NVD Vulnerabilities

Severity Distribution

Publication Trend

Vulnerability Database

CVE ID Description Published Base Score Attack Vector Severity Actions
CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (j... 2026-10-05 7.5 NETWORK HIGH NVD
CVE-2026-104711 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts.... 2026-10-05 9.8 NETWORK CRITICAL NVD
CVE-2026-93323 The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing ... 2026-10-05 6.8 LOCAL MEDIUM NVD
CVE-2026-93322 A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. 2026-10-05 6.9 LOCAL MEDIUM NVD
CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or,... 2026-10-05 6.0 LOCAL MEDIUM NVD
CVE-2026-93319 A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit... 2026-10-05 5.7 LOCAL MEDIUM NVD
CVE-2026-93318 A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the adv... 2026-10-05 7.5 NETWORK HIGH NVD
CVE-2026-93317 An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The re... 2026-10-05 5.9 NETWORK MEDIUM NVD
CVE-2026-93316 If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by ac... 2026-10-05 7.1 NETWORK HIGH NVD
CVE-2026-78413 Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with ... 2026-10-05 5.5 NETWORK MEDIUM NVD
CVE-2026-78411 Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS perm... 2026-10-05 6.5 NETWORK MEDIUM NVD
CVE-2026-102576 A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Becaus... 2026-10-05 4.2 NETWORK MEDIUM NVD
CVE-2026-102295 A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaS... 2026-10-05 5.4 NETWORK MEDIUM NVD
CVE-2026-101919 A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privile... 2026-10-05 8.8 NETWORK HIGH NVD