Skip to main content
Components
Vulnerabilities
Security Events
Pricing
MCP
API
Docs
Sign up
Login
Find vulnerabilities. Fix fast with AI.
Search components by package, version, or CVE to get started.
Unlock full vulnerability insights and fix guidance with Sonatype Guide.
Sign up for free
Severity
Critical
(74,031)
High
(124,717)
Medium
(153,407)
Low
(12,158)
CVSS Score
0.0
10.0
EPSS Score
0.0
1.0
Malware
KEV Status
Published
Vulnerabilities
458,325
Filter
Sort: Published (Newest first)
10.0
sonatype-2026-009323
Security holding package detected: tailwindcss-uniform@0.0.1-security
affected
Severity
Critical
Published
Oct 15, 2026
8.8
CVE-2026-108381
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments.
affected
Severity
High
Published
Oct 15, 2026
8.8
CVE-2026-108383
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, FieldRepresentation.get_field_default renders a schema-controlled enum field default as an enum member reference after applying case conversion but without validating it as an identifier. Newlines, operators, and punctuation can escape the intended reference and inject constrained statements into the generated module, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating enum defaults as names.
affected
Severity
High
Published
Oct 15, 2026
8.8
CVE-2026-108380
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it.
affected
Severity
High
Published
Oct 15, 2026
8.8
CVE-2026-108376
dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.47.3 through 0.70.5, FieldRepresentation.get_field_default inserts a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default. Version 0.70.6 fixes the vulnerability by rejecting record names that do not match the Avro name grammar.
affected
Severity
High
Published
Oct 15, 2026
5.4
CVE-2026-109710
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
affected
Severity
Medium
Published
Oct 15, 2026
5.4
CVE-2026-109728
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
affected
Severity
Medium
Published
Oct 15, 2026
5.3
CVE-2026-102502
CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
affected
Severity
Medium
Published
Oct 15, 2026
9.1
CVE-2026-65173
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.
affected
Severity
Critical
Published
Oct 15, 2026
9.6
CVE-2026-110159
Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
affected
Severity
Critical
Published
Oct 15, 2026
7.5
CVE-2026-65161
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure.
affected
Severity
High
Published
Oct 15, 2026
9.3
CVE-2026-109708
Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
affected
Severity
Critical
Published
Oct 15, 2026
5.3
CVE-2026-102501
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
affected
Severity
Medium
Published
Oct 15, 2026
6.8
CVE-2026-102702
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in guests flushing caches through GNTTABOP_cache_flush. Unfortunately the fix there introduced a calculation which may underflow, resulting in a loop which would - at least on 64-bit Arm - take excessively long, and which would likely eventually crash the hypervisor. This is CVE-2026-102699. 2) GNTTABOP_cache_flush may be issued on memory mapped from another domain using the grant table interface. However there was no restriction to disallow the use of invalidate-without-clean against read-only grant mappings, which may corrupt the granted memory. This is CVE-2026-102702.
affected
Severity
Medium
Published
Oct 15, 2026
9.3
CVE-2026-109731
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
affected
Severity
Critical
Published
Oct 15, 2026
9.9
CVE-2026-77459
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. The omitted checks include cluster-scoped and namespaced resource allow/deny lists. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. The reachable impact is bounded by the controller's cluster access but can include cluster-scoped resources, disallowed namespaces, persistent hook objects, and secondary objects created by a hook Job. PreSync, Sync, PostSync, and SyncFail hooks continue to use the normal project checks. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.
affected
Severity
Critical
Published
Oct 15, 2026
8.7
CVE-2026-95839
containerd - Malformed digest causes denial of service panic
affected
Severity
High
Published
Oct 15, 2026
7.5
CVE-2026-110869
nodemailer - Inefficient Regular Expression Complexity
affected
Severity
High
Published
Oct 15, 2026
6.9
CVE-2026-110870
nodemailer - Improper Input Validation
affected
Severity
Medium
Published
Oct 15, 2026
7.1
CVE-2026-110871
nodemailer - Uncontrolled Resource Consumption
affected
Severity
High
Published
Oct 15, 2026
5.9
CVE-2026-110872
nodemailer - Uncontrolled Resource Consumption
affected
Severity
Medium
Published
Oct 15, 2026
5.3
CVE-2026-110866
renovate - Protection Mechanism Failure
affected
Severity
Medium
Published
Oct 15, 2026
7.5
CVE-2026-100119
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
affected
Severity
High
Published
Oct 15, 2026
8.5
CVE-2026-110868
renovate - Server-Side Request Forgery (SSRF)
affected
Severity
High
Published
Oct 15, 2026
8.5
CVE-2026-110867
renovate - Incorrect Authorization
affected
Severity
High
Published
Oct 15, 2026
1-25 of 458,325
