CVE-2026 records published in October 2026
This page lists the 13,324 CVE-2026 records published in October 2026, newest first, 1,000 to a page. October 2026 is still in progress, so the list grows each night. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 14 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2026 list filters these records by severity or signal.
- Critical
- 1,2079.1% of these records
- Listed in CISA KEV
- 140.1% of these records
- Reported exploited
- 300.2% of these records
- Detection signal
- 180.1% of these records
- Exploit code
- 1641.2% of these records
- Actionable vendor fix
- 10,08675.7% of these records
Figures as of 2026-10-24 13:48 UTC. Records published in October 2026 have had less than a month to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2026-116020 | BookStack incorrect authorization via AttachmentController on Draft pages | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116019 | Grav Allowlist Bypass via Flex Form Override Directives | 8.7CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116018 | ONEARMY community-platform IDOR via notification read endpoint | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116017 | Xiaozhi-esp32-server IDOR via device address-book endpoint | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116016 | yudao-cloud data permission bypass via data-permission-enable header | 7.1CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116015 | yudao-cloud IDOR via after-sale-log list endpoint | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116014 | open62541 integer overflow heap buffer overflow via Custom DataType | 9.2CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116013 | OpenResty lua-resty-dns denial of service via DNS Response Parsing | 6.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116012 | Ghidra Integer Truncation in PackedDecode::skipAttribute Decompiler parser | 2.0CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116011 | Crow denial of service via Deeply Nested JSON in Crow::json::load | 8.7CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116010 | RosarioSIS missing authorization in Teacher Save Handlers | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116009 | owen2345 CamaleonCMS camaleon CMS path traversal RCE via Media crop_url action | 8.7CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-116008 | DaybydayCRM missing authorization via ProjectsController updateAssign | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-115998 | CervantesSec cervantes IDOR: User reads and modifies findings from other people's projects | 4.3CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-115994 | CervantesSec cervantes BOLA allows Cross-Project Target tampering | 5.4CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-115993 | CervantesSec cervantes stored XSS in the Notes field of project checklists | 6.8CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-115975 | CervantesSec cervantes broken access control in JiraController | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-115929 | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs | 7.6CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-115807 | User Profile Builder WordPress plugin privilege escalation | 7.1CNA v3.1 | – | 2026-10-24 | Fix |
| CVE-2026-115806 | Prime Mover WordPress plugin unauthenticated PHP object injection | 9.8CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-115803 | Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-115802 | InternScience InternAgent LoRA Loading inclusion of untrusted functionality | 5.3CNA v4.0 | – | 2026-10-24 | |
| CVE-2026-114705 | WP Social Feed Gallery WordPress plugin broken access control | 6.5CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114697 | QA Analytics WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114695 | VOD Infomaniak WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114694 | Events Manager WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114693 | All-in-One Video Gallery WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114429 | WP VR - Contributor+ stored XSS via Hotspot Content | – | – | 2026-10-24 | |
| CVE-2026-114196 | Paytium WordPress plugin PHP object injection | 9.8CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114194 | Ad Inserter WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114190 | LiteSpeed Cache WordPress plugin sensitive data exposure | 5.9CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114179 | BP Better Messages WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-114178 | W3 Total Cache WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-113674 | GeoDirectory for WordPress unauthenticated Guest-Submitted Listing modification | – | – | 2026-10-24 | |
| CVE-2026-113673 | GeoDirectory for WordPress Admin+ RCE via DB Text export | – | – | 2026-10-24 | |
| CVE-2026-113493 | GeoDirectory for WordPress Contributor+ stored XSS via gd_map shortcode width attribute | – | – | 2026-10-24 | |
| CVE-2026-113492 | GeoDirectory Recently Viewed Listings AJAX action information disclosure | – | – | 2026-10-24 | |
| CVE-2026-113491 | GeoDirectory for WordPress Subscriber+ Media file disclosure and deletion via path traversal | – | – | 2026-10-24 | |
| CVE-2026-113490 | GeoDirectory Marker Popup REST endpoint vulnerability | – | – | 2026-10-24 | |
| CVE-2026-113489 | GeoDirectory for WordPress Subscriber+ arbitrary Listing Image modification via IDOR | – | – | 2026-10-24 | |
| CVE-2026-112869 | We’re Open! WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-112866 | Product Filter by WBW WordPress plugin SQL injection | 9.3CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-112844 | WP Event Solution WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-112207 | Download Monitor for WordPress reflected XSS via Cross-Origin download Link | – | – | 2026-10-24 | |
| CVE-2026-111402 | Newsletters WordPress plugin SQL injection | 9.3CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-110956 | asVereinbase for WordPress unauthenticated authentication bypass via 2FA validation | – | – | 2026-10-24 | |
| CVE-2026-110892 | SureDash WordPress plugin broken access control | 6.5CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-110018 | aBlocks WordPress plugin privilege escalation to roleSlug block attribute | 8.8CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-108013 | HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle | 6.8CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-107907 | MAS Videos for WordPress Subscriber+ arbitrary post deletion via delete_video/delete_playlist | – | – | 2026-10-24 | |
| CVE-2026-107887 | Advanced Twenty Seventeen for WordPress Subscriber+ site theme Switch via ats_create_child_theme | – | – | 2026-10-24 | |
| CVE-2026-105199 | Pixel Tag Manager for WooCommerce for WordPress stored XSS | – | – | 2026-10-24 | |
| CVE-2026-97353 | The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to | – | – | 2026-10-24 | |
| CVE-2026-97352 | The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the | – | – | 2026-10-24 | |
| CVE-2026-94075 | Newsletters WordPress plugin PHP object injection | 9.8CNA v3.1 | – | 2026-10-24 | |
| CVE-2026-87835 | Front End Users for WordPress unauthenticated Membership Level and account Status Self-Assignment | – | – | 2026-10-24 | |
| CVE-2026-115938 | Craft CMS element-search condition filter server-side template injection | 8.7CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115937 | craftcms commerce-mollie unauthenticated payment reuse allows unpaid orders to be marked as paid | 8.7CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115935 | craftcms cms control panel only API response emulation replaces securityKey and reaches server RCE | 8.7CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115931 | gitroomhq postiz-app arbitrary file read and backend crash | 9.9CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-115897 | yahoo serialize-javascript serialize JavaScript: Cross-site scripting | 2.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115895 | capricorn86 happy-dom ECMAScriptModuleCompiler code injection | 8.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115893 | bytecodealliance wasmtime Cranelift backend insufficient control flow management | 9.9CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115892 | bytecodealliance wasmtime type confusion | 5.7CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115889 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation | 9.9CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115887 | graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115886 | MLflow: SSRF on unauthenticated MLflow servers | 6.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115885 | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output | 4.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115883 | LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores | 6.0CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115877 | Twisted: HTTP request smuggling in twisted.web via a Bare CR or LF in a Header Value | 5.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115863 | ConnMan stack-based buffer overflow | 7.6CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115845 | Incomplete validation in the run_script Python sandbox in AWS MCP Server | 5.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115813 | AWS multi-model-server server-side request forgery | 6.9CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115812 | Multi Model Server relative path traversal | 9.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115810 | Tandoor Recipes SSRF via Pestle Importer Image URL | 6.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115801 | Kakao khaiii JSON Config File Linear.cpp open out-of-bounds | 4.8CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115800 | UbiquitousLearning mllm Convertor __init__.py load_model path traversal | 4.8CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115797 | Tenda F6 web management cleartext transmission | 6.3CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115796 | Tenda F6 web management cross-site request forgery | 5.3CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115786 | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error enables Quota Exhaustion | 6.5CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-115785 | Zimbra Collaboration Suite Data Source Test SMTP command injection via Unsanitized Email Address | 4.3CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-115778 | Twisted: Unauthenticated remote denial of service in the Twisted conch Telnet Transport | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115776 | Twisted: Unauthenticated remote denial of service in the Twisted IRC Server | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115775 | Twisted: Unauthenticated remote denial of service in the Twisted words domish XML Element Stream | 8.7CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115774 | Twisted: Denial of service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH | 4.9CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115754 | yahoo serialize-javascript cross-site scripting | 2.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115752 | signalk-server Signal K server SSRF via App Store appIcon | 2.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115751 | mcp-from-openapi SSRF blockedHosts Bypass via Trailing-Dot Hostname | 6.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115750 | mcp-from-openapi from credential leak via Cross-Origin Redirects | 6.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115749 | hydra-ecosystem hydra-ray-launcher hydra-ray-launcher.dev1 and.dev4 arbitrary Module Import | 4.8CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115730 | i18next-http-backend Protocol-Relative URL injection via Namespace in interpolateUrl | 2.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115729 | @pdfme/common SSRF via isUrlSafeToFetch Bypass | 8.9CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115728 | @hapi/content ReDoS via Content.disposition Parameter Parsing | 8.7CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115727 | AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server | 9.2CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115726 | Aider command execution via Repository .Aider.conf.yml settings | 8.5CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115725 | Chatwoot Cross-account authorization bypass via source_id | 2.3CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115724 | VLC for Android File Overwrite via Spoofed Mail Attachment Provider | 2.1CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-115723 | Snap7 out-of-bounds write via BRecv and CheckAsBRecvCompletion | 8.3CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115722 | RPly Out-of-Bounds Function Pointer Index via PLY header | 6.9CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115657 | KNIME Analytics Platform logs credentials of configured proxy when used as an executor | 4.8CNA v4.0 | 0.1% | 2026-10-23 | |
| CVE-2026-115638 | OpenStack Ironic decompression bomb | 4.3CNA v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-115586 | pypa virtualenv Bash activator script OS command injection | 7.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115585 | pypdf resource exhaustion | 7.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115580 | pypdf cross-reference table vulnerability | 7.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115572 | pypdf resource exhaustion | 7.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115570 | Electron: Mitigation for compromised eMudhra intermediate certificates | 7.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115569 | fallow Jest and Vitest projects entries path traversal | 3.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115567 | Tokio: Race condition in `tokio::time::Interval` | 5.8CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115547 | Command execution via Admin Console Input in Okta Access Gateway | 9.1CNA v3.1 | 0.4% | 2026-10-23 | |
| CVE-2026-115546 | Authentication Source Verification issue in Okta Access Gateway | 8.1CNA v3.1 | 0.4% | 2026-10-23 | |
| CVE-2026-115537 | gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect | 5.3CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-115536 | gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross-site scripting | 5.3CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-115497 | Music Store WordPress plugin unauthenticated arbitrary file read via f parameter | 7.5CNA v3.1 | 1.0% | 2026-10-23 | Fix |
| CVE-2026-115481 | baserproject baserCMS BcCustomContent vulnerability | 8.5CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115480 | baserCMS: Public Web API mail-form submission bypasses image CAPTCHA | 5.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115479 | baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients | 5.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-115478 | The-40-Thieves obsidian-tc Memory-lifecycle tools incorrect authorization | 7.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115477 | The-40-Thieves obsidian-tc incorrect authorization | 7.1CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-115457 | baserCMS: Unauthenticated stored XSS via Shortcode Expansion in Blog Comments | 7.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-114624 | baserCMS: PHP object injection via unguarded unserialize in the widget-area entity | 7.2CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-114623 | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure | 6.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-114622 | baserCMS: Encoded path traversal bypass in the theme file API | 7.2CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-114621 | baserCMS: SQL injection in the admin panel and admin API | 8.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-114357 | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) | 7.0CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-114356 | DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization | 7.0CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-114355 | DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root | 8.6CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-114354 | DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root | 8.6CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-114353 | DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution | 7.0CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-113951 | Apple Container arbitrary command execution | – | – | 2026-10-23 | |
