{ "schemaVersion": 1, "site": "https://cveboard.org", "generatedAt": "2026-10-23T06:52:43.954Z", "lastRun": "2026-10-23T06:34:17.026Z", "liveDays": 14, "filters": { "kind": null, "exploited": false, "severity": "critical", "ecosystems": [] }, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" } ], "incidents": [ { "id": "cve-2026-96639", "url": "https://cveboard.org/i/cve-2026-96639", "urlPt": "https://cveboard.org/pt/i/cve-2026-96639", "json": "https://cveboard.org/i/cve-2026-96639.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow multi-frame loaders can reuse stale native image storage after mode transitions", "summary": "Pillow multi-frame image loaders can retain native ImagingCore storage allocated for one frame while changing the Python-side image mode and decoder tiles for a later frame.", "titlePt": "Carregadores multi-frame do Pillow podem reutilizar armazenamento nativo de imagem obsoleto após transições de modo.", "summaryPt": "Carregadores de imagens multi-frame do Pillow podem reter o armazenamento nativo do ImagingCore alocado para um frame enquanto alteram o modo e os azulejos do decodificador da imagem do lado do Python para um frame posterior.", "cves": [ "CVE-2026-96639" ], "ghsa": "GHSA-v9pv-5gc8-w2m6", "cvss": { "score": 9.8, "version": "3.1" }, "epss": { "percentage": 0.00565, "percentile": 0.46187, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": ">= 11.0.0, < 13.0.0", "fixed": "13.0.0", "advisory": "GHSA-v9pv-5gc8-w2m6" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-v9pv-5gc8-w2m6" } ], "publishedAt": "2026-10-22T16:00:15.000Z", "updatedAt": "2026-10-22T16:00:15.000Z" }, { "id": "ghsa-673q-mjm6-r5xr", "url": "https://cveboard.org/i/ghsa-673q-mjm6-r5xr", "urlPt": "https://cveboard.org/pt/i/ghsa-673q-mjm6-r5xr", "json": "https://cveboard.org/i/ghsa-673q-mjm6-r5xr.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays", "summary": "A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.", "titlePt": "Next.js: Execução remota de código não autenticada nas funções `use cache` que retornam arrays tipados", "summaryPt": "Uma vulnerabilidade em aplicações que utilizam o App router com o Cache Component pode levar à execução remota de código. A aplicação precisa ter uma função use cache que retorna múltiplos arrays tipados.", "cves": [], "ghsa": "GHSA-673q-mjm6-r5xr", "cvss": { "score": 9.5, "version": "4.0" }, "epss": null, "packages": [ { "ecosystem": "npm", "name": "next", "vulnerable": ">= 16.0.0, <= 16.4.0", "fixed": "16.4.1", "advisory": "GHSA-673q-mjm6-r5xr" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-673q-mjm6-r5xr" } ], "publishedAt": "2026-10-22T16:42:31.000Z", "updatedAt": "2026-10-22T16:42:31.000Z" }, { "id": "ghsa-2464-fhr4-w9xw", "url": "https://cveboard.org/i/ghsa-2464-fhr4-w9xw", "urlPt": "https://cveboard.org/pt/i/ghsa-2464-fhr4-w9xw", "json": "https://cveboard.org/i/ghsa-2464-fhr4-w9xw.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used", "summary": "A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux.", "titlePt": "Next.js: Execução remota de código não autenticada na API de otimização de imagens quando arquivos SVG são usados.", "summaryPt": "Uma vulnerabilidade relacionada à memória foi descoberta em uma biblioteca upstream usada para otimização de imagens, que pode levar à possível execução remota de código (RCE) quando o Next.js é executado em Linux baseado em glibc.", "cves": [], "ghsa": "GHSA-2464-fhr4-w9xw", "cvss": { "score": 9.5, "version": "4.0" }, "epss": null, "packages": [ { "ecosystem": "npm", "name": "next", "vulnerable": ">= 10.0.0, <= 15.5.27", "fixed": "15.5.28", "advisory": "GHSA-2464-fhr4-w9xw" }, { "ecosystem": "npm", "name": "next", "vulnerable": ">= 16.0.0, <= 16.4.0", "fixed": "16.4.1", "advisory": "GHSA-2464-fhr4-w9xw" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-2464-fhr4-w9xw" } ], "publishedAt": "2026-10-22T15:52:53.000Z", "updatedAt": "2026-10-22T15:52:53.000Z" }, { "id": "ghsa-cg2g-xh64-v4q7", "url": "https://cveboard.org/i/ghsa-cg2g-xh64-v4q7", "urlPt": "https://cveboard.org/pt/i/ghsa-cg2g-xh64-v4q7", "json": "https://cveboard.org/i/ghsa-cg2g-xh64-v4q7.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes", "summary": "When DOMPurify is configured with SAFE_FOR_TEMPLATES: true together with a DOM-returning mode (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true), template expressions such as {{...}}, ${...}, and <%...