Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104036 | medium | 5.8 | No | A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destinat... | 2026-10-06 |
| CVE-2026-78413 | medium | 5.5 | No | Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually... | 2026-10-06 |
| CVE-2026-78411 | medium | 6.5 | No | Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CL... | 2026-10-06 |
| CVE-2026-102576 | medium | 4.2 | No | A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XS... | 2026-10-06 |
| CVE-2026-102295 | medium | 5.4 | No | A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbit... | 2026-10-06 |
| CVE-2026-78412 | medium | 4.9 | No | Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissi... | 2026-10-06 |
| CVE-2026-77805 | high | 7.9 | No | In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper t... | 2026-10-06 |
| CVE-2026-105306 | medium | 6.5 | No | A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the... | 2026-10-06 |
| CVE-2026-105302 | medium | 5.7 | No | A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mappe... | 2026-10-06 |
| CVE-2026-104988 | high | 8.1 | No | A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is subm... | 2026-10-06 |
| CVE-2026-93321 | not reported | — | No | A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daem... | 2026-10-06 |
| CVE-2026-93315 | not reported | — | No | When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operat... | 2026-10-06 |
| CVE-2026-91107 | not reported | — | No | openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and ca... | 2026-10-06 |
| CVE-2026-103433 | not reported | — | No | Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a r... | 2026-10-06 |
| CVE-2026-93326 | not reported | — | No | A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the... | 2026-10-06 |
| CVE-2026-93323 | not reported | — | No | The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context c... | 2026-10-06 |
| CVE-2026-93322 | not reported | — | No | A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daem... | 2026-10-06 |
| CVE-2026-93320 | not reported | — | No | BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block oper... | 2026-10-06 |
| CVE-2026-93319 | not reported | — | No | A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause th... | 2026-10-06 |
| CVE-2026-93318 | not reported | — | No | A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could u... | 2026-10-06 |