| CVE-2026-113877 | HTTP::Headers::ActionPack versions for Perl allow CPU exhaustion | – | – | 2026-10-23 | Fix |
| CVE-2026-113501 | LiteSpeed Cache for WordPress Subscriber+ Pinned Administrative Notice Dismissal | 3.1CISA ADP v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-113500 | LiteSpeed Cache for WordPress unauthenticated stored XSS via Font Display Optimization | 7.5CISA ADP v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-113499 | LiteSpeed Cache for WordPress unauthenticated stored XSS via CDN Inline CSS Rewriting | 7.5CISA ADP v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-113472 | Depicter - Editor+ arbitrary file upload via Media upload | 5.4CISA ADP v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-112904 | Vvveb: Path traversal in nextRestore and nextBackup | 8.7CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112863 | KALLYAS WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112862 | Participants Database WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.3% | 2026-10-23 | |
| CVE-2026-112860 | Participants Database WordPress plugin SQL injection | 9.3CNA v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-112859 | Little Birdies WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112858 | Rhodos WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112857 | Reprizo WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112856 | Vagabonds WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112855 | Redy WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112854 | Holistic Center WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112853 | Hallelujah WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112852 | Helion WordPress theme PHP object injection | 8.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112851 | HotLock WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112850 | Your Dress WordPress theme local file inclusion | 8.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112849 | Hostme v2 WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112848 | Hostme v2 WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112847 | ZenSoul WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112846 | Save Life WordPress theme PHP object injection | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-112838 | VikRentCar WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-112837 | GamiPress WordPress plugin SQL injection | 8.5CNA v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-112835 | VikRentCar WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-112825 | Car Rental Manager WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-112821 | Knit Pay WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-112359 | WPMobile.App WordPress plugin broken access control | 7.5CNA v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-112342 | Tandoor Recipes Cross-Space Permission cache poisoning | 7.1CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-112333 | GFI Archiver stored XSS via MailInsights.aspx | 5.1CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-112230 | Popup Builder for WordPress unauthenticated Popup Trashing via post_type parameter | 3.7CISA ADP v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-112219 | Download Monitor for WordPress Multisite Subsite incorrect authorization | 4.9CISA ADP v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-111982 | Profile Builder for WordPress Multisite Subsite Network Super admin account takeover | 7.2CISA ADP v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-111966 | Profile Builder for WordPress Contributor+ stored XSS via redirect_url shortcode attribute | 6.8CISA ADP v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-111965 | Profile Builder - Subscriber+ Comment reCAPTCHA Bypass | 4.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-111738 | Speed Optimizer for WordPress Admin+ Network option update via enable-option/disable-option | 5.5CISA ADP v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-111737 | Speed Optimizer for WordPress Admin+ stored XSS via DNS Prefetch and Font Preload URL Lists | 3.5CISA ADP v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-110975 | Autotune: Kruize/autotune: Kruize/autotune: Datasources credential disclosure | 7.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-110537 | Essential Addons for Elementor for WordPress Cross-Site user Approval State Change via Bulk action | 3.8CISA ADP v3.1 | 0.1% | 2026-10-23 | |
| CVE-2026-110510 | Essential Addons for Elementor for WordPress content injection | 3.5CISA ADP v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-109936 | Otter Blocks for WordPress unauthenticated stored XSS via Dynamic content Render Filter | 7.5CISA ADP v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-109935 | Otter Blocks for WordPress unauthenticated Restricted block content disclosure via REST API | – | 0.1% | 2026-10-23 | Fix |
| CVE-2026-109934 | Otter Blocks - Unauthenticated Non-Public Content Disclosure via REST API | 5.3CISA ADP v3.1 | 0.1% | 2026-10-23 | Fix |
| CVE-2026-109933 | Otter Blocks for WordPress Contributor+ stored XSS via block Style attributes | 6.8CISA ADP v3.1 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-109198 | Anti-Spam by CleanTalk WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.4% | 2026-10-23 | Fix |
| CVE-2026-107858 | Google Agent Development Kit (ADK) for Java development web server vulnerability | 7.2CNA v4.0 | 0.4% | 2026-10-23 | Fix |
| CVE-2026-107685 | agentjido req_llm WebSocket streaming client improper certificate validation | 9.1CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-106765 | @rog0x mcp-docker-tools handleImageList function vulnerability | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-106764 | @rog0x mcp-git-tools resolveBaseBranch function vulnerability | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-106763 | @justice8096 sagemath-mcp-server escapeShellString and sanitizeCode functions vulnerability | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-106074 | Node.js Node insufficient randomness | 4.8CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-106073 | Node.js Node improper access control | 3.3CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-106072 | Node.js Node improper certificate validation | 6.7CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-106071 | Node.js Node improper access control | 3.6CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-106070 | Node.js Node business logic error | 3.7CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-106069 | Node.js Node improper certificate validation | 7.4CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-105963 | elixir-plug plug_crypto information disclosure | 5.1CNA v4.0 | 0.7% | 2026-10-23 | Fix |
| CVE-2026-105483 | Node.js Node improper certificate validation | 7.4CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-105482 | Node.js Node improper access control | 7.4CNA v3.0 | – | 2026-10-23 | Exploit code |
| CVE-2026-105481 | Node.js Node time-of-check time-of-use race condition | 6.5CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-102786 | Joomla extension phoca.cz authenticated stored cross-site scripting | 8.6CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-99087 | Linux kernel dm-integrity null pointer dereference | – | – | 2026-10-23 | |
| CVE-2026-99086 | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the construct | – | – | 2026-10-23 | |
| CVE-2026-99085 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in sched_cpu_wait_empty() until nothing else is left, and the only thing that wak | – | – | 2026-10-23 | |
| CVE-2026-99084 | In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate_dir() takes the directory's i_rwsem shared and holds it across ->iterate_shared(). For a directory that never has an entry and is never removed the lock keeps nothing s | – | – | 2026-10-23 | |
| CVE-2026-99083 | Linux kernel ksmbd out-of-bounds write | – | – | 2026-10-23 | |
| CVE-2026-99082 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvm_memslot | – | – | 2026-10-23 | |
| CVE-2026-99081 | Linux kernel bnxt_en buffer overflow | – | – | 2026-10-23 | |
| CVE-2026-99080 | In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear_inode() For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with | – | – | 2026-10-23 | |
| CVE-2026-99079 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is full, the XSK core frees the buffer. During the subsequent batched refill of a legacy cyclic RQ, mlx | – | – | 2026-10-23 | |
| CVE-2026-99078 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actual_wq_head is not advanced | – | – | 2026-10-23 | |
| CVE-2026-99077 | Linux kernel udp side-channel information leak | – | – | 2026-10-23 | |
| CVE-2026-99076 | Linux kernel udp side-channel information leak | – | – | 2026-10-23 | |
| CVE-2026-99075 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: reschedule node refcount update on thread exit When a thread exits via BINDER_THREAD_EXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment (e.g. pushed as deferr | – | – | 2026-10-23 | |
| CVE-2026-99074 | In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 ("net: ipv4: Cache pmtu for all packet paths if multipath enabled") made __ip_rt_update_pmtu() update every path. For nexthop objects, fib_info_num_path() and fi | – | – | 2026-10-23 | |
| CVE-2026-99073 | In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de ("inet: switch inet_dump_fib() to RCU protection") allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fib_dump_info_fnhe() uses fib_info_n | – | – | 2026-10-23 | |
| CVE-2026-99072 | In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added an RCU-only fib_nlmsg_size() call for asynchronous hardware flag notifi | – | – | 2026-10-23 | |
| CVE-2026-99071 | In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c ("net: ipv4: Emit notification when fib hardware flags are changed") added asynchronous route notifications for hardware flag changes. fib_alias_hw_flags_set() | – | – | 2026-10-23 | |
| CVE-2026-99070 | In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later fills it with rt6_fill_node(). With nexthop compatibility mode enabled, a concurrent replacement can grow th | – | – | 2026-10-23 | |
| CVE-2026-99069 | Linux kernel Input type confusion | – | – | 2026-10-23 | |
| CVE-2026-99068 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d ("ALSA: ctxfi: Simplify dao_clear_{left,right}_input() functions") centralized the DAO input mapper clearing logic in dao_clear_input(), but omitt | – | – | 2026-10-23 | |
| CVE-2026-99067 | In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() When paths_from_inode() fails, scrub_print_warning_inode() jumps to err without dropping the reference taken by btrfs_get_fs_root(), leaking a reference to | – | – | 2026-10-23 | |
| CVE-2026-99066 | Linux kernel can dev kernel panic | – | – | 2026-10-23 | |
| CVE-2026-99065 | In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus() With commit 2125c0034c5d ("cgroup/cpuset: Make cpuset hotplug processing synchronous"), the cpuset hotplug operation becomes synchronous. That commit also removes t | – | – | 2026-10-23 | |
| CVE-2026-99064 | In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by | – | – | 2026-10-23 | |
| CVE-2026-99063 | In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let data_start run past the buffer struct dm_ioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetof(struct dm_ioctl, data), is seven bytes shorter than sizeof(st | – | – | 2026-10-23 | |
| CVE-2026-99062 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read_skb() After a partial stream receive, rx_bytes tracks the unread suffix while buf_used and peer credit still cover the whole packet. virtio_transport_read_skb() dequeues that packet | – | – | 2026-10-23 | |
| CVE-2026-99061 | Linux kernel brcmfmac crash | – | – | 2026-10-23 | |
| CVE-2026-99060 | Linux kernel mt7603 race condition | – | – | 2026-10-23 | |
| CVE-2026-99059 | In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partwa | – | – | 2026-10-23 | |
| CVE-2026-99058 | In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populate | – | – | 2026-10-23 | |
| CVE-2026-99057 | In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves wha | – | – | 2026-10-23 | |
| CVE-2026-99056 | Linux kernel strparser race condition | – | – | 2026-10-23 | |
| CVE-2026-99055 | Linux kernel tcp null pointer dereference | – | – | 2026-10-23 | |
| CVE-2026-99054 | Linux kernel tipc use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99053 | In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers then lock and access the | – | – | 2026-10-23 | |
| CVE-2026-99052 | In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem exported with security_label is mounted a second time, sget_fc() returns the existing superblock and nfs_get_root() calls security_ | – | – | 2026-10-23 | |
| CVE-2026-99051 | Linux kernel fsverity use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99050 | Linux kernel mpsse use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99049 | In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it. gpiolib does not call ->free() when | – | – | 2026-10-23 | |
| CVE-2026-99048 | Linux kernel gve deadlock | – | – | 2026-10-23 | |
| CVE-2026-99047 | In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached | – | – | 2026-10-23 | |
| CVE-2026-99046 | In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a le | – | – | 2026-10-23 | |
| CVE-2026-99045 | In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns t | – | – | 2026-10-23 | |
| CVE-2026-99044 | Linux kernel ice use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99043 | In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without check | – | – | 2026-10-23 | |
| CVE-2026-99042 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28 bytes. The IPv6 connec | – | – | 2026-10-23 | |
| CVE-2026-99041 | Linux kernel ip6_gre null pointer dereference | – | – | 2026-10-23 | |
| CVE-2026-99040 | In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring_restrict() installs a restriction while holding that semaphore | – | – | 2026-10-23 | |
| CVE-2026-99039 | In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_completion_timeout() is used to wait for device identification and address configuration requests to com | – | – | 2026-10-23 | |
| CVE-2026-99038 | In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them memstick_check() can pass its host->removing check just before rtsx_usb_ms_drv_remove() sets eject/removing. Its next request is then silently dropped: | – | – | 2026-10-23 | |
| CVE-2026-99037 | In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets | – | – | 2026-10-23 | |
| CVE-2026-99036 | Linux kernel dm race condition | – | – | 2026-10-23 | |
| CVE-2026-99035 | Linux kernel mtk-sd use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99034 | In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the | – | – | 2026-10-23 | |
| CVE-2026-99033 | In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, skb->data - skb_mac_header(skb)); That subtraction is only meaningful when the device actually has a | – | – | 2026-10-23 | |
| CVE-2026-99032 | Linux kernel net/smc use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99031 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicas | – | – | 2026-10-23 | |
| CVE-2026-99030 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The c | – | – | 2026-10-23 | |
| CVE-2026-99029 | In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sparx5->mall_entries. sparx5_tc_matchall_destroy() removes the en | – | – | 2026-10-23 | |
| CVE-2026-99028 | In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion c | – | – | 2026-10-23 | |
| CVE-2026-99027 | Linux kernel team use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99026 | In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_O | – | – | 2026-10-23 | |
| CVE-2026-99025 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovs_flow_cmd_dump() calls ovs_flow_stats_get | – | – | 2026-10-23 | |
| CVE-2026-99024 | In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called tee_device_register() on both the client and the supplicant device before the rest of struct optee had been initialized. tee_device_register() calls cde | – | – | 2026-10-23 | |
| CVE-2026-99023 | Linux kernel pcie-m2 memory leak | – | – | 2026-10-23 | |
| CVE-2026-99022 | In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading the | – | – | 2026-10-23 | |
| CVE-2026-99021 | Linux kernel of uninitialized memory use | – | – | 2026-10-23 | |
| CVE-2026-99020 | In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n_linear_ranges, but tps65224_bucks_2_3_4_ranges[] only has two entries, covering selectors 0x00-0x45 | – | – | 2026-10-23 | |