%> survive sanitization inside the text content of an attached shadow root. The post-walk safety net _scrubTemplateExpressions (src/purify.", "titlePt": "Contornar SAFE_FOR_TEMPLATES do DOMPurify: expressões de template divididas sobrevivem no conteúdo da shadow root anexada nos modos de saída DOM", "summaryPt": "Quando o DOMPurify é configurado com SAFE_FOR_TEMPLATES: true junto com um modo de retorno DOM (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, ou IN_PLACE: true), expressões de template como {{...}}, ${...} e <%...%> sobrevivem à sanitização dentro do conteúdo de texto de uma shadow root anexada. A rede de segurança pós-caminhada _scrubTemplateExpressions (src/purify.", "cves": [], "ghsa": "GHSA-cg2g-xh64-v4q7", "cvss": { "score": 9.2, "version": "4.0" }, "epss": null, "packages": [ { "ecosystem": "npm", "name": "dompurify", "vulnerable": ">= 3.4.4, <= 3.4.16", "fixed": "3.4.17", "advisory": "GHSA-cg2g-xh64-v4q7" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-cg2g-xh64-v4q7" } ], "publishedAt": "2026-10-22T16:25:31.000Z", "updatedAt": "2026-10-22T16:25:31.000Z" }, { "id": "cve-2026-114139", "url": "https://cveboard.org/i/cve-2026-114139", "urlPt": "https://cveboard.org/pt/i/cve-2026-114139", "json": "https://cveboard.org/i/cve-2026-114139.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Sentry-Javascript: Middleware Bypass when using Tunnel route", "summary": "The tunnelRoute option makes the SDK send browser events to a path on your own Next.js server (for example /monitoring), where a rewrite forwards them to Sentry to prevent ad blockers from blocking them. To keep those envelope requests from being rejected by your middleware, the SDK skips middleware for them.", "titlePt": "Sentry-Javascript: Contorno de Middleware ao usar a rota Tunnel", "summaryPt": "A opção tunnelRoute faz com que o SDK envie eventos do navegador para um caminho no seu próprio servidor Next.js (por exemplo /monitoring), onde um redirecionamento os encaminha para o Sentry para evitar que bloqueadores de anúncios os bloqueiem. Para evitar que esses pedidos de envelope sejam rejeitados pelo seu middleware, o SDK ignora o middleware para eles.", "cves": [ "CVE-2026-114139" ], "ghsa": "GHSA-mchm-gjx6-7h55", "cvss": { "score": 9.1, "version": "4.0" }, "epss": { "percentage": 0.00407, "percentile": 0.33815, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "npm", "name": "@sentry/nextjs", "vulnerable": ">= 9.36.0, < 9.47.2", "fixed": "9.47.2", "advisory": "GHSA-mchm-gjx6-7h55" }, { "ecosystem": "npm", "name": "@sentry/nextjs", "vulnerable": ">= 10.0.0-alpha.0, < 10.75.2", "fixed": "10.75.2", "advisory": "GHSA-mchm-gjx6-7h55" }, { "ecosystem": "npm", "name": "@sentry/nextjs", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-rc.1", "fixed": "11.0.0-rc.1", "advisory": "GHSA-mchm-gjx6-7h55" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-mchm-gjx6-7h55" } ], "publishedAt": "2026-10-22T15:55:07.000Z", "updatedAt": "2026-10-22T15:55:07.000Z" }, { "id": "cve-2026-114125", "url": "https://cveboard.org/i/cve-2026-114125", "urlPt": "https://cveboard.org/pt/i/cve-2026-114125", "json": "https://cveboard.org/i/cve-2026-114125.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites", "summary": "A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of exploitation in the wild.", "titlePt": "Storybook: Falta de validação de origem no preview do Storybook permite a injeção de código de sites maliciosos", "summaryPt": "Um site malicioso pode ser capaz de causar alterações não autorizadas em arquivos de um projeto de um desenvolvedor enquanto um servidor de desenvolvimento Storybook afetado está em execução. Sob condições adicionais, um arquivo alterado pode ser executado por um tempo de execução local com os privilégios do desenvolvedor. Não temos conhecimento de exploração na natureza.", "cves": [ "CVE-2026-114125" ], "ghsa": "GHSA-f2ph-cmg5-wxc8", "cvss": { "score": 9.4, "version": "4.0" }, "epss": { "percentage": 0.00375, "percentile": 0.30254, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 9.0.0, < 9.1.21", "fixed": "9.1.21", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 10.0.0, < 10.6.2", "fixed": "10.6.2", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "storybook", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6", "fixed": "11.0.0-alpha.6", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/core", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/core-server", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/experimental-addon-test", "vulnerable": ">= 8.0.0, < 8.6.19", "fixed": "8.6.19", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-vitest", "vulnerable": ">= 9.0.0, < 