CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-11-01 (5)

2026-11-01 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-11-01

5 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-120306 — 9.9 — Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --…
  • CVE-2026-120307 — 9.9 — The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, includin…
  • CVE-2026-118636 — 9.8 — UNSUPPORTED WHEN ASSIGNED JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer i…
  • CVE-2026-120263 — 9.8 — When [oauth2_client].ACCOUNT_LINKING is set to auto (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form …
  • CVE-2026-116289 — 9.1 — Gitea did not reject personal access tokens restricted to public resources (public-only) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limite…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.