| CVE-2026-99019 | In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch->dt[]. scsi_de | – | – | 2026-10-23 | |
| CVE-2026-99018 | Linux kernel entry missing brute-force protection | – | – | 2026-10-23 | |
| CVE-2026-99017 | In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mi | – | – | 2026-10-23 | |
| CVE-2026-99016 | In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm amoswap/amoadd/.../l | – | – | 2026-10-23 | |
| CVE-2026-99015 | Linux kernel hci_sock crash | – | – | 2026-10-23 | |
| CVE-2026-99014 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix command skb lifetime during scan setup During PA sync scan setup, hci_le_set_ext_scan_param_sync() gets the address used for the PA_LINK lookup from hci_sent_cmd_data(). The returned pointer borrows storag | – | – | 2026-10-23 | |
| CVE-2026-99013 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before calling iso_listen_bis() to preserve the hdev->lock ordering. Two concurrent listen() calls on the same broadcast socket can there | – | – | 2026-10-23 | |
| CVE-2026-99012 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls iso_sock_connect() checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check whi | – | – | 2026-10-23 | |
| CVE-2026-99011 | Linux kernel SCO use-after-free | – | – | 2026-10-23 | |
| CVE-2026-99010 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when | – | – | 2026-10-23 | |
| CVE-2026-99009 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex An RFCOMM connect() issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between rf | – | – | 2026-10-23 | |
| CVE-2026-99008 | Linux kernel RFCOMM null pointer dereference | – | – | 2026-10-23 | |
| CVE-2026-99007 | In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN __drm_fb_helper_initial_config_and_unlock() calls drm_client_modeset_probe() first, which already fills in each mode_set->mode/num_connectors for every conne | – | – | 2026-10-23 | |
| CVE-2026-99006 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for eb_relocate_parse_slow() to call kvfree() on entries outside the original exec array during following scenario inside eb_relocate_parse_slow(): 1) eb_copy_ | – | – | 2026-10-23 | |
| CVE-2026-99005 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intel_rps_boost() reading a stale ACTIVE state and queuing rps->work, where ACTIVE may be changed via asynchronous calls triggered by wak | – | – | 2026-10-23 | |
| CVE-2026-99004 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 ("drm/imagination: Fix page count for page table for map() interface") passed the device address to pvr_mmu_op_context_create(), but the prealloc | – | – | 2026-10-23 | |
| CVE-2026-99003 | Linux kernel drm/panthor crash | – | – | 2026-10-23 | |
| CVE-2026-99002 | In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping. | – | – | 2026-10-23 | |
| CVE-2026-99001 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->work when the adapter is registered under the xe I2C platform device, and xe_i2c_client_work() then in | – | – | 2026-10-23 | |
| CVE-2026-99000 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, since the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count refcount rather | – | – | 2026-10-23 | |
| CVE-2026-98999 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's pinned_link list membership in xe->pinned.late.external, based on whether the current call | – | – | 2026-10-23 | |
| CVE-2026-98998 | In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove() callback This driver stores struct th1520_hdmi * in platform drvdata, but th1520_dw_hdmi_remove() was reading it back as struct dw_hdmi * and passing it to dw_hdmi_remove(), so teardown run | – | – | 2026-10-23 | |
| CVE-2026-98997 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moves it with ttm_bo_move_null() and its contents | – | – | 2026-10-23 | |
| CVE-2026-98996 | In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those | – | – | 2026-10-23 | |
| CVE-2026-98995 | In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount of the parent when it unmounts the mount that overmounts it. mnt_change_mountpoint() doesn't. It moves the mount to its new | – | – | 2026-10-23 | |
| CVE-2026-98994 | In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of the parent through m->mnt_parent with namespace_sem held for reading. That's fine for a mount that is in a namespace. Everyth | – | – | 2026-10-23 | |
| CVE-2026-98993 | In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken out of its namespace. It's never cleared. __detach_mounts() unhooks a mount that carries it instead | – | – | 2026-10-23 | |
| CVE-2026-98992 | In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no | – | – | 2026-10-23 | |
| CVE-2026-98991 | In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per name | – | – | 2026-10-23 | |
| CVE-2026-98990 | In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrink_submounts() and mark_mounts_for_expiry() first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is deci | – | – | 2026-10-23 | |
| CVE-2026-98989 | In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own fi | – | – | 2026-10-23 | |
| CVE-2026-98988 | In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespac | – | – | 2026-10-23 | |
| CVE-2026-98987 | In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach_recursive_mnt() preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on to | – | – | 2026-10-23 | |
| CVE-2026-98986 | In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mnt_ns_release() drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotify_mntns_delete(). That takes the mutex o | – | – | 2026-10-23 | |
| CVE-2026-98985 | In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the parents of new_root and of the caller's root and checks whether they are shared before it checks that either mount is in the call | – | – | 2026-10-23 | |
| CVE-2026-98984 | In the Linux kernel, the following vulnerability has been resolved: dcache: don't put a mountpoint on a dentry that's being removed rmdir(), unlink() and rename() call dont_mount() on the victim and then detach_mounts() with the victim's inode locked. do_lock_mount() takes the inode lock of the mo | – | – | 2026-10-23 | |
| CVE-2026-98983 | In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and drop | – | – | 2026-10-23 | |
| CVE-2026-98982 | In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE_NORCU and dentry_free() frees them r | – | – | 2026-10-23 | |
| CVE-2026-98981 | In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and then call d_delete() once the inode is u | – | – | 2026-10-23 | |
| CVE-2026-98980 | In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. step_into() step_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock. An entry that gets unlinked in betwe | – | – | 2026-10-23 | |
| CVE-2026-98979 | In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount names | – | – | 2026-10-23 | |
| CVE-2026-98978 | In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrink_submounts() doesn't. A shrinkable mo | – | – | 2026-10-23 | |
| CVE-2026-98977 | In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach_recursive_mnt() locks every copy of the source mount to protect overmounts from vanishing and revealing the underlyin | – | – | 2026-10-23 | |
| CVE-2026-98976 | In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attach_recursive_mnt() transfers MNT_LOCKED from the top mount to the mount that is moved beneath it with MOVE_MOUNT_BENEATH. This allows the owner of a u | – | – | 2026-10-23 | |
| CVE-2026-98975 | In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to i_disk_size, xmi_can_exchange_reflink_flags() assumes every mapping moved and hands the reflink flag over to the other | – | – | 2026-10-23 | |
| CVE-2026-98974 | Linux kernel xfs incorrect behavior | – | – | 2026-10-23 | |
| CVE-2026-98973 | In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked list_del in drm_bridge_add() When re-adding a bridge that was previously removed, drm_bridge_add() drops it from bridge_lingering_list without holding bridge_lock. Both bridge_list and bridge_lingering_li | – | – | 2026-10-23 | |
| CVE-2026-98972 | Linux kernel cgroup/cpuset use-after-free | – | – | 2026-10-23 | |
| CVE-2026-98971 | In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the cleanup action immediately when registering the action fails. gpio_exar_probe() currently stores the allocated ID in exar_gpio on | – | – | 2026-10-23 | |
| CVE-2026-98970 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4_bo_cache_destroy() purges the cached BOs but never frees the size list, leaking it on every unbind. | – | – | 2026-10-23 | |
| CVE-2026-98969 | In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a ("net/sched: fix potential stack infoleak in em_text_dump()"), which zero-initialised the dump-side struct. Sashiko pointed at | – | – | 2026-10-23 | |
| CVE-2026-98968 | Linux kernel amt use-after-free | – | – | 2026-10-23 | |
| CVE-2026-98967 | In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path using xa_insert_bh(). The array is shared by the adapter's connections and initialized with XA_FLAGS_ | – | – | 2026-10-23 | |
| CVE-2026-98966 | In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation s | – | – | 2026-10-23 | |
| CVE-2026-98965 | In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql->num_queued, is updated by the ICE driver when it invokes __netdev_tx_sent_queu | – | – | 2026-10-23 | |
| CVE-2026-98964 | In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocatio | – | – | 2026-10-23 | |
| CVE-2026-98963 | In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio If all bios finish before btrfs_encoded_read_regular_fill_pages() returns, it calls btrfs_uring_read_extent_endio() and previously returned the I/O status. A n | – | – | 2026-10-23 | |
| CVE-2026-98962 | In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uring_read_extent(), the caller always jumped to out_acct. That skips kfree(data->iov), which is only correct for -EIOCBQUEUED where the deferred path owns the iov. | – | – | 2026-10-23 | |
| CVE-2026-98961 | In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent fails btrfs_uring_read_extent() runs only after btrfs_encoded_read() has taken the inode shared lock and the extent lock. On failure it used to unlock in out_fail | – | – | 2026-10-23 | |
| CVE-2026-98960 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io_uring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfs_uring_encoded_data in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. io_uring does not free driver PDU | – | – | 2026-10-23 | |
| CVE-2026-98959 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfs_dir_item item that packs multiple xattrs and then we replace the value of one of them (with the setxattr(2) family of syscalls) with anot | – | – | 2026-10-23 | |
| CVE-2026-98958 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid->non_aql_packets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware | – | – | 2026-10-23 | |
| CVE-2026-98957 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in __netif_napi_del_locked() and in page_pool_disable_direct_recycling() because the driver does not disab | – | – | 2026-10-23 | |
| CVE-2026-98956 | In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiod_set_value() emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in proce | – | – | 2026-10-23 | |
| CVE-2026-98955 | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of skb->len when computing thoff __skb_flow_dissect() computes key_control->thoff using: key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); min_t(u16, ...) casts both arguments | – | – | 2026-10-23 | |
| CVE-2026-98954 | In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in __virtio_net_hdr_to_skb() Commit 9e8db5913264 ("net: avoid false positives in untrusted gso validation") added a '&& skb->network_header' check before flow-dissecting GSO packets without VIRTIO_N | – | – | 2026-10-23 | |
| CVE-2026-98953 | In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink_rel reference leak when notify work is pending devlink_rel_nested_in_notify_work_schedule() takes a reference on the devlink_rel for the notify work and then queues the work, ignoring the return value of sched | – | – | 2026-10-23 | |
| CVE-2026-98952 | In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp_encap_recv() only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcp_session_recv() then reads the 8 byte SEID t | – | – | 2026-10-23 | |
| CVE-2026-98951 | In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() th | – | – | 2026-10-23 | |
| CVE-2026-98950 | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated befo | – | – | 2026-10-23 | |
| CVE-2026-98949 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm_bo handling in remap() When a map overlaps part of an existing mapping, pvr_vm_gpuva_remap() splits the mapping into prev/next parts covering what the request did not take, instead of creating | – | – | 2026-10-23 | |
| CVE-2026-98948 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Pars | – | – | 2026-10-23 | |
| CVE-2026-98947 | Linux kernel vsock memory leak | – | – | 2026-10-23 | |
| CVE-2026-98946 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the int | – | – | 2026-10-23 | |
| CVE-2026-98945 | In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This a | – | – | 2026-10-23 | |
| CVE-2026-98944 | In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the | – | – | 2026-10-23 | |
| CVE-2026-98943 | In the Linux kernel, the following vulnerability has been resolved: HID: steam: Clean up locking This cleans up several issues with locking behavior, including RCU accesses not being guarded behind a lock. | – | – | 2026-10-23 | |
| CVE-2026-98942 | Linux kernel sched_ext uninitialized memory use | – | – | 2026-10-23 | |
| CVE-2026-98941 | Linux kernel ext4 crash | – | – | 2026-10-23 | |
| CVE-2026-98940 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant->dai_driver. When configuring a DAI with LPAIF_I2SCTL_MOD | – | – | 2026-10-23 | |
| CVE-2026-98939 | Linux kernel x86/mm deadlock | – | – | 2026-10-23 | |
| CVE-2026-98938 | Linux kernel irq race condition | – | – | 2026-10-23 | |
| CVE-2026-98937 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclud | – | – | 2026-10-23 | |
| CVE-2026-98936 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did n | – | – | 2026-10-23 | |
| CVE-2026-98935 | Linux kernel rtc dev information disclosure | – | – | 2026-10-23 | |
| CVE-2026-98934 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3c | – | – | 2026-10-23 | |
| CVE-2026-98933 | Linux kernel hub crash | – | – | 2026-10-23 | |
| CVE-2026-98932 | Linux kernel EDAC/altera use-after-free | – | – | 2026-10-23 | |
| CVE-2026-98931 | Linux kernel spinand null pointer dereference | – | – | 2026-10-23 | |
| CVE-2026-98930 | Linux kernel s390 injection | – | – | 2026-10-23 | |
| CVE-2026-98929 | In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled by default. regist | – | – | 2026-10-23 | |
| CVE-2026-98928 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE from the host separately, but pkvm_vcpu_init_sve() tests the bit while vcpu_has | – | – | 2026-10-23 | |
| CVE-2026-98927 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPU_INIT for whole guest, which | – | – | 2026-10-23 | |
| CVE-2026-98926 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream->sink->link, which can be | – | – | 2026-10-23 | |
| CVE-2026-98925 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances | – | – | 2026-10-23 | |
| CVE-2026-98924 | In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bdev_mark_dead() calls evict_inodes() whi | – | – | 2026-10-23 | |
| CVE-2026-98923 | In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys(): | – | – | 2026-10-23 | |
| CVE-2026-98922 | Linux kernel emac crash | – | – | 2026-10-23 | |
| CVE-2026-98921 | Linux kernel ovl use-after-free | – | – | 2026-10-23 | |
| CVE-2026-98920 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_ | – | – | 2026-10-23 | |
| CVE-2026-98919 | Linux kernel drm/xe divide by zero | – | – | 2026-10-23 | |
| CVE-2026-98918 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check() picks a random byte address within the region and stores it in r->sampling_addr. damon_va_mkold() passes it into a page table | – | – | 2026-10-23 | |
| CVE-2026-98917 | Linux kernel parisc crash | – | – | 2026-10-23 | |
| CVE-2026-98916 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link. | – | – | 2026-10-23 | |
| CVE-2026-98915 | In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of video_unregister_device() during drive | – | – | 2026-10-23 | |
| CVE-2026-98914 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded. | – | – | 2026-10-23 | |