9.1.21", "fixed": "9.1.21", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-vitest", "vulnerable": ">= 10.0.0, < 10.6.2", "fixed": "10.6.2", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-vitest", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6", "fixed": "11.0.0-alpha.6", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-mcp", "vulnerable": ">= 10.6.0, < 10.6.2", "fixed": "10.6.2", "advisory": "GHSA-f2ph-cmg5-wxc8" }, { "ecosystem": "npm", "name": "@storybook/addon-mcp", "vulnerable": ">= 11.0.0-alpha.0, < 11.0.0-alpha.6", "fixed": "11.0.0-alpha.6", "advisory": "GHSA-f2ph-cmg5-wxc8" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8" } ], "publishedAt": "2026-10-21T17:23:29.000Z", "updatedAt": "2026-10-21T17:23:29.000Z" }, { "id": "cve-2026-112393", "url": "https://cveboard.org/i/cve-2026-112393", "urlPt": "https://cveboard.org/pt/i/cve-2026-112393", "json": "https://cveboard.org/i/cve-2026-112393.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", "summary": "Pillow can write attacker-chosen data past the end of a heap buffer when it saves a TIFF image to an in-memory destination such as io.BytesIO rather than to a file. The same code also copies leftover heap memory from the process into the saved file. Anyone who can supply an image to a service that opens it and re-saves it as TIFF this way can trigger this with default settings.", "titlePt": "Pillow: estouro de buffer de heap em _tiffWriteProc ao salvar TIFF em BytesIO", "summaryPt": "Pillow pode escrever dados escolhidos pelo atacante além do final de um buffer de heap quando salva uma imagem TIFF em um destino de memória, como io.BytesIO, em vez de em um arquivo. O mesmo código também copia memória de heap restante do processo para o arquivo salvo. Qualquer pessoa que possa fornecer uma imagem a um serviço que a abre e a re-salva como TIFF dessa maneira pode acionar isso com as configurações padrão.", "cves": [ "CVE-2026-112393" ], "ghsa": "GHSA-332p-7hrc-92wf", "cvss": { "score": 9.2, "version": "4.0" }, "epss": { "percentage": 0.00528, "percentile": 0.43574, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": ">= 2.0.0, < 13.0.0", "fixed": "13.0.0", "advisory": "GHSA-332p-7hrc-92wf" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-332p-7hrc-92wf" } ], "publishedAt": "2026-10-21T21:28:09.000Z", "updatedAt": "2026-10-21T21:28:09.000Z" }, { "id": "cve-2026-112900", "url": "https://cveboard.org/i/cve-2026-112900", "urlPt": "https://cveboard.org/pt/i/cve-2026-112900", "json": "https://cveboard.org/i/cve-2026-112900.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", "summary": "PIL.EpsImagePlugin.Ghostscript() builds the Ghostscript command line using the input file path (fp.name) without sanitization, placing it at -f . A filename beginning with - is interpreted by Ghostscript as an option, giving command-line argument injection; chainable to RCE (see Impact). Reproduces with Pillow's default invocation (with -dSAFER enabled).", "titlePt": "Pillow: Injeção de Argumento na chamada do Ghostscript, potencialmente levando a execução remota de código", "summaryPt": "PIL.EpsImagePlugin.Ghostscript() constrói a linha de comando do Ghostscript usando o caminho do arquivo de entrada (fp.name) sem sanitização, colocando-o em -f . Um nome de arquivo começando com - é interpretado pelo Ghostscript como uma opção, permitindo a injeção de argumentos na linha de comando; encadeável para execução remota de código (veja Impacto). Reproduz com a invocação padrão do Pillow (com -dSAFER habilitado).", "cves": [ "CVE-2026-112900" ], "ghsa": "GHSA-w889-685w-c8fh", "cvss": { "score": 9.2, "version": "4.0" }, "epss": { "percentage": 0.00431, "percentile": 0.36065, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": ">= 2.6.0, < 13.0.0", "fixed": "13.0.0", "advisory": "GHSA-w889-685w-c8fh" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w889-685w-c8fh" } ], "publishedAt": "2026-10-21T19:58:44.000Z", "updatedAt": "2026-10-21T19:58:44.000Z" }, { "id": "cve-2026-112403", "url": "https://cveboard.org/i/cve-2026-112403", "urlPt": "https://cveboard.org/pt/i/cve-2026-112403", "json": "https://cveboard.org/i/cve-2026-112403.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Pillow: Heap buffer overflow in ImagingJpegDecode", "summary": "JpegImageFile.draft() — which Image.thumbnail() calls automatically — requests 1/2, 1/4 or 1/8 scaled JPEG output and shrinks self._size and the tile extents to match, so _setimage() allocates a single-row decode buffer of ceil(W/s) samples. ImagingJpegDecode() sets cinfo.scale_num/scale_denom, calls jpeg_start_decompress(), and then reads scanlines into that buffer without ever comparing cinfo.", "titlePt": "Pillow: transbordamento de buffer na heap em ImagingJpegDecode", "summaryPt": "JpegImageFile.draft() — que Image.thumbnail() chama automaticamente — solicita saída JPEG escalonada em 1/2, 1/4 ou 1/8 e reduz self._size e os limites do tile para corresponder, então _setimage() aloca um buffer de decodificação de linha única de ceil(W/s) amostras. ImagingJpegDecode() define cinfo.scale_num/scale_denom, chama jpeg_start_decompress(), e depois lê linhas de varredura para esse buffer sem nunca comparar cinfo.", "cves": [ "CVE-2026-112403" ], "ghsa": "GHSA-8g5g-8vmr-9782", "cvss": { "score": 9.2, "version": "4.0" }, "epss": { "percentage": 0.00321, "percentile": 0.23691, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "Pillow", "vulnerable": "<= 12.3.0", "fixed": "13.0.0", "advisory": "GHSA-8g5g-8vmr-9782" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-8g5g-8vmr-9782" } ], "publishedAt": "2026-10-20T20:40:07.000Z", "updatedAt": "2026-10-20T20:40:07.000Z" }, { "id": "ghsa-hq85-5cpj-mr62", "url": "https://cveboard.org/i/ghsa-hq85-5cpj-mr62", "urlPt": "https://cveboard.org/pt/i/ghsa-hq85-5cpj-mr62", "json": "https://cveboard.org/i/ghsa-hq85-5cpj-mr62.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised", "summary": "By default, uv verifies TLS connections against a vendored copy of the webpki-root-certs bundle. Versions before 0.13.4 include the emSign ECC Root CA - G3 root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them.", "titlePt": "O repositório de CA embutido do uv confia em uma raiz emSign cujas chaves de CA intermediária estão comprometidas", "summaryPt": "Por padrão, o uv verifica conexões TLS contra uma cópia vendida do pacote webpki-root-certs. Versões anteriores à 0.13.4 incluem a raiz emSign ECC Root CA - G3. Oito certificados de CA intermediária da eMudhra que encadeiam até essa raiz têm chaves privadas comprometidas, e a CA os revogou.", "cves": [], "ghsa": "GHSA-hq85-5cpj-mr62", "cvss": { "score": 9.1, "version": "4.0" }, "epss": null, "packages": [ { "ecosystem": "pip", "name": "uv", "vulnerable": "< 0.13.4", "fixed": "0.13.4", "advisory": "GHSA-hq85-5cpj-mr62" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-hq85-5cpj-mr62" } ], "publishedAt": "2026-10-20T19:37:52.000Z", "updatedAt": "2026-10-20T19:37:52.000Z" }, { "id": "ghsa-6q48-6c7w-9gw2", "url": "https://cveboard.org/i/ghsa-6q48-6c7w-9gw2", "urlPt": "https://cveboard.org/pt/i/ghsa-6q48-6c7w-9gw2", "json": "https://cveboard.org/i/ghsa-6q48-6c7w-9gw2.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "summary": "Certifi versions before 2026.10.18 include the emSign ECC Root CA - G3 root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them.", "titlePt": "certifi inclui CAs raiz emSign com chaves de CA intermediária comprometidas", "summaryPt": "Versões do certifi anteriores à 2026.10.18 incluem o certificado raiz emSign ECC Root CA - G3 em seu repositório de CAs embutido. Oito certificados de CA intermediária eMudhra que se encadeiam a esta raiz têm chaves privadas comprometidas e a CA os revogou.", "cves": [], "ghsa": "GHSA-6q48-6c7w-9gw2", "cvss": { "score": 9.1, "version": "4.0" }, "epss": null, "packages": [ { "ecosystem": "pip", "name": "certifi", "vulnerable": ">= 2019.03.09, < 2026.10.19", "fixed": "2026.10.19", "advisory": "GHSA-6q48-6c7w-9gw2" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2" } ], "publishedAt": "2026-10-20T19:35:05.000Z", "updatedAt": "2026-10-20T19:35:05.000Z" }, { "id": "cve-2026-111057", "url": "https://cveboard.org/i/cve-2026-111057", "urlPt": "https://cveboard.org/pt/i/cve-2026-111057", "json": "https://cveboard.org/i/cve-2026-111057.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass", "summary": "A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.", "titlePt": "Mercury: execução remota de código não autenticada em /api/terminals - contorno de controle de acesso", "summaryPt": "Uma vírgula faltante na lista BLOCKED_PATTERNS do arquivo mercury_app/block_handler.py faz com que a lista de bloqueios falhe ao cobrir o endpoint /api/terminals. Como resultado, qualquer atacante não autenticado pode iniciar um shell interativo completo no nível do sistema operacional no host que executa o Mercury.", "cves": [ "CVE-2026-111057" ], "ghsa": "GHSA-f8c7-rwf9-fmgm", "cvss": { "score": 10, "version": "3.1" }, "epss": { "percentage": 0.00443, "percentile": 0.37177, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "mercury", "vulnerable": ">= 3.0.0, <= 3.2.3", "fixed": "3.2.4", "advisory": "GHSA-f8c7-rwf9-fmgm" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-f8c7-rwf9-fmgm" } ], "publishedAt": "2026-10-19T17:00:54.000Z", "updatedAt": "2026-10-19T17:00:54.000Z" }, { "id": "cve-2026-111058", "url": "https://cveboard.org/i/cve-2026-111058", "urlPt": "https://cveboard.org/pt/i/cve-2026-111058", "json": "https://cveboard.org/i/cve-2026-111058.