vulnerability

MongoDB's CVE record lists seven fixed releases and says code execution may be possible under certain conditions. Datadog crashed a lab 8.0.34 primary with unauthenticated requests and a forced failover, without code execution.

Canonical's LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5 fix a TLS certificate-chain flaw; CISA's entry in the CVE record, dated October 30, lists exploitation as none. Incus fixed it in 7.6.0.

Rails says 8.1.4.1 and 8.0.5.2 fix 21 issues; the advisory for the Critical one says a crafted upload may let an unauthenticated attacker write files via ImageMagick.

Storybook's maintainers published two advisories on October 12, rated critical (CVSS 9.4) and high (8.7) by the project, with fixes in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6.

A GitHub advisory published October 13 for SAP's Cloud SDK for Python lists CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF flaw, as affecting versions before 0.45.2.

JFrog's October 7 advisory rates LMCache's CVE-2026-105192 at CVSS 9.8 and lists no fixed release; a fix pull request opened October 11 was still open that day.

GitHub advisories published October 6 describe two medium and one low-severity Vite dev-server flaws; the project lists patches in 8.3.3, 8.2.4, 8.1.6, 7.3.7 and 6.4.4.

Gradle 9.8.1 fixes three high-rated flaws: two Java deserialization bugs in daemon communication and an SSL-failure repository fallback, plus three 9.8.0 regressions.

Atlassian disclosed CVE-2026-21589, a 9.3-rated path traversal letting unauthenticated attackers read known files in eight self-hosted products, with fixes listed for each.

Angular's maintainers published four GitHub advisories between September 23 and October 1 covering router and platform-server flaws in server-side rendering, three rated High.

OpenSSL's 29 September 2026 advisory covers 14 CVEs, one High-severity DTLS flaw that can leak heap memory, one Moderate and 12 Low; fixes ship in 4.0.3, 3.6.5, 3.5.9 and 3.4.8.

A high-severity flaw in the official MCP Python SDK let a malicious server redirect OAuth credentials to an attacker's endpoint; fixes ship in 1.30.0 and 2.2.0, with extra steps needed.