| CVE-2026-98913 | In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp_get(), the PTP PCI device reference is | – | – | 2026-10-23 | |
| CVE-2026-98912 | In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverte | – | – | 2026-10-23 | |
| CVE-2026-98911 | In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since the dpaa2_switch_free_fd() is intended | – | – | 2026-10-23 | |
| CVE-2026-98910 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and | – | – | 2026-10-23 | |
| CVE-2026-98909 | In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the | – | – | 2026-10-23 | |
| CVE-2026-98908 | In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resour | – | – | 2026-10-23 | |
| CVE-2026-98907 | In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLKBSZSET as the one fixed by commit 3f29d66 | – | – | 2026-10-23 | |
| CVE-2026-98906 | In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966x_fdma_reload() backs up rx->page_pool and rx->fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back befo | – | – | 2026-10-23 | |
| CVE-2026-98905 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfd_queue_acquire_buffers() was split off from set_queue_properties_from_user(), set_queue_properties_from_criu() was missed. Thus, set_queue_properties_from_criu() i | – | – | 2026-10-23 | |
| CVE-2026-98904 | In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devm_pm_runtime_enable() sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pm_runtime_enable() into the removal path instead doing it early. Thi | – | – | 2026-10-23 | |
| CVE-2026-98903 | In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imx_mu_isr() imx_mu_shutdown() | – | – | 2026-10-23 | |
| CVE-2026-98902 | In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bm_seq comparison wrap-safe Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way. | – | – | 2026-10-23 | |
| CVE-2026-98901 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that | – | – | 2026-10-23 | |
| CVE-2026-98900 | In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntalloc_ioctl_alloc() allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so re | – | – | 2026-10-23 | |
| CVE-2026-98899 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtype_gc we need the rcu lock | – | – | 2026-10-23 | |
| CVE-2026-98898 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. (cherry pick | – | – | 2026-10-23 | |
| CVE-2026-98897 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci->m_lock while waiting for a lease break ack When a cifs.ko client caches a read-handle (RH) lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in w | – | – | 2026-10-23 | |
| CVE-2026-98896 | Linux kernel thunderbolt use-after-free | – | – | 2026-10-23 | |
| CVE-2026-98895 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that points to it in a list. If such table is | – | – | 2026-10-23 | |
| CVE-2026-98894 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does n | – | – | 2026-10-23 | |
| CVE-2026-98893 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate SENSOR_UPDATE payload size SENSOR_UPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did n | – | – | 2026-10-23 | |
| CVE-2026-98892 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size BASE_ERROR_EVENT carries a variable number of message reports, with the count encoded in error_status. The notification parser used that count without checking whether the | – | – | 2026-10-23 | |
| CVE-2026-98891 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame l | – | – | 2026-10-23 | |
| CVE-2026-98890 | In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. | – | – | 2026-10-23 | |
| CVE-2026-98889 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() | – | – | 2026-10-23 | |
| CVE-2026-98888 | In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe | – | – | 2026-10-23 | |
| CVE-2026-98887 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from | – | – | 2026-10-23 | |
| CVE-2026-98886 | In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xfer_read() waits for the HDMI I2C transaction to reach I2C_TRANSACTION_DONE, but it ignores both timeout and signal returns from wait_for_completion_interruptible_timeout(). | – | – | 2026-10-23 | |
| CVE-2026-98885 | In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which f | – | – | 2026-10-23 | |
| CVE-2026-98884 | Linux kernel mmc core undefined behavior | – | – | 2026-10-23 | |
| CVE-2026-98883 | In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: recognize UPIO_AU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250_port.c:462 at set_io_from_upio+0xfc/0x124, CPU#0: swapper/0/1 Unsu | – | – | 2026-10-23 | |
| CVE-2026-98882 | Linux kernel wave5 buffer overflow | – | – | 2026-10-23 | |
| CVE-2026-98881 | In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() This rcu_barrier() came from a time call_rcu() calls were used in net/bridge/br_multicast.c. Now kfree_rcu() is there, we can remove this problematic rcu_barrier() | – | – | 2026-10-23 | |
| CVE-2026-98880 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle set_blocksize failures ntfs3 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(offset >= folio_size(folio)); in folio_set_bh on the first __bre | – | – | 2026-10-23 | |
| CVE-2026-98879 | In the Linux kernel, the following vulnerability has been resolved: isofs: handle set_blocksize failures isofs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting we will hit the BUG_ON(offset >= folio_size(folio)); in folio_set_bh on the first __bre | – | – | 2026-10-23 | |
| CVE-2026-98878 | In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a priority drop. This is done via the GIC CDEOI system instruction. Once | – | – | 2026-10-23 | |
| CVE-2026-98877 | Linux kernel irqchip/gic-v4 kernel panic | – | – | 2026-10-23 | |
| CVE-2026-98876 | Linux kernel host1x bus null pointer dereference | – | – | 2026-10-23 | |
| CVE-2026-98875 | Linux kernel drm/nouveau/gsp crash | – | – | 2026-10-23 | |
| CVE-2026-98874 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these case | – | – | 2026-10-23 | |
| CVE-2026-98873 | Linux kernel nf_conntrack_expect uninitialized memory use | – | – | 2026-10-23 | |
| CVE-2026-98872 | Linux kernel freevxfs crash | – | – | 2026-10-23 | |
| CVE-2026-98871 | Linux kernel crypto deadlock | – | – | 2026-10-23 | |
| CVE-2026-98870 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbd_sessions_deregister() removes a connection's channels from other sessions' channel lists only while conn->binding is still set: if (conn->binding) { hash_for_eac | – | – | 2026-10-23 | |
| CVE-2026-95620 | Qt use-after-free | 2.1CNA v4.0 | – | 2026-10-23 | Fix |
| CVE-2026-94268 | Advanced Custom Fields: Extended Unauthenticated Administrator account takeover | 8.1CISA ADP v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-94267 | Advanced Custom Fields: Extended for WordPress unauthenticated RCE via Front-End post update action | 9.0CISA ADP v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-94264 | Advanced Custom Fields: Extended - Contributor+ XSS via form shortcode attributes | 6.8CISA ADP v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-94263 | The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 to 0.9.2.7 do not consistently disable shortcode processing in the confirmation message of their front-end forms, allowing unauthenticated visitors to have arbitrary shortcodes executed serve | 4.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-94262 | Advanced Custom Fields: Extended Unauthenticated Non-Administrator account takeover | 8.1CISA ADP v3.1 | 0.1% | 2026-10-23 | |
| CVE-2026-93640 | Zimbra Collaboration Suite local privilege escalation via Unrestricted zmunbound Sudo Configuration | 7.8CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93639 | Zimbra Collaboration Suite missing authorization | 8.7CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93638 | Zimbra Collaboration Suite Pre-authentication reflected cross-site scripting | 6.1CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93636 | Zimbra Collaboration Suite LDAP Filter injection via Calendar Resource Attribute Name | 4.3CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93634 | Zimbra Collaboration Suite Cross-account authorization bypass via Forged Shared-File Records | 4.3CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93633 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters | 5.4CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93631 | Zimbra Collaboration Suite OAuth extension cross-site request forgery enables Account Linking | 7.1CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93630 | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization | 4.3CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93629 | Zimbra Collaboration Suite Calendar Processing authentication bypass | 5.3CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93628 | Zimbra Collaboration Suite Calendar Processing authentication bypass | 5.3CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93627 | Zimbra Collaboration Suite Calendar Processing authentication bypass | 5.3CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-93489 | ASUS Router improper authentication | 8.7CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2026-91093 | HP One Agent Software Security Update | 8.5CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-90458 | OpenStack Ironic improper type validation | 5.4CNA v3.1 | 0.3% | 2026-10-23 | |
| CVE-2026-89419 | OpenStack Ironic unprotected alternate path | 5.0CNA v3.1 | 0.3% | 2026-10-23 | |
| CVE-2026-89320 | Eclipse KeyPont HmacShaCryptor.Hash improper integrity check validation | 8.8CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2026-89319 | Eclipse KeyPont JweDirectDecryptorBlock.Decrypt improper array index validation | 6.3CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2026-89318 | Eclipse KeyPont JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length | 6.9CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2026-89317 | Eclipse KeyPont JwtVerifierImpl.Verify does not enforce the JWS `crit` header (RFC 7515 §) | 6.3CNA v4.0 | 0.1% | 2026-10-23 | |
| CVE-2026-89316 | Eclipse KeyPont LoadPublicKey panics on kty/alg mismatch via unchecked *ECDSAOptions type assertion | 6.3CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2026-89315 | Eclipse KeyPont JwtClaims.MarshalJSON denial of service | 6.9CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-89314 | Eclipse KeyPont jwkFields.CheckConsistency algorithmic complexity | 6.9CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-89313 | Eclipse KeyPont JwksTrustStore.Get incorrectly resolved name or reference | 6.3CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2026-89312 | Eclipse KeyPont AesGcmCryptor.Open denial of service | 6.9CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-87901 | phpBB registration module improper neutralization | 8.3CNA v3.0 | – | 2026-10-23 | |
| CVE-2026-86055 | Part-DB-server host header injection | 8.7CNA v4.0 | 0.4% | 2026-10-23 | |
| CVE-2026-86020 | Part-DB: Spreadsheet formula injection in XLSX Part Exports | 4.6CNA v3.1 | 0.1% | 2026-10-23 | |
| CVE-2026-86019 | Part-DB: Attachment Size Limit Bypass via API Base64 upload | 5.3CNA v4.0 | 0.2% | 2026-10-23 | |
| CVE-2026-86018 | Part-DB: Authenticated Disk Exhaustion via Unbounded Server-Side Attachment Downloads | 5.3CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-83813 | Twisted: DNS Response spoofing in twisted.names due to Missing Source Address Validation | 3.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-79982 | zephyrproject zephyr USB Bluetooth HCI transport class out-of-bounds write | 8.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-79981 | zephyrproject zephyr DNS stub resolver insufficient randomness | 6.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-79980 | Zephyr DHCPv4 client vulnerability | 5.6CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-79979 | zephyrproject zephyr arm64 MMU backend use-after-free | 7.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-79978 | zephyrproject zephyr out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path | 3.6CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-79977 | zephyrproject Zephyr WireGuard VPN service missing authentication | 8.2CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-75779 | ASUS Router OS command improper neutralization | 8.6CNA v4.0 | 1.0% | 2026-10-23 | |
| CVE-2026-75775 | ASUS Router OS command in certain ASUS improper neutralization | 7.7CNA v4.0 | 0.5% | 2026-10-23 | |
| CVE-2026-75525 | open-reception appointment-booking-software staff-crypto recipient directory incorrect authorization | 5.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-75524 | open-reception appointment-booking-software race condition | 5.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-65825 | open-reception appointment-booking-software missing brute-force protection | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-65824 | open-reception appointment-booking-software authentication bypass by replay | 7.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-63244 | WizLearn Technologies Learning Management System authentication bypass | 9.8CNA v3.1 | 0.5% | 2026-10-23 | |
| CVE-2026-63243 | Creative Sound Blaster Katana V2 Bluetooth Low Energy implementation vulnerability | 4.3CNA v3.1 | 0.3% | 2026-10-23 | |
| CVE-2026-63120 | PGHoard: Incomplete path traversal fix in restore.py allows arbitrary file write | 8.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-59188 | Part-DB: SVG Sanitization Bypass via extension spoofing leads to stored XSS in Attachment Viewer | 5.4CNA v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-58497 | Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests | 8.6CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-58202 | open-reception appointment-booking-software auth resend-confirmation API account takeover | 8.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57845 | Hugging Face Datasets Pickle deserialization RCE via Pandas Builder | 8.7CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-57210 | Heimdall: IP spoofing via Unvalidated Forwarding headers | 7.0CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-57209 | Heimdall: Forwarded header injection via Unsanitized host header in Proxy Mode | 7.0CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-57208 | entireio cli checkpoint session metadata path traversal | 6.2CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-57207 | NetBox MCP Server: HTTP transport exposes all NetBox data without authentication | 5.9CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57146 | PraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57144 | MervinPraison PraisonAI SandlockSandbox protection mechanism failure | 8.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57142 | MervinPraison PraisonAI recipe workflow policy incorrect authorization | 7.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57121 | MervinPraison PraisonAI Platform API improper authorization | 8.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57117 | PraisonAI: Compute-bridged file tools allow shell command injection | 8.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57116 | MervinPraison PraisonAI AgentOS FastAPI deployment surface missing authentication | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57114 | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding | 7.2CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-57113 | MervinPraison PraisonAI template loader path traversal | 8.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56840 | MervinPraison PraisonAI HTTPApproval dashboard cross-site scripting | 8.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56838 | PraisonAI recipe.run_stream skips dangerous-tool policy enforcement | 7.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56837 | PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing | 8.6CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56836 | PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard | 8.2CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56835 | PraisonAI Slack app_mention bypasses configured user/channel authorization | 8.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56834 | PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56833 | MervinPraison PraisonAI Dynamic Context module path traversal | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-56832 | PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals | 8.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55981 | A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. | 9.6CNA v3.1 | 0.3% | 2026-10-23 | |