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Mercury: Unauthenticated Remote Code Execution via /api/kernels", "summary": "Mercury runs a JupyterLab server with anonymous access by default (mercury_app/main.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints.", "titlePt": "Mercury: execução remota de código não autenticada via /api/kernels", "summaryPt": "Mercury executa um servidor JupyterLab com acesso anônimo por padrão (mercury_app/main.py define --IdentityProvider.token='' quando nenhum --token/MERCURY_TOKEN é fornecido; quando sem token, também define --ServerApp.disable_check_xsrf=True). Ele depende de uma lista de bloqueio (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) para manter usuários anônimos fora de endpoints perigosos do Jupyter.", "cves": [ "CVE-2026-111058" ], "ghsa": "GHSA-rv4m-xm3f-3ccq", "cvss": { "score": 9.8, "version": "3.1" }, "epss": { "percentage": 0.00437, "percentile": 0.36703, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "mercury", "vulnerable": "<= 3.2.5", "fixed": "3.2.6", "advisory": "GHSA-rv4m-xm3f-3ccq" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rv4m-xm3f-3ccq" } ], "publishedAt": "2026-10-19T16:49:08.000Z", "updatedAt": "2026-10-19T16:49:08.000Z" }, { "id": "cve-2026-105192", "url": "https://cveboard.org/i/cve-2026-105192", "urlPt": "https://cveboard.org/pt/i/cve-2026-105192", "json": "https://cveboard.org/i/cve-2026-105192.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport", "summary": "LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport", "titlePt": "LMCache: execução remota de código via deserialização insegura no transporte em modo multiprocesso", "summaryPt": "LMCache é vulnerável à execução remota de código não autenticada via deserialização Pickle no transporte ZMQ Multiprocesso", "cves": [ "CVE-2026-105192" ], "ghsa": "GHSA-w5f2-9q9c-ff4h", "cvss": { "score": 9.8, "version": "3.1" }, "epss": { "percentage": 0.00482, "percentile": 0.40535, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "lmcache", "vulnerable": ">= 0.3.9, < 0.5.6", "fixed": "0.5.6", "advisory": "GHSA-w5f2-9q9c-ff4h" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-w5f2-9q9c-ff4h" } ], "publishedAt": "2026-10-16T20:08:44.000Z", "updatedAt": "2026-10-16T20:08:44.000Z" }, { "id": "cve-2026-96620", "url": "https://cveboard.org/i/cve-2026-96620", "urlPt": "https://cveboard.org/pt/i/cve-2026-96620", "json": "https://cveboard.org/i/cve-2026-96620.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution", "summary": "The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls.", "titlePt": "Claude Agent SDK: Injeção de argumento via opção resume permite execução arbitrária de comandos", "summaryPt": "O SDK do Claude Agent para Python passou a opção resume para o CLI do Claude sem validação, permitindo que um valor iniciado com - fosse interpretado como uma flag CLI separada. Um atacante que controlasse o valor do resume poderia injetar uma flag --mcp-config definindo um servidor MCP stdio, resultando na execução arbitrária de comandos no início do CLI que contornava os controles de permissão do SDK.", "cves": [ "CVE-2026-96620" ], "ghsa": "GHSA-h4mw-j7qp-8mwm", "cvss": { "score": 9.2, "version": "4.0" }, "epss": { "percentage": 0.00578, "percentile": 0.46547, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "pip", "name": "claude-agent-sdk", "vulnerable": "< 0.2.121", "fixed": "0.2.121", "advisory": "GHSA-h4mw-j7qp-8mwm" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-h4mw-j7qp-8mwm" } ], "publishedAt": "2026-10-16T19:44:37.000Z", "updatedAt": "2026-10-16T19:44:37.000Z" }, { "id": "cve-2026-94603", "url": "https://cveboard.org/i/cve-2026-94603", "urlPt": "https://cveboard.org/pt/i/cve-2026-94603", "json": "https://cveboard.org/i/cve-2026-94603.