{ "query": {}, "count": 20, "total": 46314, "page": 1, "limit": 20, "updated": { "cves": "2026-10-05T22:45:08.761Z", "kev": "2026-10-05T22:44:08.566Z", "epss": "2026-10-05T18:56:17.551Z", "breaches": "2026-10-05T18:44:37.761Z", "posts": "2026-10-05T22:45:08.761Z" }, "links": { "web": "https://spydr.io/threats", "next": "https://spydr.io/threats.json?page=2" }, "warnings": [], "results": [ { "id": "CVE-2026-93321", "url": "https://spydr.io/cve/CVE-2026-93321", "published": "2026-10-05T22:16:58.960Z", "modified": "2026-10-05T22:16:58.960Z", "score": 6.9, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "docker.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "moby" ], "products": [ "moby BuildKit" ], "cwes": [ "CWE-129" ], "description": "A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon." }, { "id": "CVE-2026-93315", "url": "https://spydr.io/cve/CVE-2026-93315", "published": "2026-10-05T22:16:58.820Z", "modified": "2026-10-05T22:16:58.820Z", "score": 5.8, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "docker.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "moby" ], "products": [ "moby BuildKit" ], "cwes": [ "CWE-367" ], "description": "When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build." }, { "id": "CVE-2026-91107", "url": "https://spydr.io/cve/CVE-2026-91107", "published": "2026-10-05T22:16:58.657Z", "modified": "2026-10-05T22:16:58.657Z", "score": 9.3, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "fluidattacks.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "OS4ED" ], "products": [ "OS4ED openSIS-Classic" ], "cwes": [ "CWE-639" ], "description": "openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password." }, { "id": "CVE-2026-21589", "url": "https://spydr.io/cve/CVE-2026-21589", "published": "2026-10-05T22:16:58.423Z", "modified": "2026-10-05T22:16:58.423Z", "score": 9.3, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "atlassian.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Atlassian" ], "products": [ "Atlassian Bamboo Data Center", "Atlassian Bamboo Server", "Atlassian Bitbucket Data Center", "Atlassian Bitbucket Server", "Atlassian Confluence Data Center", "Atlassian Confluence Server", "Atlassian Crowd Data Center", "Atlassian Crowd Server", "Atlassian Crucible Data Center", "Atlassian Crucible Server", "Atlassian Fisheye Data Center", "Atlassian Fisheye Server", "Atlassian Jira Service Management Data Center", "Atlassian Jira Service Management Server", "Atlassian Jira Software Data Center", "Atlassian Jira Software Server" ], "cwes": [], "description": "h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. h3. Context This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. h3. Details: * The vulnerability must be addressed for affected versions of: Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.1, 7.2.4 Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 Crucible, fix versions 4.9.15 Fisheye, fix version 4.9.15 * Exploitation requires prior knowledge of the target file's exact name and path. * The vulnerability does not include the capability to enumerate or list directory contents." }, { "id": "CVE-2026-105751", "url": "https://spydr.io/cve/CVE-2026-105751", "published": "2026-10-05T22:16:58.253Z", "modified": "2026-10-05T22:16:58.253Z", "score": 6.9, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling" ], "cwes": [ "CWE-22" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3." }, { "id": "CVE-2026-105750", "url": "https://spydr.io/cve/CVE-2026-105750", "published": "2026-10-05T22:16:58.097Z", "modified": "2026-10-05T22:16:58.097Z", "score": 5.9, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-552", "CWE-863" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1." }, { "id": "CVE-2026-105749", "url": "https://spydr.io/cve/CVE-2026-105749", "published": "2026-10-05T22:16:57.943Z", "modified": "2026-10-05T22:16:57.943Z", "score": 6.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-400", "CWE-789" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend conversion call. Export through the TableData.grid property can further materialize the oversized grid. This issue is fixed in 2.131.0." }, { "id": "CVE-2026-105748", "url": "https://spydr.io/cve/CVE-2026-105748", "published": "2026-10-05T22:16:57.793Z", "modified": "2026-10-05T22:16:57.793Z", "score": 4.3, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-73", "CWE-200" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0." }, { "id": "CVE-2026-105747", "url": "https://spydr.io/cve/CVE-2026-105747", "published": "2026-10-05T22:16:57.633Z", "modified": "2026-10-05T22:16:57.633Z", "score": 4.3, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-409", "CWE-770" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats restriction is applied. This issue is a residual weakness in the member-count protection added for CVE-2026-44018. This issue is fixed in 2.131.0." }, { "id": "CVE-2026-105746", "url": "https://spydr.io/cve/CVE-2026-105746", "published": "2026-10-05T22:16:57.480Z", "modified": "2026-10-05T22:16:57.480Z", "score": 2.2, "severity": "low", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-668", "CWE-693" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker. This issue is fixed in 