| CVE-2026-55889 | flatpak xdg-desktop-portal FileTransfer.RetrieveFiles method insufficient randomness | 8.3CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-55888 | xdg-desktop-portal FileChooser.SaveFiles method path traversal | 8.8CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-55835 | Lookyloo: Potential sub-system DoS due to parameter missmatch in notification | 6.9CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-55826 | stape-io gtm-server-side-wordpress-plugin information disclosure | 8.7CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-55606 | OpenWrt odhcpd DHCPv6 self-loop detection vulnerability | 6.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55600 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name | 5.7CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-55486 | intranda goobi-viewer-core AuthorizationFlowResource reflected XSS | 9.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55465 | intranda goobi-viewer-core goobi viewer: Solr injection | 5.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55463 | intranda goobi-viewer-core Jakarta WebSocket endpoints missing authentication | 6.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55459 | intranda goobi-viewer-core goobi viewer: OpenID JWT audience not enforced by the verifier | 7.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55457 | intranda goobi-viewer-core AuthorizationFilter improper authentication | 7.4CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55444 | intranda goobi-viewer-core goobi viewer: Solr query injection | 5.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55442 | intranda goobi-viewer-core SolrTools.cleanUpQuery improper input validation | 5.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55422 | conda-forge.github.io conda-forge.org: Stored DOM XSS | 4.6CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55222 | Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap | 5.1CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-55190 | eventschedule event Schedule Vulnerable to SSRF: IsUrlSafe bypassable | 6.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-54711 | PGHoard: Password written to debug log | 2.4CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-54668 | kitodo-production Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers | 8.7CNA v4.0 | – | 2026-10-23 | Exploit code |
| CVE-2026-54631 | Part-DB: Hard-coded APP_SECRET enables forged remember-me cookie | 6.3CNA v3.1 | 0.1% | 2026-10-23 | |
| CVE-2026-54630 | Part-DB: Authenticated RCE via .phar attachment upload served from public/media | 9.6CNA v3.1 | 0.2% | 2026-10-23 | |
| CVE-2026-54615 | Part-DB: Stored XSS / HTML injection in activity-log Extra column | 6.0CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-53942 | Conda Organization Infrastructure update workflow code injection | 9.9CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-53921 | OpenWrt odhcpd DHCPv6 IA response handler stack buffer overflow | 9.8CNA v3.1 | – | 2026-10-23 | Exploit code |
| CVE-2026-53920 | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure | 8.7CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-53918 | odhcpd DHCPv6 IA dangling first pointer use-after-free | 8.8CNA v4.0 | – | 2026-10-23 | |
| CVE-2026-52356 | D-Link DAP1160L diagnostic.php OS command injection | – | – | 2026-10-23 | |
| CVE-2026-50787 | e-SIC Livre captcha.php denial of service | – | – | 2026-10-23 | |
| CVE-2026-50057 | Zimbra Collaboration Suite local privilege escalation via Unrestricted Postfix Sudo Permissions | 7.8CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-50056 | Zimbra Collaboration Suite local privilege escalation via zmmailboxdmgr JVM argument injection | 7.8CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-50053 | Zimbra Collaboration Suite RestFilter request Attribute Override via Unauthenticated URL parameters | 8.7CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-49442 | Cacti: User Enumeration via Error messages | 5.3CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-46652 | intranda goobi-viewer-core path traversal | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-46651 | intranda goobi-viewer-core unauthenticated SSRF and local file inclusion | 9.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-46531 | Cacti: Authenticated Stored 2nd-order SQL injection in automation_tree_rule_items.field | 5.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-46347 | intranda goobi-viewer-core insufficient randomness | 6.8CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-46346 | intranda goobi-viewer-core predictable identifiers | 6.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-39902 | Cacti: Authenticated RCE on Data Input | 7.2CNA v3.1 | – | 2026-10-23 | Exploit code |
| CVE-2026-25784 | Hallo Welt! BlueSpice insecure default initialization | 9.3CNA v4.0 | 0.3% | 2026-10-23 | Fix |
| CVE-2026-25716 | Hallo Welt! BlueSpice missing authorization | 7.1CNA v4.0 | 0.2% | 2026-10-23 | Fix |
| CVE-2026-19741 | zephyrproject zephyr OpenThread integration default credentials | 7.5CNA v3.1 | – | 2026-10-23 | |
| CVE-2026-19678 | onPhase Forms server-side request forgery (SSRF) leading to Internal Solr data disclosure | 8.7CNA v4.0 | 0.4% | 2026-10-23 | Fix |
| CVE-2026-19677 | onPhase Forms authentication bypass leading to Server-Side command execution | 9.3CNA v4.0 | 0.5% | 2026-10-23 | Fix |
| CVE-2026-16762 | Denial of service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt | 8.7CNA v4.0 | 0.4% | 2026-10-23 | Fix |
| CVE-2026-10632 | Zimbra Collaboration Suite Classic Web client reflected cross-site scripting | 8.7CNA v3.1 | – | 2026-10-23 | Fix |
| CVE-2026-4952 | VertiGIS WebOrderSystem OrderAdministration portal stored cross-site scripting | 5.1CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-4951 | Reflected cross-site scripting in CustomerAdministration Portalin VertiGIS WebOrderSystem | 5.1CNA v4.0 | 0.4% | 2026-10-23 | |
| CVE-2026-4950 | Stored cross-site scripting in CustomerAdministration Portal in VertiGIS WebOrderSystem | 4.8CNA v4.0 | 0.3% | 2026-10-23 | |
| CVE-2026-115534 | gedelumbung HospitalManagement Contact form contact.php kirim cross-site scripting | 5.3CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115519 | Sensitive cookies without Secure and HttpOnly attributes in KNIME Business Hub | 2.1CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115517 | Unrestricted network access between execution contexts in KNIME Business Hub | 6.4CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-115516 | An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A workaround is not possible. The same behaviour is present in on-premise KNIME Business Hub installations but it was designed as such in order to foster | 6.9CNA v4.0 | – | 2026-10-22 | |
| CVE-2026-115513 | OpenCATS stored XSS via MRU Navigation Panel | 6.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115509 | Jitsu Console Cross-Workspace authorization bypass via sources/state API | 2.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115508 | Crawl4AI ReDoS via /crawl Regex fields | 7.1CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115507 | Vikunja HTML injection via Notification Email header | 5.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115506 | libexpat denial of service via billion laughs Detection Delay | 8.7CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-115505 | libsmb2 integer overflow in DCE/RPC NDR Decoder via NetrShareEnum | 7.2CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115504 | CFITSIO out-of-bounds write via ffgcls2 in getcols.c | 8.5CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-115503 | Ghidra denial of service via Compressed Extension Archive | 6.8CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115502 | DataApp links without login expose job information to other user in KNIME Business Hub | 6.3CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115496 | Workflow names may be leaked to unauthenticated users in KNIME Business Hub | 6.9CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-115494 | CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub | 5.3CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115482 | litespeedtech LSQUIC resource exhaustion | 7.5CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-115454 | Large tables in data apps can bring down execution services in KNIME Hub | 5.3CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-115453 | MarcosCamara01 Ecommerce Template cart and wishlist repositories insecure direct object reference | 7.1CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115450 | MarcosCamara01 Ecommerce Template cart and checkout flow web parameter tampering | 7.1CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115449 | libslirp information disclosure | 3.5CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-115424 | Red Hat OpenShift Container Platform 4 oc image extract symlink following | 5.5CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-115419 | Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server | 8.6CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115417 | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt | 8.2CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115416 | AWS Amazon Athena incorrect authorization | 6.3CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115414 | OS command injection in the Terraform hook in AWS SAM CLI | 8.4CNA v4.0 | 0.9% | 2026-10-22 | Fix |
| CVE-2026-115411 | crawlseo server-side request forgery via Crawler | 5.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115400 | crawlseo cleartext storage of Google OAuth Tokens | 6.7CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115398 | Ghidra denial of service via TAR and ZIP File System Mount | 6.8CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115397 | Ghidra denial of service via Extension Archive Install | 6.8CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115396 | Ghidra denial of service via Compressed Theme Archive | 6.8CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115395 | Ghidra denial of service via ThemeReader.readZipTheme | 6.8CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115394 | Ghidra denial of service via BinaryField Memory Allocation | 6.8CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115393 | Wasmtime,,, and Cross-Engine type confusion | 1.0CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115392 | Wasmtime,,, and sandbox escape via Trailing Slashes | 8.8CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115391 | Wasmtime and Unbounded Heap Allocation via WASIp3 Streams | 6.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115390 | Wasmtime and Fuel Accounting Bypass DoS | 6.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115389 | Wasmtime,, and denial of service via Val API | 1.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115388 | Wasmtime,, and memory exhaustion DoS via wasmtime-wasi-http Outgoing Body Write | 6.9CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115387 | Wasmtime,, and host panic via WASI Filesystem Timestamp Overflow | 6.9CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115386 | Wasmtime,, and Memory Disclosure via fd_readdir | 2.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115385 | Wasmtime and host panic via WASIp3 Timestamps | 6.9CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115384 | Wasmtime and stack buffer overflow | 9.4CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115383 | Wasmtime and GC Heap Corruption via Tag Imports | 5.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115382 | Wasmtime and wasi:HTTP Zero Timeout panic DoS | 5.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115381 | Wasmtime,, and Unbounded Host Memory Allocation via SinkOutputStream write-zeroes | 5.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115380 | Wasmtime,, and Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoff | 5.1CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115379 | Wasmtime and GC Heap Corruption via try_call | 6.9CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115378 | Incus,, and arbitrary file write via Recursive File Pull | 6.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115377 | Incus,, and arbitrary file write via Symlink in Migration Stream | 9.4CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115376 | Incus and Project Restriction Bypass via Custom Volume Copy | 8.3CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115375 | Incus and path traversal via Instance Backup Dependent Volumes | 9.4CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115374 | Incus and Unsigned Header Bypass in Presigned S3 Upload URLs | 7.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115373 | lxc Incus authorization bypass | 7.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115372 | Incus Project Restriction Bypass via block.create_options | 9.0CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115371 | LXC Incus,, and Bucket credential disclosure via Storage Bucket Keys endpoints | 7.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115370 | Incus,, and Restricted Project Bypass via Clustered Migration Refresh | 5.3CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115369 | OpenBao PKI allowed_ip_sans_cidr Bypass via CSR IP SANs | 2.1CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115366 | OpenBao Missing Root Namespace Enforcement in Plugin Catalog APIs | 2.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115365 | OpenBao incorrect authorization via Policy Cache Namespace Traversal | 7.5CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115364 | OpenBao Missing Header Check on Agent/Proxy Quit endpoints | 2.1CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115363 | OpenBao and ACME EAB MAC key disclosure via Sanitized Configuration | 2.1CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115362 | OpenBao and Expired AppRole SecretID authentication bypass | 2.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115361 | OpenBao ACL Bypass via Dropped Templated Policy Denial | 2.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115360 | OpenBao open redirect via OIDC Identity Provider UI | 5.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115359 | OpenBao and Role-Based Rate Limit Quota Bypass via Request Parsing | 6.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115358 | OpenBao sensitive data leak in Audit Log via Malformed parameters | 2.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115357 | OpenBao and Improper Audit Logging of Root Generation and Rekey Responses | 2.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115356 | OpenBao and Kubernetes Auth Method Token Renewal after Revocation | 5.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115355 | Mistune path traversal and XSS via Include Directive | 8.7CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115354 | Mistune arbitrary Local File Read via Include Directive | 7.1CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115353 | Mistune path traversal via include Directive | 9.2CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115352 | Mistune Quadratic-Time DoS via Unmatched Brackets in Inline parser | 8.7CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115351 | Mistune CSS injection via Figure Directive figwidth option | 5.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115350 | Mistune stored XSS via Include Directive HTML files | 5.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115349 | Mistune denial of service via Nested Bracket Parsing | 8.7CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115348 | Mistune Quadratic-Time DoS via parse_link_text | 8.7CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115347 | Mistune Quadratic denial of service via parse_link_text | 8.7CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-115334 | Lotus authorization bypass via switch_organization endpoint | 7.6CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115333 | Lotus improper authentication via Event Ingestion API Key Prefix | 8.2CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115332 | Lotus SQL injection via Subscription Filter Keys | 8.7CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115331 | Lotus SQL injection via Metric Property Names and Filters | 8.7CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115330 | Lotus SQL injection via Custom SQL Billable Metrics | 8.7CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115329 | Lotus Cross-Organization IDOR via SubscriptionViewSet | 6.0CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115328 | JSON-SCADA SQL injection via OPC HistoryRead API | 8.7CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115327 | libyang uninitialized pointer Free in NETCONF RPC parser | 6.0CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115326 | QloApps IDOR via OrderDetailController Refund request | 5.3CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115325 | Netmaker authorization bypass via updateExtClient Unscoped Lookup | 8.7CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115324 | mem0 SQL injection via Databricks Vector Store | 9.2CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115323 | EverShop customer address API missing authorization | 6.