causes a significant availability impact. Versions prior to 2.44.0-r12 are affected.
A stored cross-site scripting (XSS) vulnerability exists in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin versions from 5.16.2 up to but not including 5.16.5. The plugin does not properly escape certain customer-supplied order fields, such as billing and shipping addresses and customer order notes, in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to inject malicious scripts that execute when a shop administrator views these documents.
Trail of Bits fickling versions through 0.1.12 contain a vulnerability in the _process_import() method that trusts imported names from standard library modules without verifying their behavior. This leads to the OvertlyBadEvals analysis pass skipping dangerous calls, allowing arbitrary code execution or file writes via trusted but unsafe callables. Demonstrated exploits include arbitrary code execution through dataclasses._create_fn and mailcap.findmatch, and arbitrary file writes via readline methods. The vulnerability is due to trusting module origin for callable safety and is distinct from a related CVE-2026-118938. The issue remains in released versions through 0.1.12, with a pending fix on the vendor master branch.
A vulnerability in the Python package 'fickling' version 0.1.12 allows arbitrary code execution via a crafted pickle containing a STACK_GLOBAL operand with a dotted __qualname__. The flaw arises because the pickle's find_class resolves dotted attribute paths to arbitrary attributes rather than restricting to module-level functions, bypassing the security checks in fickling.load(). This enables execution of the optparse.Values.read_file method, which executes code from a file. The issue is distinct from other module-origin trust weaknesses and remains unpatched as of the latest vendor commit in October 2026.
CVE-2026-110176 is a high-severity authorization vulnerability in the Drupal 7 File Force Download module versions 7.1.0 through 7.1.2. The module improperly grants access to files in the temporary:// scheme or other stream wrappers by returning download headers without proper access checks when the download=1 parameter is appended to the file URL. This allows unauthenticated users to bypass intended access restrictions and download files they should not be able to access. The issue does not affect files in the public or private schemes. The vulnerability is fixed in version 7.1.3.
CVE-2026-77152 is an improper authorization vulnerability in the Field Collection module for Drupal 7. It allows users with the "edit field collections" permission to bypass access controls on the parent entity. Specifically, such users can edit or delete field collection items attached to entities they do not have permission to edit. The flaw exists in versions 7.x-1.0 through 7.x-1.2 of the module. The vulnerability is due to the access check granting edit and delete rights without verifying access to the host entity. The fix requires verifying access to the parent entity in addition to the field collection permission.
CVE-2026-117656 is an authentication bypass vulnerability in the Sign in with Apple strategy of the pow-auth Assent library. The flaw allows an unauthenticated remote attacker to impersonate another user by manipulating the user parameter in the authorization callback. This parameter, controlled by the client, can override verified ID token claims, enabling attackers to replace critical identity attributes such as subject and email. The vulnerability affects versions from 0.1.25 up to but not including 0.3.2 and has been fixed in version 0.3.2.
Kubeflow Pipelines API server versions through 2.17.3 decompress uploaded pipeline archives without sufficient limits on expanded data size. This allows a crafted compressed archive (ZIP or gzip tar) to consume excessive memory during decompression, potentially exhausting server resources and causing service interruption. The vulnerability can be triggered by unauthenticated callers who can reach the upload endpoints, as decompression occurs before authorization. The issue is fixed in version 2.18.0, which introduces bounds on compressed input and extracted data sizes.
Kubeflow Pipelines API server contains an authorization bypass vulnerability in the run-log endpoint, allowing unauthorized users who can access the backend and know a run ID to read logs of that run or unrelated pods in the same namespace. This can expose sensitive workload data or credentials. The issue affects versions through 2.17.3 and is fixed in version 2.18.0.
pypdf versions prior to 6.21.4 contain a vulnerability where opening an incomplete PDF file without a trailer can cause an infinite loop during the search for the standard xref table. This flaw allows an attacker to craft a malicious PDF that triggers this behavior. The issue has been fixed in pypdf version 6.21.4.
A high-severity vulnerability in pypdf prior to version 6.21.4 allows an attacker to craft a malicious PDF that causes large memory usage when parsing the page tree with many shared resources. This issue has been fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.
A vulnerability in pypdf prior to version 6.21.4 allows an attacker to craft a malicious PDF that triggers an infinite loop when cloning a DictionaryObject. This flaw has been assigned CVE-2026-119205 and is rated high severity with a CVSS score of 7.1. The issue is fixed in pypdf version 6.21.4. Users unable to upgrade immediately can apply the changes from the referenced pull request as a workaround.