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation", "summary": "Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox.", "titlePt": "Podman: O comando `podman run` pode ser instruído a desabilitar quase todo o sandboxing por meio de anotação de imagem", "summaryPt": "O Podman v4.4.0 adicionou um recurso onde pontos de verificação de contêineres (do comando podman container checkpoint) poderiam ser distribuídos via registro OCI, e puxados desse registro e executados via o comando podman run. Isso permitiu a transferência fácil de pontos de verificação entre sistemas. No entanto, os pontos de verificação permitem controle total sobre como o contêiner é criado - incluindo controle total do sandbox do contêiner.", "cves": [ "CVE-2026-94603" ], "ghsa": "GHSA-2cvf-wqm6-wr9g", "cvss": { "score": 10, "version": "3.1" }, "epss": { "percentage": 0.00918, "percentile": 0.59508, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "go", "name": "github.com/containers/podman", "vulnerable": ">= 4.4.0, < 5.8.8", "fixed": "5.8.8", "advisory": "GHSA-2cvf-wqm6-wr9g" }, { "ecosystem": "go", "name": "go.podman.io/podman/v6", "vulnerable": ">= 6.0.0, < 6.1.3", "fixed": "6.1.3", "advisory": "GHSA-2cvf-wqm6-wr9g" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-2cvf-wqm6-wr9g" } ], "publishedAt": "2026-10-15T20:22:16.000Z", "updatedAt": "2026-10-15T20:22:16.000Z" }, { "id": "cve-2026-77524", "url": "https://cveboard.org/i/cve-2026-77524", "urlPt": "https://cveboard.org/pt/i/cve-2026-77524", "json": "https://cveboard.org/i/cve-2026-77524.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication", "summary": "A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds [\"*\"]/[\"*\"] get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs and horizontalpodautoscalers create/delete cluster-wide, */scale update on any workload,…", "titlePt": "KEDA: escalonamento de privilégios de administrador de namespace para administrador de cluster via KEDA TriggerAuthentication", "summaryPt": "Um administrador de namespace que cria um TriggerAuthentication e um ScaledObject no próprio namespace pode fazer com que o operador KEDA envie seu próprio token de ServiceAccount para uma URL controlada pelo inquilino. Esse token possui [\"*\"]/[\"*\"] get em todo o cluster, então ele lê todo Secret em cada namespace, além de batch/jobs e horizontalpodautoscalers criar/excluir em todo o cluster, */scale atualizar em qualquer carga de trabalho,…", "cves": [ "CVE-2026-77524" ], "ghsa": "GHSA-637c-6jxx-4rwm", "cvss": { "score": 9.9, "version": "3.1" }, "epss": { "percentage": 0.00635, "percentile": 0.49524, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "go", "name": "github.com/kedacore/keda", "vulnerable": "<= 1.5.0", "fixed": null, "advisory": "GHSA-637c-6jxx-4rwm" }, { "ecosystem": "go", "name": "github.com/kedacore/keda/v2", "vulnerable": "< 2.21.0", "fixed": "2.21.0", "advisory": "GHSA-637c-6jxx-4rwm" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-637c-6jxx-4rwm" } ], "publishedAt": "2026-10-15T20:19:42.000Z", "updatedAt": "2026-10-15T20:19:42.000Z" }, { "id": "cve-2026-77459", "url": "https://cveboard.org/i/cve-2026-77459", "urlPt": "https://cveboard.org/pt/i/cve-2026-77459", "json": "https://cveboard.org/i/cve-2026-77459.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks", "summary": "Argo CD checks an Application's AppProject before it creates resources during a sync. That check covers destination namespaces and servers, cluster-scoped resource allow and deny lists, and namespaced resource allow and deny lists, including resource names. PreDelete and PostDelete hooks skip it.", "titlePt": "Argo CD: contorno das restrições de destination-namespace e de recursos do AppProject por hooks de recursos PreDelete/PostDelete", "summaryPt": "O Argo CD verifica o AppProject de uma Aplicação antes de criar recursos durante uma sincronização. Essa verificação cobre namespaces e servidores de destino, listas de permissões e negações de recursos em nível de cluster e listas de permissões e negações de recursos em nível de namespace, incluindo nomes de recursos. Os hooks PreDelete e PostDelete pulam essa verificação.", "cves": [ "CVE-2026-77459" ], "ghsa": "GHSA-fmxq-cgp8-87wp", "cvss": { "score": 9.9, "version": "3.1" }, "epss": { "percentage": 0.0072, "percentile": 0.52865, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v2", "vulnerable": ">= 2.10.0, <= 2.14.21", "fixed": null, "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.0.0, < 3.3.15", "fixed": "3.3.15", "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.4.0, < 3.4.10", "fixed": "3.4.10", "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.5.0, < 3.5.4", "fixed": "3.5.4", "advisory": "GHSA-fmxq-cgp8-87wp" }, { "ecosystem": "go", "name": "github.com/argoproj/argo-cd/v3", "vulnerable": ">= 3.6.0-rc1, < 3.6.0-rc2", "fixed": "3.6.0-rc2", "advisory": "GHSA-fmxq-cgp8-87wp" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-fmxq-cgp8-87wp" } ], "publishedAt": "2026-10-15T20:19:31.000Z", "updatedAt": "2026-10-15T20:19:31.000Z" }, { "id": "cve-2026-104252", "url": "https://cveboard.org/i/cve-2026-104252", "urlPt": "https://cveboard.org/pt/i/cve-2026-104252", "json": "https://cveboard.org/i/cve-2026-104252.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Vitess vttablet /twopcz reflected XSS", "summary": "From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800", "titlePt": "Vitess vttablet /twopcz reflected XSS", "summaryPt": "De: xylove21 Para: security@vitess.io Assunto: [Relatório de Segurança] Vitess vttablet /twopcz reflected XSS Data: Ter, 24 Jun 2026 14:30:00 +0800", "cves": [ "CVE-2026-104252" ], "ghsa": "GHSA-v75v-6fpf-gvw8", "cvss": { "score": 9.8, "version": "3.1" }, "epss": { "percentage": 0.00885, "percentile": 0.58523, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "go", "name": "vitess.io/vitess", "vulnerable": "< 0.23.5", "fixed": "0.23.5", "advisory": "GHSA-v75v-6fpf-gvw8" }, { "ecosystem": "go", "name": "vitess.io/vitess", "vulnerable": ">= 0.24.0, < 0.24.2", "fixed": "0.24.2", "advisory": "GHSA-v75v-6fpf-gvw8" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-v75v-6fpf-gvw8" } ], "publishedAt": "2026-10-15T20:16:29.000Z", "updatedAt": "2026-10-15T20:16:29.000Z" }, { "id": "cve-2026-102989", "url": "https://cveboard.org/i/cve-2026-102989", "urlPt": "https://cveboard.org/pt/i/cve-2026-102989", "json": "https://cveboard.org/i/cve-2026-102989.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses", "summary": "An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority.", "titlePt": "TanStack Router: XSS refletido não autenticado nas respostas de função de servidor do TanStack Start", "summaryPt": "Um atacante não autenticado pode criar uma URL para uma função de servidor em um aplicativo TanStack Start afetado. Se alguém abrir o link, o aplicativo pode retornar HTML controlado pelo atacante de sua própria origem e executar o JavaScript do atacante. O script pode acessar dados de mesma origem disponíveis para aquele visitante e fazer solicitações com sua autoridade.", "cves": [ "CVE-2026-102989" ], "ghsa": "GHSA-qx66-fv34-fjm8", "cvss": { "score": 9.3, "version": "3.1" }, "epss": { "percentage": 0.00516, "percentile": 0.42559, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "npm", "name": "@tanstack/start-server-core", "vulnerable": ">= 1.143.12, < 1.169.39", "fixed": "1.169.39", "advisory": "GHSA-qx66-fv34-fjm8" }, { "ecosystem": "npm", "name": "@tanstack/react-start", "vulnerable": ">= 1.143.12, < 1.168.60", "fixed": "1.168.60", "advisory": "GHSA-qx66-fv34-fjm8" }, { "ecosystem": "npm", "name": "@tanstack/solid-start", "vulnerable": ">= 1.143.12, < 1.168.57", "fixed": "1.168.57", "advisory": "GHSA-qx66-fv34-fjm8" }, { "ecosystem": "npm", "name": "@tanstack/vue-start", "vulnerable": ">= 1.143.12, < 1.168.56", "fixed": "1.168.56", "advisory": "GHSA-qx66-fv34-fjm8" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-qx66-fv34-fjm8" } ], "publishedAt": "2026-10-15T20:22:20.000Z", "updatedAt": "2026-10-15T20:22:20.000Z" }, { "id": "cve-2026-102748", "url": "https://cveboard.org/i/cve-2026-102748", "urlPt": "https://cveboard.org/pt/i/cve-2026-102748", "json": "https://cveboard.org/i/cve-2026-102748.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service", "summary": "Dgraph v25.3.8 exposes a Zero HTTP administrative surface that is unauthenticated when port 6080 is reachable.", "titlePt": "Dgraph: Negação de Serviço via removeNode HTTP Admin sem autenticação", "summaryPt": "Dgraph v25.3.8 expõe uma superfície administrativa HTTP Zero que não é autenticada quando a porta 6080 está acessível.", "cves": [ "CVE-2026-102748" ], "ghsa": "GHSA-qj98-gp63-54xj", "cvss": { "score": 9.2, "version": "4.0" }, "epss": { "percentage": 0.00486, "percentile": 0.40534, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "go", "name": "github.com/dgraph-io/dgraph/v25", "vulnerable": "<= 25.3.8", "fixed": "25.4.0", "advisory": "GHSA-qj98-gp63-54xj" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-qj98-gp63-54xj" } ], "publishedAt": "2026-10-15T20:17:22.000Z", "updatedAt": "2026-10-15T20:17:22.000Z" }, { "id": "cve-2026-105016", "url": "https://cveboard.org/i/cve-2026-105016", "urlPt": "https://cveboard.org/pt/i/cve-2026-105016", "json": "https://cveboard.org/i/cve-2026-105016.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability", "summary": "Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC as used by .NET 8.0, .NET 9.0, .NET 10.0, and .NET 11 RC2 on Windows. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.", "titlePt": "Aviso de Segurança da Microsoft CVE-2026-105016 - Vulnerabilidade de Execução Remota de Código no Microsoft QUIC", "summaryPt": "A Microsoft está divulgando este aviso de segurança para fornecer informações sobre uma vulnerabilidade no Microsoft QUIC conforme usado pelo .NET 8.0, .NET 9.0, .NET 10.0 e .NET 11 RC2 no Windows. Este aviso também fornece orientações sobre o que os desenvolvedores podem fazer para atualizar seus aplicativos e remover esta vulnerabilidade.", "cves": [ "CVE-2026-105016" ], "ghsa": "GHSA-5gjq-3f94-rcf7", "cvss": { "score": 9.8, "version": "3.1" }, "epss": { "percentage": 0.00986, "percentile": 0.6161, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "nuget", "name": "Microsoft.Native.Quic.MsQuic.Schannel", "vulnerable": "= 2.5.11-ci.156755675", "fixed": "2.5.11-ci.159417053", "advisory": "GHSA-5gjq-3f94-rcf7" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-5gjq-3f94-rcf7" } ], "publishedAt": "2026-10-13T19:56:35.000Z", "updatedAt": "2026-10-13T19:56:35.000Z" }, { "id": "cve-2026-88092", "url": "https://cveboard.org/i/cve-2026-88092", "urlPt": "https://cveboard.org/pt/i/cve-2026-88092", "json": "https://cveboard.org/i/cve-2026-88092.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability", "summary": "Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.", "titlePt": "Aviso de segurança da Microsoft CVE-2026-88092 - Vulnerabilidade de contorno de recurso de segurança do ASP.NET Core", "summaryPt": "A Microsoft está lançando este aviso de segurança para fornecer informações sobre uma vulnerabilidade no Microsoft.AspNetCore.Server.Kestrel.Core. Este aviso também fornece orientações sobre o que os desenvolvedores podem fazer para atualizar seus aplicativos e remover esta vulnerabilidade.", "cves": [ "CVE-2026-88092" ], "ghsa": "GHSA-rv87-ccxw-8ggf", "cvss": { "score": 9.4, "version": "3.1" }, "epss": { "percentage": 0.00786, "percentile": 0.55584, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-rv87-ccxw-8ggf" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-rv87-ccxw-8ggf" } ], "publishedAt": "2026-10-13T20:40:50.000Z", "updatedAt": "2026-10-13T20:40:50.000Z" }, { "id": "cve-2026-70188", "url": "https://cveboard.org/i/cve-2026-70188", "urlPt": "https://cveboard.org/pt/i/cve-2026-70188", "json": "https://cveboard.org/i/cve-2026-70188.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability", "summary": "Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Server.Kestrel.Core. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.", "titlePt": "Aviso de segurança da Microsoft CVE-2026-70188 - Vulnerabilidade de contorno de recurso de segurança do ASP.NET Core", "summaryPt": "A Microsoft está divulgando este aviso de segurança para fornecer informações sobre uma vulnerabilidade no Microsoft.AspNetCore.Server.Kestrel.Core. Este aviso também fornece orientações sobre o que os desenvolvedores podem fazer para atualizar seus aplicativos e remover esta vulnerabilidade.", "cves": [ "CVE-2026-70188" ], "ghsa": "GHSA-fpq8-4vhr-rcxx", "cvss": { "score": 9.1, "version": "3.1" }, "epss": { "percentage": 0.00827, "percentile": 0.5655, "asOf": "2026-10-23" }, "packages": [ { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 11.0.0-preview.1, <= 11.0.0-rc.1", "fixed": "11.0.0-rc.2", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 8.0.0, <= 8.0.31", "fixed": "8.0.32", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 10.0.0, <= 10.0.12", "fixed": "10.0.13", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.linux-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.osx-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-arm64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x64", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" }, { "ecosystem": "nuget", "name": "Microsoft.AspNetCore.App.Runtime.win-x86", "vulnerable": ">= 9.0.0, <= 9.0.20", "fixed": "9.0.21", "advisory": "GHSA-fpq8-4vhr-rcxx" } ], "vendor": null, "product": null, "kev": null, "breach": null, "retracted": false, "sources": [ { "label": "GitHub Advisory Database", "url": "https://github.com/advisories/GHSA-fpq8-4vhr-rcxx" } ], "publishedAt": "2026-10-13T20:37:27.000Z", "updatedAt": "2026-10-13T20:37:27.000Z" }, { "id": "cve-2026-108261", "url": "https://cveboard.org/i/cve-2026-108261", "urlPt": "https://cveboard.org/pt/i/cve-2026-108261", "json": "https://cveboard.org/i/cve-2026-108261.json", "kind": "vuln", "live": true, "knownExploited": false, "severity": "critical", "title": "TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment", "summary": "The TinaCMS admin builds its preview