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115322 | Bytebase authorization bypass via Rollout Service Task Run Handlers | 5.3CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-115321 | Bytebase authorization bypass via UpdateIssueComment | 5.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-115319 | fzf denial of service via maskActionContents | 2.0CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-115253 | WatchGuard Agent incorrect permission assignment in Log Directory allows Local Log tampering | 7.3CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-115249 | subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation | 5.1CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115248 | subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow | 5.3CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-115247 | subhajitkhan online-clinic-management-system patientregistration.php missing encryption | 5.3CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-115246 | subhajitkhan online-clinic-management-system patdocmsg.php cross-site scripting | 5.1CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-115221 | Red Hat Enterprise Linux 10 ipa: Freeipa: Freeipa uses subject cn as proof of certificate ownership | 5.4CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-115207 | patch path traversal | 5.5CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-114732 | Roundcube Webmail authentication bypass | 6.8CNA v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-114731 | Roundcube Webmail resource exhaustion | 5.3CNA v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-114730 | Roundcube Webmail server-side request forgery | 7.2CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114729 | Roundcube Webmail incomplete denylist | 5.3CNA v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-114728 | Roundcube Webmail incomplete denylist | 5.3CNA v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-114727 | Roundcube Webmail inclusion of untrusted functionality | 8.3CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114726 | Roundcube Webmail resource injection | 5.8CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114725 | Roundcube Webmail resource injection | 5.0CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114724 | Roundcube Webmail deserialization of untrusted data | 7.4CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114723 | Roundcube Webmail resource exhaustion | 3.7CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114722 | Roundcube Webmail incorrect resource transfer | 6.5CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114721 | Roundcube Webmail incorrect authorization | 3.1CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114720 | Roundcube Webmail CRLF injection | 7.1CNA v3.1 | 0.8% | 2026-10-22 | Fix |
| CVE-2026-114719 | Roundcube Webmail cross-site request forgery | 3.7CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114718 | Roundcube Webmail cross-site scripting | 4.7CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114717 | Roundcube Webmail resource injection | 4.0CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114716 | Roundcube Webmail resource injection | 8.5CNA v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-114715 | Roundcube Webmail incorrect authorization | 6.8CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114714 | Roundcube Webmail relative path traversal | 5.3CNA v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-114703 | Extensions for Leaflet Map WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-114702 | ND Shortcodes For Visual Composer WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-114701 | Waitlist Woocommerce ( Back in stock notifier ) WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-114700 | Restaurant Menu Food Ordering System Table Reservation WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-114699 | ЮKassa для WooCommerce WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114698 | myCred WordPress plugin insecure direct object references (IDOR) | 5.4CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114696 | Page Restriction WordPress (WP) plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114665 | Goploy symlink following arbitrary file read via /deploy/fileDiff and /deploy/fileCompare | 7.1CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-114664 | Frappe blind SQL injection via get_events | 7.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114663 | Vyper Name Shadowing of Imported Constants and Default arguments | 8.6CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-114662 | Obot API Key Theft via CLI Login Token request | 8.6CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114661 | OpenRemote missing authorization in Gateway Tunnel endpoints | 9.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114660 | Grav Unauthorized Page Deletion via Flex Form Directives | 7.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114659 | getgrav grav-plugin-flex-objects Grav Flex Objects authorization bypass via Pages API Routes | 7.1CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114658 | getgrav grav-plugin-login grav Login plugin privilege escalation via login.invite | 8.7CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114657 | Grav HTTP Basic credential disclosure via Twig Uri | 6.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114656 | Traefik and mTLS Bypass via Negated Host Matcher | 6.9CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114655 | KMS request injection via unsanitized key vault and provider values in libmongocrypt | 6.0CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114654 | MongoDB C Driver BSON handling library incorrect numeric conversion | 6.9CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114653 | MongoDB C# Driver CSFLE schema builder information disclosure | 7.1CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-114652 | MongoDB C Driver update operator injection via single-element list rewriting in the update builder | 7.1CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114651 | MongoDB C Driver cross-document data leak via malformed BSON array parsing in reused thread buffer | 6.3CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-114650 | MongoDB C Driver client-side encryption support information disclosure | 6.9CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-114649 | MongoDB C Driver authentication bypass | 7.6CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-114648 | MongoDB C Driver NoSQL injection | 7.2CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114647 | MongoDB C Driver NoSQL operator injection via unvalidated replacement document in findOneAndReplace | 5.3CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114646 | MongoDB C Driver NoSQL command injection | 6.9CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114645 | MongoDB C Driver heap overflow | 5.7CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-114644 | MongoDB C Driver memory-exhaustion denial of service | 8.2CNA v4.0 | 0.5% | 2026-10-22 | |
| CVE-2026-114643 | MongoDB C Driver duplicate geometry fields via unvalidated GeoJSON extra members | 5.3CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-114642 | Traefik and TLS Config Bypass via NTLM/Kerberos Round Tripper | 7.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114641 | Traefik and race condition in NTLM/Kerberos Round Tripper | 6.3CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114640 | Traefik mTLS header spoofing via Ingress-NGINX HTTP Router | 7.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114639 | Traefik and authentication bypass via Negotiate Connection Pool | 7.0CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114638 | Traefik Client CA Mix-up via auth-tls-secret Name Collision | 7.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114637 | Traefik FastProxy NTLM/Negotiate Connection Pool Identity leak | 7.0CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114636 | Traefik authentication bypass via ssl-passthrough Ingress HTTP Router | 7.0CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114635 | Traefik and SNI Check Bypass via HTTP/2 Scheme | 7.0CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114634 | WWBN AVideo blind SSRF via getHeaderContentTypeFromURL Redirect | 5.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114633 | WWBN AVideo incorrect authorization via confirmDeleteUser.json.php | 7.0CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-114625 | Arista VeloCloud Orchestrator SQL injection | 9.4CNA v4.0 | 0.6% | 2026-10-22 | KEVFix |
| CVE-2026-114620 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF | 5.4CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114619 | Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens | 4.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114618 | Authlib: Default JWT bearer grant accepts assertions for the wrong audience | 6.8CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114617 | Authlib: ID token can disable its own nonce validation via the nonce_supported claim | 4.2CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114616 | Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) | 7.4CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114615 | Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys | 7.4CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-114614 | authlib authlib.common.security.is_secure_transport protection mechanism failure | 2.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114613 | MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure | 7.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114612 | LiteLLM: Privilege escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key | 9.9CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114611 | schorschii OCO-Server Apple MDM enrollment endpoint improper certificate validation | 9.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114610 | py-pdf fpdf2 SVGObject.build_xref resource exhaustion | 6.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114609 | py-pdf fpdf2 shared image loader server-side request forgery | 5.8CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114608 | Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME | 5.4CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-114607 | better-auth improper authentication | 9.1CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114606 | jgraph drawio-desktop draw.io Desktop: Arbitrary local-file read via read-side IPC | 5.6CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-114605 | dnspython dns.name.from_wire_parser excessive CPU use | 7.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114603 | opentelemetry-python OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api | 5.3CNA v3.1 | 0.5% | 2026-10-22 | |
| CVE-2026-114583 | Python CPython tar filter allows writing outside destination via empty-named symlink | 6.9CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-114577 | oretnom23 php-travel-agency-system Insertion insert.php SQL injection | 6.9CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114576 | Linksys RE6250 Web Management strcmp random values | 6.3CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-114575 | TOTOLINK A950RG product.so UploadCustomModule command injection | 10.0CNA v4.0 | 2.2% | 2026-10-22 | |
| CVE-2026-114570 | WordPress Core authenticated (Contributor+) stored cross-site scripting via Quick Edit | 4.9CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114519 | Roskus Prospero Flow CRM user API missing authorization | 8.6CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-114515 | OCO-Server: Self-Service portal uninstall-job authorization bypass | 6.5CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114510 | stevereiner flexible-graphrag flexible GraphRAG: Cypher/Graph injection | 7.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-114487 | Devolutions Server PAM AD computer import endpoint missing authorization | – | 0.1% | 2026-10-22 | |
| CVE-2026-114486 | Devolutions Server incorrect authorization | – | 0.1% | 2026-10-22 | |
| CVE-2026-114485 | Devolutions Server information disclosure | – | 0.1% | 2026-10-22 | |
| CVE-2026-114460 | Mod_qos: Query truncation during json body merging permits security-rule bypass | 5.3CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114459 | Mod_qos: Out-of-bounds reads in response-body substring matching | 3.7CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114458 | Mod_qos: Undersized connection-monitor scratch array permits heap buffer overflow | 5.9CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114457 | Mod_qos: Missing nul termination in json value escaping permits out-of-bounds reads | 3.7CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114348 | webpack-dev-server vulnerable to information disclosure | 5.3CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114223 | NewType Infortech｜NT OneAPP exposure of sensitive information | 6.7CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-114222 | NewType Infortech｜NT OneAPP authentication bypass | 6.9CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-114221 | NewType Infortech｜NT OneAPP credential disclosure | 5.9CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114220 | NewType Infortech｜NT OneAPP improper certificate validation | 9.3CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-114219 | NewType Infortech｜NT OneAPP hard-coded credentials | 9.1CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-114195 | ShopMagic WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114184 | Elementor Addon Elements WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-114182 | PowerPack Addons for Elementor WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114180 | Metform WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-114177 | Xpro Elementor Addons WordPress plugin cross-site request forgery (CSRF) | 8.8CNA v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-114175 | eRoom WordPress plugin settings Change vulnerability | 5.4CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-113876 | SmileCDR HAPI FHIR incorrect authorization | 5.3CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-113875 | SmileCDR HAPI FHIR unauthorized read via subscription | 2.3CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-113874 | SmileCDR HAPI FHIR trusted tenant partition override | 8.6CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-113873 | SmileCDR HAPI FHIR improper data decompression | 8.7CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-113872 | multer vulnerable to denial of service via a pending asynchronous fileFilter after request teardown | 7.5CNA v3.1 | 0.4% | 2026-10-22 | Exploit code |
| CVE-2026-113582 | Apache Abdera: XML external entity expansion in Atom document parsing | 8.7CNA v4.0 | 0.5% | 2026-10-22 | Fix |
| CVE-2026-112867 | H5P WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-112845 | Off-Canvas Sidebars and Menus (Slidebars) WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-112843 | Strong Testimonials WordPress plugin broken access control | 4.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112842 | Paid Member Subscriptions WordPress plugin broken access control | 6.5CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112832 | Rootblox WordPress plugin local file inclusion | 9.8CNA v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-112826 | Falcon WordPress Optimizations and Tweaks plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112822 | Workreap Core WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-112820 | Academist Core WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-112379 | Contact Form Email WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-112332 | GDATASoftwareAG motornet Motor.NET denial of service via JsonNet deserialization | 8.7CNA v4.0 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-112331 | GDATASoftwareAG motornet Motor.NET Kafka denial of service via Structured CloudEvent Mapping | 8.7CNA v4.0 | 0.7% | 2026-10-22 | Fix |
| CVE-2026-112330 | GDATASoftwareAG motornet Motor.NET RabbitMQ denial of service via CloudEvents headers | 8.7CNA v4.0 | 0.6% | 2026-10-22 | Fix |
| CVE-2026-112327 | Amelia WordPress plugin SQL injection | 9.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112313 | ACF Extended WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112312 | ACF Extended WordPress plugin broken access control | 7.5CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112311 | ACF Extended WordPress plugin arbitrary file deletion | 6.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-112242 | Profile Builder WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112241 | SureCart WordPress plugin broken authentication | 9.8CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-112218 | Majestic Support WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-112085 | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades | 8.2CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-111972 | Photo Engine for WordPress Author+ arbitrary Attachment deletion via IDOR | 4.9CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-111971 | Photo Engine for WordPress Author+ stored XSS via Collection Name | 6.8CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-111958 | Royal MCP for WordPress authentication bypass via Preview Link Token | 7.5CISA ADP v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-111851 | Royal Elementor Addons WordPress plugin arbitrary code execution | 7.6CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-111847 | MarketKing WordPress plugin broken access control | 5.4CNA v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-111842 | Sunshine Photo Cart WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-111830 | WP Mailster WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-111594 | InterSystems IRIS for Health cleartext transmission of sensitive information | 9.2CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-111497 | Out-of-bounds write in Google Brotli Decoder | 9.2CNA v4.0 | 0.5% | 2026-10-22 | Exploit codeFix |
| CVE-2026-111181 | body-parser vulnerable to denial of service via trailing bytes after a compressed request body | 7.5CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-111100 | Kiloview E3 NDI Encoder missing authentication for critical function | 6.9CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-111079 | Goose terminal integration information disclosure | 7.4CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-110974 | Uncontrolled recursion on Nested JSON allows denial of service in android-json | 6.3CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-110894 | SureDash WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-110893 | SureDash WordPress plugin broken access control | 5.3CNA v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-110825 | Kiloview E3 NDI Encoder missing authentication for critical function | 8.7CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-110491 | Kiloview E3 NDI Encoder null pointer dereference | 6.9CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-110354 | HAProxy infinite loop | 7.5CNA v3.1 | 0.8% | 2026-10-22 | |
| CVE-2026-110353 | HAProxy unchecked return value | 7.5CNA v3.1 | 0.7% | 2026-10-22 | |
| CVE-2026-110264 | Integer overflow or wraparound in GitLab | 10.0CNA v3.1 | 0.5% | 2026-10-22 | Exploit code |
| CVE-2026-110243 | Kiloview E3 NDI Encoder OS command injection | 9.4CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-110063 | Microsoft VM Inspector for Azure Virtual Machines elevation of privilege | 10.0CNA v3.1 | 0.9% | 2026-10-22 | Fix |
| CVE-2026-110011 | MB Custom Post Types and Custom Taxonomies export feature vulnerability | 2.7CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-110010 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before allowing an unauthenticated request to re-run a legacy data migration, letting anyone revert a custom post type or taxonomy definition on sites upgraded from a p | 4.8CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-109987 | PixelYourSite (Free and Pro) unauthenticated stored XSS via Cookie | 7.2CISA ADP v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-109931 | Infility Global for WordPress unauthenticated Google Translate API Key update | 3.7CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-109927 | CM HIPAA Forms for WordPress hipaa_forms+ privilege escalation via cm_hipaa_update_user_role | 7.2CISA ADP v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-109122 | Kiloview E3 NDI Encoder OS command injection | 9.4CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-108456 | Microsoft Azure AI Foundry elevation of privilege | 7.7CNA v3.1 | 0.7% | 2026-10-22 | Fix |
| CVE-2026-108360 | PhpSpreadsheet: SSRF whitelist bypass | 6.4CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-108359 | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU and memory exhaustion (DoS) | 8.7CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-108358 | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences allows XXE and denial of service | 8.8CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-108357 | PHPOffice PhpSpreadsheet XmlScanner XML external entity injection | 8.8CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-107861 | Kiloview E3 NDI Encoder OS command injection | 9.4CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-107079 | Systrome Validation & Certification qrcode_auth.html denial of service | – | 0.2% | 2026-10-22 | Exploit code |
| CVE-2026-106017 | OpenVPN 3 Core Library improper certificate validation | 6.3CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-105270 | Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion | 8.7CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-105265 | Kiloview E3 NDI Encoder path traversal | 6.0CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-105014 | Microsoft Azure Pipelines remote code execution | 9.1CNA v3.1 | 0.7% | 2026-10-22 | Fix |
| CVE-2026-104068 | JetBackup WordPress Plugin Symlink arbitrary file write via Backup Restore | 8.6CNA v4.0 | 0.6% | 2026-10-22 | Exploit codeFix |
| CVE-2026-103634 | Apache DataSketches Count-Min sketch deserialization out-of-bounds read | – | 0.2% | 2026-10-22 | Fix |
| CVE-2026-103234 | WP Ultimate Review for WordPress unauthenticated arbitrary shortcode execution via Reviewer email | 4.8CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-102785 | Joomla extension yootheme.com unauthenticated remote code execution in YOOtheme Pro | 10.0CNA v4.0 | 0.7% | 2026-10-22 | Exploit code |
| CVE-2026-100142 | FluentCart A New Era of eCommerce information disclosure | 5.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-97785 | AAD App Proxy elevation of privilege | 10.0CNA v3.1 | 0.6% | 2026-10-22 | Fix |
| CVE-2026-97635 | Agent Zero Web UI XSS | 8.6CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-97631 | TianoCore edk2 pre-boot RCE in EDK II PXE driver | 9.5CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-97328 | WebP Express WordPress plugin unauthenticated stored XSS via Alter HTML Parser | 7.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96616 | Kiloview E3 NDI Encoder insufficient session expiration | 8.3CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-96398 | Webform Less critical Access bypass SA-CONTRIB-2026-173 | 4.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96392 | AI CKEditor Moderately critical code execution via Twig templates SA-CONTRIB-2026-187 | 3.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96391 | Webform REST Less critical Access bypass SA-CONTRIB-2026-186 | – | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96390 | Editoria11y Accessibility Checker Moderately critical Access bypass SA-CONTRIB-2026-185 | 4.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96388 | Tawk.to Live chat application Critical cross-site request forgery SA-CONTRIB-2026-184 | 5.4CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-96387 | Stop administrator login Moderately critical Access bypass SA-CONTRIB-2026-183 | 3.8CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96386 | Smart Content Moderately critical Access bypass SA-CONTRIB-2026-190 | 6.5CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-96385 | REST and JSON API Authentication for Drupal Moderately critical Access bypass SA-CONTRIB-2026-182 | 6.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96384 | Mermaid Diagram Field Moderately critical Access bypass SA-CONTRIB-2026-180 | 3.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96382 | Diba carousel slider Moderately critical cross-site scripting (XSS) SA-CONTRIB-2026-191 | 4.6CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-96380 | CSS Usage Analyzer Moderately critical improper access control SA-CONTRIB-2026-189 | 6.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96379 | CookieCuttr Moderately critical cross-site scripting SA-CONTRIB-2026-181 | – | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96378 | Commerce Decoupled Checkout Moderately critical Access bypass SA-CONTRIB-2026-179 | 4.3CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-96377 | Combined image style Moderately critical improper access control SA-CONTRIB-2026-188 | 5.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96376 | Drupal Cloud Cloud Critical remote code execution SA-CONTRIB-2026-177 | 6.4CISA ADP v3.1 | 0.6% | 2026-10-22 | Fix |
| CVE-2026-96375 | Drupal Cloud Cloud Critical remote code execution SA-CONTRIB-2026-176 | 4.8CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-96374 | Project Browser Critical cross-site request forgery SA-CONTRIB-2026-178 | 4.2CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-96373 | Webform Moderately critical Access bypass SA-CONTRIB-2026-168 | 3.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96372 | Webform Moderately critical Access bypass SA-CONTRIB-2026-167 | 5.4CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-96371 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-166 | 5.4CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96370 | Webform Moderately critical Access bypass, server-side request forgery SA-CONTRIB-2026-164 | 5.4CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-96369 | Webform Less critical Access bypass SA-CONTRIB-2026-165 | 3.1CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96368 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-163 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96367 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-162 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96366 | Webform Moderately critical Access bypass SA-CONTRIB-2026-169 | 5.3CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-96365 | Webform Less critical denial of service SA-CONTRIB-2026-170 | 7.5CISA ADP v3.1 | 0.5% | 2026-10-22 | Fix |
| CVE-2026-96364 | Webform Moderately critical Access bypass SA-CONTRIB-2026-171 | 5.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96363 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-161 | – | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96362 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-160 | 4.2CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96361 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-155 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96360 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-154 | 3.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96359 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-159 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96358 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-158 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96357 | Webform Moderately critical cross-site scripting SA-CONTRIB-2026-172 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-96356 | Webform Moderately critical Access bypass SA-CONTRIB-2026-174 | 5.3CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-96355 | Webform Critical remote code execution SA-CONTRIB-2026-175 | 9.1CISA ADP v3.1 | 0.4% | 2026-10-22 | Fix |
| CVE-2026-96293 | WatchGuard Agent endpoint security cleartext storage of FileVault Recovery Key in Log file | 6.9CNA v4.0 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-96185 | Microsoft Exchange Online remote code execution | 7.5CNA v3.1 | 0.5% | 2026-10-22 | Fix |
| CVE-2026-95721 | No description provided | 3.3CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-95720 | HPE ArubaOS authenticated local buffer overflow vulnerability leads to denial of service in AOS-8 | 4.4CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-95719 | HPE ArubaOS authenticated arbitrary file deletion vulnerability leads to denial of service in AOS-10 | 4.9CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-95718 | HPE ArubaOS (AOS) authentication bypass vulnerability in the PAPI protocol of AOS-8 | 5.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95717 | Authenticated stored cross-site scripting (XSS) vulnerability in AOS Web-Based Management interface | 5.5CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95716 | No description provided | 6.5CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95715 | HPE ArubaOS unauthenticated local command injection vulnerability in AOS-10 Command Line interface | 6.8CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95714 | HPE ArubaOS (AOS) API of AOS-10 buffer overflow | 6.8CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95713 | No description provided | 7.0CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95712 | HPE ArubaOS unauthenticated Adjacent sensitive information disclosure and denial of service in AOS-8 | 7.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95711 | HPE ArubaOS (AOS) web-based management interface of AOS-10 authentication bypass | 7.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95710 | No description provided | 7.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-95709 | HPE ArubaOS (AOS) authenticated command injection vulnerabilities in AOS-10 | 7.2CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-95708 | HPE ArubaOS (AOS) Authenticated File Write leads to command injection vulnerabilities in AOS-10 | 7.2CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-95707 | HPE ArubaOS authenticated buffer overflow vulnerability leads to remote code execution in AOS-8 | 7.2CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-95706 | HPE ArubaOS (AOS) authenticated command injection vulnerabilities in AOS-8 | 7.2CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-95705 | HPE ArubaOS (AOS) authenticated command injection vulnerabilities in AOS-8 | 7.2CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-95704 | HPE ArubaOS (AOS) arbitrary command execution | 7.2CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-94502 | Silicon Labs EmberZNet out-of-bounds write in Zigbee Publish Price Matrix handling | 7.5CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-94482 | Next.js: Denial of service in App Router using Server Actions | 8.2CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-93471 | Unbounded SAML message decompression in esaml allows memory exhaustion | 8.7CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-93336 | Missing authorization in the unit resources download route in Juju controllers | 7.1CNA v4.0 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-92709 | Rsyslog: DynFile path traversal → arbitrary file write as Root → RCE | 8.1CNA v3.1 | 0.5% | 2026-10-22 | |
| CVE-2026-92450 | Kiloview E3 NDI Encoder use of hard-coded credentials | 8.7CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-89410 | Out-of-bounds read in Z-Wave NCP SPI handler | 5.1CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-89409 | Silicon Labs Z-Wave SDK Unvalidated ZWAVE_CMD_NODES_EXIST may cause Deletion of End Nodes | 5.3CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-88849 | MasterStudy LMS - Instructor+ arbitrary User Display Name Update via Student Enrollment | 2.7CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87955 | Ultimate Table Field Critical Access bypass SA-CONTRIB-2026-153 | 4.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87954 | Taxonomy Term Glossary Critical Access bypass SA-CONTRIB-2026-152 | 4.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87953 | SAML SSO Service Provider Moderately critical server side request forgery SA-CONTRIB-2026-151 | 3.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87952 | SAML SSO Service Provider Moderately critical Insufficient replay protection SA-CONTRIB-2026-150 | 3.1CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87951 | SAML SSO Service Provider Moderately critical information disclosure SA-CONTRIB-2026-149 | 3.8CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87950 | SAML SSO Service Provider Moderately critical Embedded credentials SA-CONTRIB-2026-148 | 5.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87949 | SAML SSO Service Provider Moderately critical cross-site scripting SA-CONTRIB-2026-147 | 3.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87948 | SAML SSO Service Provider Moderately critical cross-site scripting SA-CONTRIB-2026-146 | 3.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87947 | SAML SSO Service Provider Moderately critical authentication bypass SA-CONTRIB-2026-145 | 4.8CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-87946 | SAML SSO Service Provider Critical weak cryptographic practices SA-CONTRIB-2026-144 | 4.8CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87945 | SAML SSO Service Provider Critical open redirect SA-CONTRIB-2026-143 | 5.4CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87944 | SAML SSO Service Provider Critical improper certificate validation SA-CONTRIB-2026-142 | 4.8CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-87943 | SAML SSO Service Provider Critical improper access control SA-CONTRIB-2026-141 | 6.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87942 | SafeDelete Moderately critical cross-site scripting SA-CONTRIB-2026-140 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87941 | Patreon Critical Unsupported SA-CONTRIB-2026-139 | – | 0.2% | 2026-10-22 | |
| CVE-2026-87940 | Key auth Moderately critical Access bypass SA-CONTRIB-2026-138 | 5.4CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87939 | Feed Block Moderately critical cross-site scripting SA-CONTRIB-2026-137 | 4.2CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87938 | CSP log Critical SQL injection SA-CONTRIB-2026-136 | – | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87937 | Central Authentication System (CAS) Server Moderately critical open redirect SA-CONTRIB-2026-135 | 6.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-87936 | amazee.ai Private AI Provider Critical SQL injection SA-CONTRIB-2026-134 | 6.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-86696 | dropbox esaml resource exhaustion | 8.2CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-85080 | Silicon Labs EmberZNet authenticated denial of service in Zigbee GetGroupMembership Handling | 6.0CNA v4.0 | 0.4% | 2026-10-22 | |
| CVE-2026-85079 | Silicon Labs EmberZNet out-of-bounds write in Zigbee Simple_Desc_req handling | 7.5CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-84924 | Drupal Email Verification / SMS Verification / OTP Verification cross-site scripting | 5.4CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84923 | Email Verification / SMS Verification / OTP Verification Critical Access Bypass SA-CONTRIB-2026-124 | 6.5CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-84921 | Webform Submissions Delete Moderately critical Access bypass SA-CONTRIB-2026-133 | 5.3CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-84920 | Unpublished Node Permissions Critical Access bypass SA-CONTRIB-2026-132 | 5.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84919 | Drupal PhotoSwipe stored cross-site scripting | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84918 | Monobank payment API Moderately critical Access bypass SA-CONTRIB-2026-130 | 3.7CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-84917 | Jsonapi Role Access Critical Access bypass SA-CONTRIB-2026-127 | 6.5CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84916 | Islandora Moderately critical Access bypass SA-CONTRIB-2026-126 | 3.7CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84915 | Component blocks Moderately critical cross-site scripting SA-CONTRIB-2026-123 | 4.6CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84914 | Calculate Working Days Critical Access bypass SA-CONTRIB-2026-122 | 5.3CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84913 | AI translate Moderately critical Access Bypass SA-CONTRIB-2026-121 | 4.6CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-84912 | AI (Artificial Intelligence) Moderately critical Access Bypass SA-CONTRIB-2026-120 | 4.6CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-84911 | AI (Artificial Intelligence) Moderately critical cross-site scripting SA-CONTRIB-2026-119 | 3.1CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-84910 | Advanced Search Moderately critical Access bypass SA-CONTRIB-2026-118 | 4.2CISA ADP v3.1 | 0.1% | 2026-10-22 | Fix |
| CVE-2026-83938 | Microsoft Azure Kubernetes Configuration Service elevation of privilege | 10.0CNA v3.1 | 0.7% | 2026-10-22 | Fix |
| CVE-2026-81163 | Media Library Importer Moderately critical Access bypass SA-CONTRIB-2026-129 | 5.4CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-79956 | HPE ArubaOS (AOS) improper sanitization leads to command injection in AOS-8 Web interface | 7.2CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79955 | HPE ArubaOS unauthenticated memory corruption vulnerability leads to denial of service in AOS-8 | 7.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79895 | HPE ArubaOS (AOS) unauthenticated remote denial of service (DoS) vulnerabilities in AOS-10 | 7.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79894 | HPE ArubaOS unauthenticated denial of service vulnerability in the PAPI protocol of AOS-8 | 7.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79893 | HPE ArubaOS unauthenticated memory corruption vulnerabilities lead to denial of service in AOS-10 | 7.5CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79892 | HPE ArubaOS (AOS) AOS-8 memory corruption | 7.8CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-79891 | HPE ArubaOS unauthenticated buffer overflow vulnerability leads to remote code execution in AOS-8 | 8.1CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79890 | HPE ArubaOS unauthenticated command injection vulnerabilities in AOS-8 Accessed by the PAPI protocol | 8.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79889 | HPE ArubaOS (AOS) buffer overflow | 8.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79888 | HPE ArubaOS (AOS) unauthenticated buffer overflow allows remote code execution in web interface | 8.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79887 | HPE ArubaOS authentication bypass in Web interface of AOS-8 allows remote command execution | 8.1CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79886 | HPE ArubaOS (AOS) unauthenticated buffer overflow vulnerability leads to denial of service in AOS-8 | 8.2CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79885 | HPE ArubaOS (AOS) Unauthenticated File Write vulnerability leads to denial of service in AOS-8 | 8.2CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79884 | HPE ArubaOS (AOS) authentication bypass leads to sensitive information disclosure in AOS-8 | 8.2CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79883 | HPE ArubaOS (AOS) PAPI protocol buffer overflow | 8.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79882 | HPE ArubaOS unauthenticated Adjacent command injection vulnerability in the PAPI protocol of AOS-10 | 8.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79881 | HPE ArubaOS (AOS) authentication bypass leading to remote code execution in AOS-8 | 8.5CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79880 | HPE ArubaOS (AOS) authenticated server-side request forgery leads to remote code execution in AOS-8 | 8.7CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79879 | HPE ArubaOS (AOS) affected interface of AOS-10 memory corruption | 8.8CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79878 | HPE ArubaOS (AOS) command injection | 8.8CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79877 | HPE ArubaOS (AOS) unauthenticated Adjacent remote code execution vulnerability in AOS-10 | 8.8CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79876 | HPE ArubaOS (AOS) Wi-Fi frame processing of AOS-10 information disclosure | 9.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79875 | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access | 9.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79874 | HPE ArubaOS (AOS) authentication bypass in the API allows Administrative Access of AOS-10 | 9.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79873 | HPE ArubaOS (AOS) PAPI protocol of AOS-10 authentication bypass | 9.3CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79872 | HPE ArubaOS (AOS) underlying operating system of AOS buffer overflow | 9.4CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-79871 | HPE ArubaOS unauthenticated sensitive information disclosure in the Command Line interface of AOS-10 | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79870 | HPE ArubaOS (AOS) authentication bypass leads to unauthorized access in AOS-8 | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79869 | HPE ArubaOS (AOS) authentication bypass leading to remote code execution in AOS-10 | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79868 | HPE ArubaOS (AOS) authentication bypass vulnerabilities lead to Complete System Compromise in AOS-8 | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79867 | HPE ArubaOS (AOS) authentication bypass leading to remote code execution in AOS-8 | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79866 | HPE ArubaOS (AOS) PAPI protocol in AOS-8 path traversal | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79865 | HPE ArubaOS (AOS) affected interface of AOS-10 memory corruption | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79864 | HPE ArubaOS (AOS) unauthenticated Adjacent command injection vulnerability in AOS-10 | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79863 | HPE ArubaOS unauthenticated Adjacent buffer overflow vulnerabilities lead to remote code execution | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79862 | HPE ArubaOS unauthenticated Adjacent buffer overflow vulnerabilities lead to remote code execution | 9.6CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-79861 | HPE ArubaOS (AOS) unauthenticated command injection vulnerability in the PAPI protocol of AOS-10 | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79860 | HPE ArubaOS unauthenticated buffer overflow vulnerabilities lead to remote code execution in AOS-8 | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79859 | HPE ArubaOS unauthenticated buffer overflow vulnerabilities lead to remote code execution in AOS-8 | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79858 | HPE ArubaOS (AOS) unauthenticated SQL injection vulnerability in the PAPI protocol of AOS-8 | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79857 | HPE ArubaOS (AOS) unauthenticated command injection vulnerability in AOS-8 PAPI protocol | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79856 | HPE ArubaOS unauthenticated buffer overflow vulnerability leads to authentication bypass in AOS-8 | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79855 | HPE ArubaOS authentication bypass in the SSH daemon of AOS-8 leads to Complete System Compromise | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79854 | HPE ArubaOS unauthenticated SQL injection vulnerability leads to remote code execution in AOS-10 | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79853 | HPE ArubaOS (AOS) affected interface of AOS-10 information disclosure | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79852 | Unauthenticated SQL injection allows remote code execution in AOS Web-Based Management interface | 9.8CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79851 | HPE ArubaOS unauthenticated buffer overflow vulnerability leads to remote code execution in AOS-10 | 10.0CNA v3.1 | 0.5% | 2026-10-22 | |
| CVE-2026-79850 | HPE ArubaOS (AOS) authentication bypass leading to remote code execution in AOS-8 | 10.0CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-79849 | HPE ArubaOS (AOS) unauthenticated SQL injection vulnerabilities allow remote code execution in AOS-8 | 10.0CNA v3.1 | 0.5% | 2026-10-22 | |
| CVE-2026-79848 | HPE ArubaOS (AOS) unauthenticated SQL injection vulnerabilities allow remote code execution in AOS-8 | 10.0CNA v3.1 | 0.5% | 2026-10-22 | |
| CVE-2026-79847 | HPE ArubaOS unauthenticated buffer overflow vulnerabilities leads to remote code execution in AOS-10 | 10.0CNA v3.1 | 0.5% | 2026-10-22 | |
| CVE-2026-79846 | HPE ArubaOS (AOS) unauthenticated command injection vulnerabilities in AOS-8 | 10.0CNA v3.1 | 0.5% | 2026-10-22 | |
| CVE-2026-79844 | HPE ArubaOS (AOS) authentication bypass leading to remote code execution in AOS-10 | 10.0CNA v3.1 | 0.4% | 2026-10-22 | |
| CVE-2026-78846 | AiDot Linkind Matter Smart Plug SSDP local header parsing buffer overflow | – | 0.2% | 2026-10-22 | |
| CVE-2026-78801 | SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router information disclosure | – | 0.3% | 2026-10-22 | |
| CVE-2026-78392 | Link Library WordPress plugin Contributor+ stored XSS via link_target parameter | 6.8CISA ADP v3.1 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-77157 | Ast-cli: Auto-update downloads are not verified against a checksum before execution | 6.3CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-77156 | Ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory | 6.3CNA v4.0 | 0.3% | 2026-10-22 | Fix |
| CVE-2026-75508 | GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit | 7.5CNA v3.1 | 0.6% | 2026-10-22 | |
| CVE-2026-75507 | GraphQL-core: Denial of service | 7.5CNA v3.1 | 0.6% | 2026-10-22 | |
| CVE-2026-66282 | Silicon Labs EmberZNet authenticated denial of service in Zigbee Publish Billing Period | 6.0CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-66281 | Silicon Labs EmberZNet authenticated denial of service in Zigbee Discover Attributes Handling | 6.0CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-66279 | Silicon Labs Connect SDK Connect Stack improper verification of communication source | 7.2CNA v4.0 | 0.2% | 2026-10-22 | |
| CVE-2026-61791 | OCO-Server: Stored XSS through agent hostnames in command buttons | 7.4CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-54532 | CloudPirates Open Source Helm Charts pull_request_target workflow cache poisoning | 6.9CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-54238 | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorization | 3.1CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-51954 | Webasyst Framework remote code execution | – | 0.5% | 2026-10-22 | Exploit code |
| CVE-2026-21812 | Multiple security vulnerabilities affect HCL AppScan Azure Boards plugin ( and) | 2.2CNA v3.1 | 0.1% | 2026-10-22 | |
| CVE-2026-21811 | Multiple security vulnerabilities affect HCL AppScan Azure Boards plugin ( and) | 3.8CNA v3.1 | 0.2% | 2026-10-22 | |
| CVE-2026-16648 | Mailer Plus Log Moderately critical Access bypass SA-CONTRIB-2026-128 | 3.8CISA ADP v3.1 | 0.2% | 2026-10-22 | Fix |
| CVE-2026-16477 | Insecure deserialization of .cleanshot files in CleanShot X | 8.4CNA v4.0 | 0.3% | 2026-10-22 | |
| CVE-2026-13599 | ABB Ability Edgenius missing authentication in Edgenius AuthDB | 5.8CNA v4.0 | 0.1% | 2026-10-22 | |
| CVE-2026-13411 | Mattermost null condition in Playbooks import crashes the plugin | 4.3CNA v3.1 | 0.3% | 2026-10-22 | |
| CVE-2026-114574 | massCodeIO massCode Local HTTP service index.ts information disclosure | 5.3CNA v4.0 | 0.3% | 2026-10-21 | |
| CVE-2026-114509 | Laravel TokenGuard authentication bypass through non-string API credentials | 9.2CNA v4.0 | 0.4% | 2026-10-21 | Exploit codeFix |
| CVE-2026-114508 | Laravel relationship inclusion can trigger unauthorized data destruction | 6.5CNA v3.1 | 0.3% | 2026-10-21 | Fix |
| CVE-2026-114501 | Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT | 6.3CNA v4.0 | 0.4% | 2026-10-21 | Fix |
| CVE-2026-114493 | LocalAI SSRF Guard Bypass via HTTP Redirects | 9.2CNA v4.0 | 0.4% | 2026-10-21 | |
| CVE-2026-114492 | gin-vue-admin path traversal via removePlugin endpoint | 7.0CNA v4.0 | 0.4% | 2026-10-21 | Fix |
| CVE-2026-114491 | pdfmake Local File Policy Bypass via SVG Images | 6.9CNA v4.0 | 0.3% | 2026-10-21 | Fix |
| CVE-2026-114490 | Incorrect authorization in hMailServer | 7.8CNA v3.1 | 0.1% | 2026-10-21 | |
| CVE-2026-114489 | Missing authorization in hMailServer | 8.1CNA v3.1 | 0.3% | 2026-10-21 | |
| CVE-2026-114479 | Not failing securely (Failing Open) in hMailServer | 5.8CNA v3.1 | 0.3% | 2026-10-21 | |
| CVE-2026-114478 | Unintended proxy or intermediary (confused deputy) in hMailServer | 5.9CNA v3.1 | 0.3% | 2026-10-21 | |
| CVE-2026-114477 | Missing authorization in hMailServer | 4.3CNA v3.1 | 0.2% | 2026-10-21 | |
| CVE-2026-114476 | Incorrect authorization in hMailServer | 7.5CNA v3.1 | 0.3% | 2026-10-21 |