2.131.0." }, { "id": "CVE-2026-105745", "url": "https://spydr.io/cve/CVE-2026-105745", "published": "2026-10-05T22:16:57.330Z", "modified": "2026-10-05T22:16:57.330Z", "score": 6.7, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-696", "CWE-829" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0." }, { "id": "CVE-2026-105744", "url": "https://spydr.io/cve/CVE-2026-105744", "published": "2026-10-05T22:16:57.177Z", "modified": "2026-10-05T22:16:57.177Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-22", "CWE-73", "CWE-1188" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine=\"tectonic\") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \\openin and \\openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0." }, { "id": "CVE-2026-105743", "url": "https://spydr.io/cve/CVE-2026-105743", "published": "2026-10-05T22:16:57.030Z", "modified": "2026-10-05T22:16:57.030Z", "score": 4, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-367", "CWE-918" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0." }, { "id": "CVE-2026-105742", "url": "https://spydr.io/cve/CVE-2026-105742", "published": "2026-10-05T22:16:56.867Z", "modified": "2026-10-05T22:16:56.867Z", "score": 3.7, "severity": "low", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "score_source": "github.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "docling-project" ], "products": [ "docling-project docling", "docling-project docling-slim" ], "cwes": [ "CWE-201", "CWE-522" ], "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0." }, { "id": "CVE-2026-105468", "url": "https://spydr.io/cve/CVE-2026-105468", "published": "2026-10-05T22:16:56.683Z", "modified": "2026-10-05T22:16:56.683Z", "score": 5.5, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "girishsaraf" ], "products": [ "girishsaraf Online-Appointment-Booking-System" ], "cwes": [ "CWE-74", "CWE-89" ], "description": "A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-103546", "url": "https://spydr.io/cve/CVE-2026-103546", "published": "2026-10-05T22:16:56.520Z", "modified": "2026-10-05T22:16:56.520Z", "score": 2.3, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "mongodb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "MongoDB, Inc." ], "products": [ "MongoDB, Inc. Mongodb Controllers for Kubernetes" ], "cwes": [ "CWE-918" ], "description": "In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resource to cause unintended administrative changes in Ops Manager. This affects deployments using Enterprise Ops Manager backup reconciliation." }, { "id": "CVE-2026-103433", "url": "https://spydr.io/cve/CVE-2026-103433", "published": "2026-10-05T22:16:56.370Z", "modified": "2026-10-05T22:16:56.370Z", "score": 6.9, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "docker.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Docker" ], "products": [ "Docker Buildx" ], "cwes": [ "CWE-862" ], "description": "Docker Buildx Bake does not request the expected fs.read approval for certain filesystem inputs. An untrusted Bake definition can expose a readable file through a pathless secret whose ID is interpreted as a client-side pathname, or consume a local OCI image layout outside the project after entitlement validation checks a different path representation. Users who run untrusted Bake definitions are affected." }, { "id": "CVE-2026-0482", "url": "https://spydr.io/cve/CVE-2026-0482", "published": "2026-10-05T22:16:56.210Z", "modified": "2026-10-05T22:16:56.210Z", "score": 5.4, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "amd.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "AMD" ], "products": [ "AMD Alveo™ Accelerator Cards", "AMD Versal™ Prime Series Adaptive SoCs", "AMD Versal™ Premium Series Adaptive SoCs", "AMD Versal™ AI Edge Series Adaptive SoCs", "AMD Versal™ AI Core Series Adaptive SoCs", "AMD Versal™ HBM Series Adaptive SoCs", "AMD Versal™ RF Series Adaptive SoCs", "AMD Versal Premium Series Gen 2 Adaptive SOCs (2VP3402, 2VP3502, 2VP3602)" ], "cwes": [ "CWE-787" ], "description": "In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability." }, { "id": "CVE-2026-0461", "url": "https://spydr.io/cve/CVE-2026-0461", "published": "2026-10-05T22:16:55.280Z", "modified": "2026-10-05T22:16:55.280Z", "score": 7.5, "severity": "high", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "amd.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "AMD" ], "products": [ "AMD Zynq™ UltraScale+ MPSoCs", "AMD Zynq™ UltraScale+ RFSoCs", "AMD Kria SOMs" ], "cwes": [ "CWE-787" ], "description": "Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade (DFU) download requests to overflow the DDR receive buffer into FSBL memory, potentially resulting in unauthorized code execution during the boot process. This issue could impact the confidentiality, integrity, or availability of affected system." }, { "id": "CVE-2026-93326", "url": "https://spydr.io/cve/CVE-2026-93326", "published": "2026-10-05T21:16:37.907Z", "modified": "2026-10-05T21:16:37.907Z", "score": 6, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "docker.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "moby" ], "products": [ "moby BuildKit" ], "cwes": [ "CWE-180" ], "description": "A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }