CVE-2026 list

CVE-2026 records published in October 2026

Page 13 of 14: records 12,001 to 13,000 of the 13,324 published in October 2026, newest first. The first page carries the figures for October 2026.

CVE-2026 records published in October 2026, newest first: records 12,001 to 13,000 of 13,324
CVE Summary CVSS EPSS Published Signals
CVE-2026-105686Penpot: Repeated chunk index causes temporary-storage amplification5.3CNA v4.00.3%2026-10-05Fix
CVE-2026-105684penpot comment RPCs information disclosure4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-105683Ghost: Path traversal vulnerability in Ghost ImageSize service3.8CNA v3.10.3%2026-10-05Fix
CVE-2026-105682Ghost: Server-side request forgery in Webhook Trigger2.7CNA v3.10.2%2026-10-05Fix
CVE-2026-105681Ghost: Authorization bypass in Comments feature6.5CNA v3.10.3%2026-10-05Fix
CVE-2026-105680Ghost: Authorization issue Allowed Author Role to Delete any Post6.5CNA v3.10.3%2026-10-05Fix
CVE-2026-105679Ghost: Stored XSS via File Uploads on Local Storage7.3CNA v3.10.2%2026-10-05Fix
CVE-2026-105678Ghost: Editors could Promote Staff Users to their Own Role4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-105677Ghost: Remote code execution via Theme Translation files7.2CNA v3.10.5%2026-10-05Fix
CVE-2026-105676Ghost: Path traversal via Locale setting4.9CNA v3.10.4%2026-10-05Fix
CVE-2026-105675Ghost: Invite token disclosure in Ghost Admin API7.5CNA v3.10.4%2026-10-05Fix
CVE-2026-105652Ghost: Password Hash Ordering Disclosure in Ghost Admin API3.1CNA v3.10.3%2026-10-05Fix
CVE-2026-105651Ghost: Stored XSS via Bookmark Card Images7.3CNA v3.10.3%2026-10-05Fix
CVE-2026-105650Ghost: Stored XSS via oEmbed Photo Responses8.1CNA v3.10.3%2026-10-05Fix
CVE-2026-105649Ghost: Stored XSS via SVG Uploads Bypassing Sanitization7.3CNA v3.10.3%2026-10-05Fix
CVE-2026-105648Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses4.0CNA v3.10.3%2026-10-05Fix
CVE-2026-105647Ghost: Server-side request forgery in Bookmark Fetching4.0CNA v3.10.2%2026-10-05Fix
CVE-2026-105646Ghost: Regular expression denial of service in Content Import4.9CNA v3.10.3%2026-10-05Fix
CVE-2026-105645Ghost: Regular expression denial of service in External Media Inliner4.9CNA v3.10.3%2026-10-05Fix
CVE-2026-105644Ghost: Stored XSS via SVG files in Content Imports6.8CNA v3.10.3%2026-10-05Fix
CVE-2026-105643Ghost: Stored XSS via Embed Card Previews7.3CNA v3.10.3%2026-10-05Fix
CVE-2026-105642Ghost: Remote code execution via Bookmark Card Images8.8CNA v3.10.3%2026-10-05Fix
CVE-2026-105641makeplane plane community deployment manifests hard-coded credentials9.8CNA v3.10.5%2026-10-05Fix
CVE-2026-105640Plane: Account takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)9.1CNA v3.10.4%2026-10-05Fix
CVE-2026-105639makeplane plane signup flow information disclosure9.8CNA v3.10.4%2026-10-05Fix
CVE-2026-105638Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force9.1CNA v3.10.4%2026-10-05Fix
CVE-2026-105637Plane: Cross-Project Asset Hijacking via ProjectBulkAssetEndpoint (sibling of)9.6CNA v3.10.3%2026-10-05Fix
CVE-2026-105636Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)9.9CNA v3.10.4%2026-10-05Fix
CVE-2026-105635makeplane plane ProjectJoinEndpoint information disclosure7.4CNA v3.10.4%2026-10-05Fix
CVE-2026-105634Plane: Privilege escalation: Project Guest can Demote Admin/Member Roles8.1CNA v3.10.3%2026-10-05Fix
CVE-2026-105633Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope7.1CNA v3.10.3%2026-10-05Fix
CVE-2026-105632Plane: Broken access control joinProject GraphQL mutation allows self-join into private projects8.7CNA v4.00.3%2026-10-05Fix
CVE-2026-105631makeplane plane asset download endpoints vulnerability7.5CNA v3.10.2%2026-10-05Fix
CVE-2026-105630Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)8.7CNA v3.10.2%2026-10-05Fix
CVE-2026-105629Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup7.1CNA v3.10.2%2026-10-05Fix
CVE-2026-105628Plane: OAuth Avatar Redirect SSRF leads to Internal Data Exfiltration via Static Asset endpoint7.6CNA v3.10.3%2026-10-05Fix
CVE-2026-105471girishsaraf Online-Appointment-Booking-System Registration signup.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105470girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105469girishsaraf Online-Appointment-Booking-System AJAX endpoint get_town.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105468girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105447Quay: Quay: Global read-only superuser can access build trigger write credentials5.5CNA v3.10.2%2026-10-05
CVE-2026-105444dotnet eShop Ordering API OrdersApi.cs GetOrderAsync resource injection5.3CNA v4.00.2%2026-10-05
CVE-2026-105438O2OA General URL ActionUploadExcelWithUrl server-side request forgery5.3CNA v4.00.2%2026-10-05
CVE-2026-105421Kit (formerly ConvertKit) for WooCommerce WordPress plugin broken access control5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-105397LearnPress WordPress plugin stored XSS via Quiz Question Hint and Explanation5.1CNA v4.00.2%2026-10-05Fix
CVE-2026-105396Heym HITL Review token leak via Spoofable Origin header5.3CNA v4.00.1%2026-10-05Fix
CVE-2026-105392Lybbn Django-Vue-Lyadmin JWT Signing settings.py hard-coded key6.9CNA v4.00.3%2026-10-05
CVE-2026-105389feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload5.3CNA v4.00.2%2026-10-05
CVE-2026-105388feelec-yishu feelcrm-os Member Endpoint MemberController.class.php index SQL injection5.3CNA v4.00.3%2026-10-05
CVE-2026-105387girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105386onetwothreeneth HospitalManagementSystem print.php get SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105385onetwothreeneth HospitalManagementSystem transaction_details.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105384UNION HospitalManagementSystem patient_info.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105383onetwothreeneth HospitalManagementSystem controller.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105382onetwothreeneth HospitalManagementSystem improper authorization6.9CNA v4.00.3%2026-10-05
CVE-2026-105329TallCMS PluginManager ThemeManager.php code injection5.3CNA v4.00.4%2026-10-05
CVE-2026-105326Red Hat Hardened Images cups: Cups: Argument injection in mailto notifier via notify-recipient-uri2.5CNA v3.10.2%2026-10-05Fix
CVE-2026-105315django-haystack more_like_this Template Tag elasticsearch_backend.py _to_python eval injection5.1CNA v4.00.3%2026-10-05Fix
CVE-2026-105314Papermerge path traversal7.5CNA v3.10.9%2026-10-05
CVE-2026-105307Casdoor API endpoint authz_filter.go ApiFilter missing authentication6.9CNA v4.00.4%2026-10-05
CVE-2026-105306Red Hat Keycloak Dynamic Client Registration missing authorization6.5CNA v3.10.2%2026-10-05
CVE-2026-105302Red Hat Keycloak User Session Note mapper information disclosure5.7CNA v3.10.2%2026-10-05
CVE-2026-105301A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate tha4.0CNA v3.10.1%2026-10-05
CVE-2026-105295GitAhead Unverified Update Installation and TLS Bypass7.7CNA v4.00.1%2026-10-05
CVE-2026-105294Legcord Chromium Switch injection via settings.setConfig9.1CNA v4.00.2%2026-10-05
CVE-2026-105293Legcord path traversal via Theme IPC Handlers9.2CNA v4.00.4%2026-10-05
CVE-2026-105292Chaterm Login CSRF via Chaterm:// OAuth Callback6.0CNA v4.00.2%2026-10-05Fix
CVE-2026-105291feelec-yishu feelcrm-os Department Search Endpoint cross-site scripting5.3CNA v4.00.4%2026-10-05
CVE-2026-105290feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery6.9CNA v4.00.5%2026-10-05
CVE-2026-105289feelec-yishu feelcrm-os Create Customer Endpoint cross-site scripting5.1CNA v4.00.3%2026-10-05
CVE-2026-105288feelec-yishu feelcrm-os Crm endpoint functions.php index cross-site scripting5.3CNA v4.00.4%2026-10-05
CVE-2026-105287feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php SQL injection5.3CNA v4.00.3%2026-10-05
CVE-2026-105286Totolink A3002MU file upload formUploadFile sub_44B250 path traversal5.3CNA v4.00.4%2026-10-05
CVE-2026-105285Totolink A3002MU QoS Rule formIpQoS stack-based overflow10.0CNA v4.00.6%2026-10-05
CVE-2026-105284Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization10.0CNA v4.00.8%2026-10-05
CVE-2026-105263Shaarli Admin Metadata Endpoint server-side request forgery5.1CNA v4.00.2%2026-10-05Fix
CVE-2026-105254itsourcecode Online Admission System schoolyear.php SQL injection5.3CNA v4.00.2%2026-10-05
CVE-2026-105253itsourcecode Online Admission System Project login1.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105251vgmstream VAG file psx_decoder.c ps_find_padding out-of-bounds5.3CNA v4.00.2%2026-10-05
CVE-2026-105250vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zero5.3CNA v4.00.3%2026-10-05
CVE-2026-105249vgmstream TXTP file txtp_process.c make_group_random use-after-free2.4CNA v4.00.1%2026-10-05
CVE-2026-105248vgmstream TXTP file txtp_parser.c txtp_parse out-of-bounds write5.3CNA v4.00.2%2026-10-05
CVE-2026-105247SourceCodester Online Reviewer Management System btn_functions.php course SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105246SourceCodester Online Reviewer Management System btn_functions.php update SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105245sgl-project sglang HTTP endpoint http_server.py server_info cleartext transmission6.3CNA v4.00.2%2026-10-05Fix
CVE-2026-105238ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery6.9CNA v4.00.4%2026-10-05
CVE-2026-105237linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication6.3CNA v4.00.4%2026-10-05
CVE-2026-105233kishor-23 food-waste-management-system Login Flow login.php session fixiation5.3CNA v4.00.2%2026-10-05
CVE-2026-105232kishor-23 food-waste-management-system Registration deliverysignup.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105231kishor-23 food-waste-management-system Admin Registration signup.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105230kishor-23 food-waste-management-system deliverymyord.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105229kishor-23 food-waste-management-system User Registration endpoint signup.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105226osCommerce osCommerce2 Newsletter Management newsletters.php include code injection5.1CNA v4.00.2%2026-10-05
CVE-2026-105225osCommerce osCommerce2 Payment payment.php include code injection4.8CNA v4.00.2%2026-10-05
CVE-2026-105223maclof kubernetes-client Disabled TLS Certificate Verification9.1CNA v4.00.2%2026-10-05Fix
CVE-2026-105188code-projects Human Resource Management System cross-site scripting5.1CNA v4.00.2%2026-10-05
CVE-2026-105187itsourcecode Online Admission System key.php SQL injection5.3CNA v4.00.2%2026-10-05
CVE-2026-105186itsourcecode Online Admission System new.php SQL injection5.3CNA v4.00.2%2026-10-05
CVE-2026-105185itsourcecode Online Admission System examinee.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105184itsourcecode Online Admission System creteria.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105183itsourcecode Online Admission System confirm.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105182SourceCodester Online Reviewer Management System btn_functions.php update SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105181itsourcecode Online Admission System register1.php SQL injection5.3CNA v4.00.2%2026-10-05
CVE-2026-105180Jeebase UserService info updateUser dynamically-determined object attributes5.3CNA v4.00.3%2026-10-05
CVE-2026-105179SourceCodester Drug Recommendation System Password add_user.php missing encryption5.1CNA v4.00.2%2026-10-05
CVE-2026-105178SourceCodester Drug Recommendation System Symptom Creation add_symptom.php SQL injection5.1CNA v4.00.3%2026-10-05
CVE-2026-105177SourceCodester Drug Recommendation System Drug Creation add_drug.php SQL injection5.1CNA v4.00.3%2026-10-05
CVE-2026-105176SourceCodester Drug Recommendation System edit_class.php SQL injection5.1CNA v4.00.3%2026-10-05
CVE-2026-105175SourceCodester Drug Recommendation System Student Registration add_student.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105174Gerapy Project Management views.py project_create path traversal5.3CNA v4.00.3%2026-10-05
CVE-2026-105173code-projects Human Resource Management Event Creation EventStore.php cross-site scripting5.1CNA v4.00.2%2026-10-05
CVE-2026-105172itsourcecode Online Admission System login1.php SQL injection6.9CNA v4.00.3%2026-10-05
CVE-2026-105073WP Event Solution WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-105069QR Redirector WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-05Fix
CVE-2026-105068Events Manager WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-105064Unlimited Elements For Elementor WordPress plugin broken access control6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-105062WP Admin Audit WordPress plugin broken access control4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-105060Logo Showcase WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-05Fix
CVE-2026-105056eCommerce Product Catalog WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-05Fix
CVE-2026-105055WP Mailster WordPress plugin broken access control5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-104979Plane: Cross-tenant stored XSS in intake enables account takeover8.7CNA v3.10.4%2026-10-05Fix
CVE-2026-104978Plane: Invitation Hijack in Project Join Flow via missing authorization and Email-Only Acceptance8.2CNA v3.10.3%2026-10-05Fix
CVE-2026-104977Plane: Incomplete fix of SSRF still reachable on: Missing is_blocked_ip + DNS-rebinding TOCTOU7.7CNA v3.10.3%2026-10-05Fix
CVE-2026-104976Plane: SSRF in Gitea OAuth8.7CNA v4.00.2%2026-10-05Fix
CVE-2026-104975Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints7.1CNA v3.10.3%2026-10-05Fix
CVE-2026-104974Plane: Disabled User Auto-Reactivation on Login8.1CNA v3.10.5%2026-10-05Fix
CVE-2026-104973Plane: DNS Rebinding Bypass of SSRF Fix in Webhook Delivery7.6CNA v3.10.3%2026-10-05Fix
CVE-2026-104971makeplane plane asset endpoints insecure direct object reference8.5CNA v3.10.3%2026-10-05Fix
CVE-2026-104970makeplane plane InstanceAdminSignUpEndpoint race condition8.1CNA v3.10.3%2026-10-05Fix
CVE-2026-104969Plane: Cross-Tenant Cycle issue Hijack via IDOR6.5CNA v3.10.3%2026-10-05Fix
CVE-2026-104968makeplane plane SearchEndpoint missing authorization8.7CNA v4.00.3%2026-10-05Fix
CVE-2026-104967makeplane plane BulkDeleteIssuesEndpoint and SubIssuesEndpoint insecure direct object reference5.4CNA v3.10.2%2026-10-05Fix
CVE-2026-104966makeplane plane estimate and comment endpoints insecure direct object reference8.7CNA v4.00.2%2026-10-05Fix
CVE-2026-104965Plane: Cross-Tenant issue Relation Creation via IDOR5.4CNA v3.10.2%2026-10-05Fix
CVE-2026-104964Plane: Cross-Workspace Project Modification via Unscoped Project Lookup6.8CNA v3.10.3%2026-10-05Fix
CVE-2026-104963makeplane plane Workspace cycle and module endpoints information disclosure4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-104962Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint6.5CNA v3.10.3%2026-10-05Fix
CVE-2026-104961makeplane plane WorkspaceOwnerPermission incorrect authorization5.4CNA v3.10.2%2026-10-05Fix
CVE-2026-104960makeplane plane asset download endpoint authorization bypass6.5CNA v3.10.3%2026-10-05Fix
CVE-2026-104956Plane: Unauthenticated ORM field-name injection5.3CNA v3.10.4%2026-10-05Fix
CVE-2026-104955makeplane plane project-member update endpoint privilege escalation5.4CNA v3.10.2%2026-10-05Fix
CVE-2026-104905FacturaScripts PHP object injection via WidgetSelect6.1CNA v4.00.5%2026-10-05Exploit codeFix
CVE-2026-104894Plane: Cross-Tenant module issue Linking via IDOR4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-104893Plane: Improper validation allows arbitrary modification of API token rate limits5.4CNA v3.10.3%2026-10-05Fix
CVE-2026-104892Plane: Plaintext logging of API token8.7CNA v4.00.2%2026-10-05Fix
CVE-2026-104891douglasborthwick-crypto mppx-condition-gate authentication bypass by spoofing7.5CNA v3.10.3%2026-10-05Fix
CVE-2026-104890Kunstmaan CMS MediaBundle extension vulnerability7.2CNA v3.10.4%2026-10-05Fix
CVE-2026-104852ardatan graphql-tools mergeDeep function prototype pollution8.2CNA v4.00.4%2026-10-05Fix
CVE-2026-104811Mitel MiVoice Office 400 Music on Hold WAV file upload code execution8.4CNA v4.00.2%2026-10-05
CVE-2026-104810Mitel MiVoice Office 400 File Management File Browser path traversal8.4CNA v4.00.4%2026-10-05
CVE-2026-104809Mitel MiVoice Office 400 Shared Object Hijacking leading to arbitrary code execution8.4CNA v4.00.1%2026-10-05
CVE-2026-104808Mitel MiVoice Office 400 stored cross-site scripting1.9CNA v4.00.2%2026-10-05
CVE-2026-104807Mitel MiVoice Office 400 stored cross-site scripting1.9CNA v4.00.2%2026-10-05
CVE-2026-104806Mitel MiVoice Office 400 System Logs path traversal information disclosure5.5CNA v4.00.3%2026-10-05
CVE-2026-104805Mitel MiVoice Office 400 Backup Restoration arbitrary file write leading to Root code execution8.5CNA v4.00.2%2026-10-05
CVE-2026-104714Apache Struts: Shared message formatter exposes date and time values across concurrent requests8.8NVD v3.10.7%2026-10-05Fix
CVE-2026-104713Apache Struts: Unbounded request body read in the REST plugin6.5CISA ADP v3.10.7%2026-10-05Fix
CVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parameters7.5CISA ADP v3.10.9%2026-10-05Fix
CVE-2026-104711Apache Struts: OGNL injection in the legacy RESTful action mapper9.8CISA ADP v3.11.2%2026-10-05Exploit codeFix
CVE-2026-104706Mitel MiVoice Office 400 view system files path traversal8.4CNA v4.00.1%2026-10-05
CVE-2026-104675Event Tickets WordPress plugin broken access control4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-104673MP3 Audio Player for Music, Radio and Podcast by Sonaar WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-104409Image Photo Gallery Final Tiles Grid WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-104408Groundhogg WordPress plugin SQL injection7.6CNA v3.10.3%2026-10-05Fix
CVE-2026-104407PowerPress Podcasting WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2026-10-05Fix
CVE-2026-104404GiveWP WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-104401Memberful - Membership WordPress plugin sensitive data exposure4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-104400B Blocks WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-104397Name Directory WordPress plugin arbitrary shortcode execution vulnerability5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-104396Name Directory WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-104389Sirv WordPress plugin SQL injection8.5CNA v3.10.3%2026-10-05Fix
CVE-2026-104388PowerPress Podcasting WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-104386WP VR WordPress plugin broken access control6.5CNA v3.10.1%2026-10-05Fix
CVE-2026-104030Red Hat Enterprise Linux 10 sssd: Sssd: Denial of service5.5CNA v3.10.1%2026-10-05
CVE-2026-104029Red Hat Enterprise Linux 10 sssd: Sssd: Denial of service via out-of-bounds read in autofs responder3.3CNA v3.10.1%2026-10-05
CVE-2026-103684WP Event Solution WordPress plugin broken access control5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-103546Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator2.3CNA v4.00.2%2026-10-05Fix
CVE-2026-103512Perforce P4 Search authentication bypass by spoofing5.3CNA v4.00.4%2026-10-05
CVE-2026-103511Perforce P4 (Helix Core) arbitrary file-write via extension installation in P4Search5.1CNA v4.00.3%2026-10-05
CVE-2026-103510Perforce P4 (Helix Core) authentication bypass via blank auth token in P4Search9.5CNA v4.00.3%2026-10-05
CVE-2026-103507Perforce P4 (Helix Core) arbitrary file-write via log configuration path in P4Search7.5CNA v4.00.5%2026-10-05
CVE-2026-103433Docker Buildx Bake missing authorization6.9CNA v4.00.3%2026-10-05Fix
CVE-2026-103352WP BASE Booking WordPress plugin SQL injection9.3CNA v3.10.2%2026-10-05Fix
CVE-2026-103351Taxi Booking Manager for WooCommerce WordPress plugin Other vulnerability type vulnerability5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-103349Product Feed PRO for WooCommerce WordPress plugin PHP object injection7.2CNA v3.10.4%2026-10-05Fix
CVE-2026-103348WP Ultimate Exporter WordPress plugin PHP object injection7.2CNA v3.10.4%2026-10-05Fix
CVE-2026-103337WC Ukraine Shipping WordPress plugin broken access control6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-103335Video Conferencing with Zoom WordPress plugin sensitive data exposure5.3CNA v4.00.3%2026-10-05Fix
CVE-2026-103334Five Star Restaurant Reservations WordPress plugin sensitive data exposure7.5CNA v3.10.3%2026-10-05Fix
CVE-2026-103086UsersWP WordPress plugin broken access control6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-103085WP User Manager WordPress plugin privilege escalation6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-103084Premium Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-103079JS Help Desk WordPress plugin insecure direct object references (IDOR)5.4CNA v3.10.2%2026-10-05Fix
CVE-2026-103078JS Help Desk WordPress plugin insecure direct object references (IDOR)4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-103066WP BASE Booking WordPress plugin SQL injection8.5CNA v3.10.3%2026-10-05Fix
CVE-2026-102914Presto Player WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-102780joomlafry.com TF Content for Joomla RecordController mass assignment9.8NVD v3.10.3%2026-10-05
CVE-2026-102779joomlafry.com TF Content for Joomla records.custom_action task missing authorization7.3NVD v3.10.3%2026-10-05
CVE-2026-102778svenbluege.de Event Gallery for Joomla share mini page cross-site scripting6.1NVD v3.10.1%2026-10-05
CVE-2026-102777svenbluege.de Event Gallery for Joomla Google Photos picker server-side request forgery6.5NVD v3.10.3%2026-10-05
CVE-2026-102776svenbluege.de Event Gallery for Joomla backend list tasks cross-site request forgery4.3NVD v3.10.1%2026-10-05
CVE-2026-102775Joomla extension phoca.cz authorisation bypass7.5NVD v3.10.4%2026-10-05
CVE-2026-102576Quay: Quay: Dom-based cross-site scripting via unvalidated redirect_url on signin page4.2CNA v3.10.3%2026-10-05
CVE-2026-102428Joomla extension ordasoft.com unauthenticated SQL injection in OrdaSoft Joomla CCK9.8NVD v3.10.3%2026-10-05Exploit code
CVE-2026-102426joomshaper.com SP Page Builder Pro Dynamic Content Filter addon reflected cross-site scripting6.1NVD v3.10.2%2026-10-05
CVE-2026-102393Starter Templates WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-102383Lookzy WordPress plugin broken access control6.5CNA v3.10.3%2026-10-05Fix
CVE-2026-102295Quay: Quay: Dom-based cross-site scripting via oauth local callback format=json parameter5.4CNA v3.10.2%2026-10-05
CVE-2026-102282cthackers adm-zip privilege escalation7.1CNA v3.10.1%2026-10-05Exploit codeFix
CVE-2026-102262Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control7.0CNA v4.00.2%2026-10-05Exploit codeFix
CVE-2026-101919Red Hat Multicluster Engine for Kubernetes HyperShift operator improper input validation8.8CNA v3.10.4%2026-10-05
CVE-2026-101893Newell Brands DYMO ID document parsing failing file type extension authentication check5.1CNA v4.00.2%2026-10-05Fix
CVE-2026-100727GROWI An improper access control6.9CNA v4.00.2%2026-10-05Fix
CVE-2026-100515Photo Reviews for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-05Fix
CVE-2026-100511VK Google Job Posting Manager WordPress plugin PHP object injection8.8CNA v3.10.4%2026-10-05Fix
CVE-2026-100509RepairBuddy WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-100506WP Spell Check WordPress plugin PHP object injection7.2CNA v3.10.4%2026-10-05Fix
CVE-2026-100103Perfoce P4 (Helix Core) authentication bypass via default auth token in P4Search10.0CNA v4.00.4%2026-10-05
CVE-2026-100102Perforce P4 (Helix Core) RCE via exposed JDWP debug agent in P4Search9.5CNA v4.00.4%2026-10-05
CVE-2026-97309RepairBuddy WordPress plugin sensitive data exposure7.1CNA v4.00.2%2026-10-05Fix
CVE-2026-97305AI Chatbot for WordPress Hyve Lite plugin insecure direct object references (IDOR)6.9CNA v4.00.3%2026-10-05Fix
CVE-2026-97304Timetics WordPress plugin broken access control6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-97303Scratch and Win Giveaways and Contests WordPress plugin broken access control7.6CNA v3.10.2%2026-10-05Fix
CVE-2026-97283Advanced Post Manager WordPress plugin PHP object injection9.8CNA v3.10.4%2026-10-05Fix
CVE-2026-97275VillaTheme BuildKit Input vulnerability improper input validation5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-97257Simple Event Planner WordPress plugin PHP object injection8.8CNA v3.10.4%2026-10-05Fix
CVE-2026-97071CURCY WordPress plugin broken access control5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-97070Cozy Blocks WordPress plugin insecure direct object references (IDOR)6.9CNA v4.00.3%2026-10-05Fix
CVE-2026-95265Feehi CMS UEditor catchimage endpoint server-side request forgery7.5CISA ADP v3.10.2%2026-10-05
CVE-2026-95264Feehi CMS directory traversal6.5CISA ADP v3.10.5%2026-10-05
CVE-2026-95263Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can change the password of the built-in super administrator account. The server does not enforce protection for this account, and the update scenario does not require7.2CISA ADP v3.10.3%2026-10-05
CVE-2026-95166In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.5.4CISA ADP v3.10.1%2026-10-05
CVE-2026-95165Bacularis Organization name field cross-site scripting6.1CISA ADP v3.10.2%2026-10-05
CVE-2026-94669Fluent Forms Pro Add On Pack WordPress plugin broken access control5.3CNA v3.10.2%2026-10-05Fix
CVE-2026-94201Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash8.2CNA v4.00.3%2026-10-05Fix
CVE-2026-93617Sunshine Photo Cart WordPress plugin PHP object injection7.2CNA v3.10.3%2026-10-05Fix
CVE-2026-93326moby BuildKit crafted Git build source can bypass certain policy validation6.0CNA v4.00.2%2026-10-05Fix
CVE-2026-93323moby BuildKit oversized Dockerfile or .dockerignore can exhaust buildkitd memory6.8CNA v4.00.1%2026-10-05Fix
CVE-2026-93322Malformed MergeOp can crash the BuildKit daemon6.9CNA v4.00.1%2026-10-05Fix
CVE-2026-93321moby BuildKit malformed LLB file operation can crash buildkitd6.9CNA v4.00.2%2026-10-05Fix
CVE-2026-93320BuildKit improperly handles special files in build snapshots6.0CNA v4.00.1%2026-10-05Fix
CVE-2026-93319moby BuildKit A malicious frontend can cause a daemon panic5.7CNA v4.00.1%2026-10-05Fix
CVE-2026-93318moby BuildKit cache poisoning via unvalidated image layer DiffIDs7.5CNA v4.00.2%2026-10-05Fix
CVE-2026-93317moby BuildKit container blob cache can accept unverified content5.9CNA v4.00.2%2026-10-05Fix
CVE-2026-93316moby BuildKit starting daemon with --cdi-disabled flag can lead to panic on specific builds7.1CNA v4.00.2%2026-10-05Fix
CVE-2026-93315BuildKit proxy CA cleanup can be disrupted by build steps5.8CNA v4.00.1%2026-10-05Fix
CVE-2026-92931Server-side request forgery in the Progress Sitefinity Next.js Renderer SDK8.8CNA v3.10.3%2026-10-05Fix
CVE-2026-91107OS4ED openSIS-Classic openSIS Classic insecure direct object reference (IDOR)9.3CNA v4.00.2%2026-10-05
CVE-2026-89039Arbitrary file read via the convert_playwright_script prompt in mcp-k66.5CNA v3.10.4%2026-10-05Fix
CVE-2026-88424FineAdmin ButtonService.GetListByFilter SQL injection9.8CISA ADP v3.10.3%2026-10-05
CVE-2026-88397ApiAdmin user-list endpoint SQL injection6.5CISA ADP v3.10.3%2026-10-05
CVE-2026-88396ApiAdmin admin file-upload endpoint directory traversal7.2CISA ADP v3.11.0%2026-10-05
CVE-2026-88395GouGuOA /home/message/rubbish SQL injection9.8CISA ADP v3.10.4%2026-10-05
CVE-2026-88394WookTeam project task export endpoint directory traversal7.5CISA ADP v3.10.6%2026-10-05
CVE-2026-88393WookTeam project task export interface vulnerability9.8CISA ADP v3.10.4%2026-10-05
CVE-2026-88392Unimall FileUploadController.local directory traversal7.5CISA ADP v3.10.7%2026-10-05
CVE-2026-88391Northstar quantitative trading platform H2 Console vulnerability9.8CISA ADP v3.10.4%2026-10-05
CVE-2026-86671Eclipse Che external control of a file path8.4CNA v4.00.3%2026-10-05Fix
CVE-2026-84900HP ThinPro SP10 and ThinPro 9 SP3 Security Updates6.8CNA v4.00.1%2026-10-05Fix
CVE-2026-84169UPI QR Code Payment Gateway WordPress plugin unauthenticated Cross-Order Payment-Status forgery5.3CISA ADP v3.10.2%2026-10-05
CVE-2026-82989Viewsonic vCast vCast exposed network services injection9.8CISA ADP v3.10.7%2026-10-05Fix
CVE-2026-82988Viewsonic vCast vCast APK delivery mechanism arbitrary file read7.5CISA ADP v3.10.5%2026-10-05Fix
CVE-2026-79820HPE Integrated Lights-Out (iLO) 7 improper authentication9.0CNA v3.10.3%2026-10-05
CVE-2026-78862Mercusys AC12 V2 UART serial interface arbitrary code execution6.8CISA ADP v3.10.2%2026-10-05
CVE-2026-78861Mercusys AC12 V2 excessive memory allocation7.7CISA ADP v3.10.1%2026-10-05
CVE-2026-78860Mercusys AC12 V2 missing encryption7.8CISA ADP v3.10.1%2026-10-05
CVE-2026-78413Velociraptor privilege escalation via SysmonLogForward client monitoring artifact5.5CNA v3.10.2%2026-10-05Fix
CVE-2026-78412Rapid7 Velociraptor WatchEvent API streams another organization's live events4.9CNA v3.10.2%2026-10-05Fix
CVE-2026-78411Velociraptor Server Metadata update with insufficient permission Check6.5CNA v3.10.2%2026-10-05Fix
CVE-2026-78371WooCommerce File Uploads Addon for WooCommerce information disclosure5.9CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-77805Weak Executable signature verification vulnerability in Progress® Telerik® Fiddler® Classic7.9CNA v3.10.1%2026-10-05Fix
CVE-2026-77804Progress Software Telerik Fiddler Classic root certificate installation race condition6.6CNA v3.10.1%2026-10-05Fix
CVE-2026-77803Progress Software Telerik Fiddler Classic proxy request forwarding component HTTP request smuggling3.6CNA v3.10.1%2026-10-05Fix
CVE-2026-77802HTTP request smuggling vulnerability in Progress® Telerik® Fiddler® Classic6.3CNA v3.10.1%2026-10-05Fix
CVE-2026-77226Camunda 7. incorrect authorization via SetupResource endpoint9.2CNA v4.00.7%2026-10-05Fix
CVE-2026-71299Red Hat Multicluster Engine for Kubernetes Maestro REST API missing authentication6.5CNA v3.10.3%2026-10-05
CVE-2026-71298Red Hat Multicluster Engine for Kubernetes maestro: Sql identifier injection6.4CNA v3.10.3%2026-10-05
CVE-2026-71297Red Hat Multicluster Engine for Kubernetes maestro gRPC broker missing authentication5.4CNA v3.10.2%2026-10-05
CVE-2026-63277The Document Foundation LibreOffice RCE via calcext:data-mappings, SQL provider and jdbc connector8.5CNA v4.00.2%2026-10-05Exploit codeFix
CVE-2026-63270The Document Foundation LibreOffice environment/ini-file leaks6.7CNA v4.00.1%2026-10-05Fix
CVE-2026-63269The Document Foundation LibreOffice LFI and GET SSRF via GStreamer and HLS playlists6.7CNA v4.00.1%2026-10-05Fix
CVE-2026-63268The Document Foundation LibreOffice LFI6.7CNA v4.00.1%2026-10-05Fix
CVE-2026-63267The Document Foundation LibreOffice LFI and GET SSRF via calcext:data-mappings and CSV provider6.7CNA v4.00.1%2026-10-05Fix
CVE-2026-63266The Document Foundation LibreOffice arbitrary file write6.8CNA v4.00.2%2026-10-05Fix
CVE-2026-59788Zabbix stored XSS vulnerability in OAuth configuration form5.6CNA v4.00.3%2026-10-05
CVE-2026-59787Zabbix SNMP trap injection in zabbix_trap_receiver.pl5.3CNA v4.00.2%2026-10-05Fix
CVE-2026-59786Zabbix active agent heartbeat missing TLS check6.9CNA v4.00.2%2026-10-05Fix
CVE-2026-59785Zabbix hidden host credentials inferable via multiselect.get filtering5.1CNA v4.00.2%2026-10-05Fix
CVE-2026-59783Zabbix server DoS via binary items2.3CNA v4.00.2%2026-10-05Fix
CVE-2026-59782Zabbix JavaScript preprocessing memory disclosure6.9CNA v4.00.2%2026-10-05Fix
CVE-2026-58880Google Android btif_rc.cc code execution7.0CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-58865Google Android PduParser.java denial of service7.5CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-58859Google Android multiple places denial of service7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-58856Google Android DeprecatedCamera3StreamSplitter.cpp out-of-bounds read3.3CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-58854Google Android multiple locations memory corruption7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-58841Google Android VirtualAudioControllerTest.java insecure permissions7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-58835Google Android btif_storage.cc out-of-bounds write8.8CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-58834Google Android DevicePolicyManagerService.java denial of service5.5CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-58815Google Android multiple locations out-of-bounds write7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-55286Google Android stpropnci.cc out-of-bounds write7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-55280Google Android multiple locations out-of-bounds write8.8CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-55270Google Android dialInternal in multiple locations insecure permissions7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-55269Google Android snoop_logger.cc memory safety bugs7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-55266Google Android libufdt_sysdeps_vendor.c out-of-bounds write7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-55265Google Android PduParser.java out-of-bounds read6.5CISA ADP v3.10.3%2026-10-05Fix
CVE-2026-49937Google Android MessageQueueBase.h out-of-bounds read7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-49933Google Android msft.cc privilege escalation7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-49885Google Android rw_t4t.cc out-of-bounds write7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-49880Google Android nfa_nfcee_act.cc out-of-bounds write7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-49878Google Android robust_av.c out-of-bounds write7.2CISA ADP v3.10.3%2026-10-05Fix
CVE-2026-45524Google Android WifiPermissionsUtil.java sandbox escape8.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-42700Image Slider Widget WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-10-05
CVE-2026-39783Polylang WordPress plugin sensitive data exposure4.3CNA v3.10.2%2026-10-05Fix
CVE-2026-39763WP Dummy Content Generator WordPress plugin broken access control4.3CNA v3.10.2%2026-10-05
CVE-2026-39721Starter Templates WordPress plugin broken access control5.4CNA v3.10.2%2026-10-05Fix
CVE-2026-37719dormakaba evolo Service .NET component vulnerability9.8CISA ADP v3.10.7%2026-10-05
CVE-2026-28667Google Android rw_t5t.cc out-of-bounds read5.5CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-28648Google Android settings insecure permissions7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-28647Google Android DeviceAdminAppsPreferenceController.java insecure permissions7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-28641Google Android insecure permissions7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-28640Google Android CredentialStorageActivity.java insecure permissions7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-28625Google Android multiple locations insecure permissions7.8CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-21589Atlassian Multiple Products files or directories accessible to external parties9.3CNA v4.012.7%2026-10-05KEVNucleiEmerging ThreatsExploit codeFix
CVE-2026-20589MediaTek chipset venc out-of-bounds write6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20588MediaTek chipset mtee privilege escalation6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20587MediaTek chipset mtee privilege escalation6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20586MediaTek chipset vdec out-of-bounds write8.8CISA ADP v3.10.4%2026-10-05Fix
CVE-2026-20579MediaTek chipset vdec out-of-bounds write6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20544MediaTek chipset meta out-of-bounds write6.8CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20543MediaTek chipset Modem information disclosure5.5CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20542MediaTek chipset apusys memory corruption6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20541MediaTek chipset Modem out-of-bounds read5.3CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20540MediaTek chipset Modem out-of-bounds read5.3CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20539MediaTek chipset Modem out-of-bounds read5.3CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20538MediaTek chipset Modem out-of-bounds read5.3CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20537MediaTek chipset aidl memory corruption6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20536MediaTek chipset aidl memory corruption6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20535MediaTek chipset aidl privilege escalation6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20534MediaTek chipset Modem out-of-bounds read5.3CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20533MediaTek chipset display privilege escalation6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20532MediaTek chipset apu crash6.2CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20531MediaTek chipset apu memory corruption8.4CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20530MediaTek chipset display out-of-bounds write6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20529MediaTek chipset battery out-of-bounds write6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20528MediaTek chipset ccci out-of-bounds write6.7CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20527MediaTek chipset Modem crash5.3CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20526MediaTek chipset Modem out-of-bounds write7.5CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20525MediaTek chipset Modem crash5.3CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20524MediaTek chipset apu memory corruption8.4CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20523MediaTek chipset neuropilot out-of-bounds write8.4CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20522MediaTek chipset neuropilot out-of-bounds write8.4CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20521MediaTek chipset Video HAL privilege escalation8.4CISA ADP v3.10.1%2026-10-05Fix
CVE-2026-20520MediaTek chipset Modem out-of-bounds write7.5CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-20519MediaTek chipset Modem out-of-bounds write7.5CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-19954Perl Net::Whois::Raw pwhois command-line tool improper unicode handling5.4CISA ADP v3.10.2%2026-10-05Fix
CVE-2026-19395Qt for MCUs Text element parser denial of service6.6CNA v4.00.3%2026-10-05Fix
CVE-2026-19185zephyrproject zephyr I3C do_ccc system call handler untrusted pointer dereference7.8CNA v3.10.1%2026-10-05Fix
CVE-2026-19184zephyrproject zephyr NXP GAU ADC driver out-of-bounds write8.4CNA v3.10.1%2026-10-05Fix
CVE-2026-13607File Uploads Addon for WooCommerce WordPress plugin unauthenticated direct file access5.9CISA ADP v3.10.3%2026-10-05
CVE-2026-12171cookpete auto-changelog code execution8.4CNA v4.00.2%2026-10-05Fix
CVE-2026-0482AMD Alveo™ Accelerator Cards out-of-bounds write5.4CNA v4.00.1%2026-10-05
CVE-2026-0461AMD Zynq UltraScale+ MPSoCs out-of-bounds write7.5CNA v4.00.1%2026-10-05
CVE-2026-105224YesWiki stored XSS via Bazar valeur action5.1CNA v4.00.2%2026-10-04Fix
CVE-2026-105222Alexpechkarev/google-maps Disabled TLS Certificate Verification via ssl_verify_peer9.1CNA v4.00.2%2026-10-04
CVE-2026-105221Gist RubyGem Disabled TLS Certificate Verification9.1CNA v4.00.2%2026-10-04Exploit codeFix
CVE-2026-105220klembot twinejs twine 2 Desktop arbitrary code execution via Imported Story files8.5CNA v4.00.2%2026-10-04
CVE-2026-105219Mammoth.js ReDoS via Style Map Tokeniser8.7CNA v4.00.4%2026-10-04Fix
CVE-2026-105218gopay Disabled TLS Certificate Verification in xhttp client9.1CNA v4.00.2%2026-10-04Fix
CVE-2026-105217Cockpit CMS disabled TLS verification via cron.php2.3CNA v4.00.1%2026-10-04Fix
CVE-2026-105216go-micro Disabled TLS Certificate Verification via tls.Config Helper9.1CNA v4.00.2%2026-10-04Fix
CVE-2026-105215ZITADEL Account Pre-Hijacking via Forged External IdP Callback9.3CNA v4.00.3%2026-10-04Fix
CVE-2026-105214Zitadel SSRF via Organization Domain HTTP Verification2.3CNA v4.00.2%2026-10-04Fix
CVE-2026-105213ZITADEL authentication bypass via Login V2 for Deactivated Organizations8.8CNA v4.00.2%2026-10-04Fix
CVE-2026-105212ZITADEL and account takeover via Passkey Enrollment8.7CNA v4.00.3%2026-10-04Fix
CVE-2026-105211ZITADEL authentication bypass via Login V2 OTP returnCode9.2CNA v4.00.3%2026-10-04Fix
CVE-2026-105210ZITADEL Unauthenticated MFA Enrollment via Login V1 Init Handlers8.8CNA v4.00.2%2026-10-04Fix
CVE-2026-105209ZITADEL and Cross-Organization account takeover via Passkey Enrollment9.3CNA v4.00.2%2026-10-04Fix
CVE-2026-105208ZITADEL session hijacking via Forgeable IdP Intent Tokens8.7CNA v4.00.1%2026-10-04Fix
CVE-2026-105207ZITADEL account takeover via External IdP Linking9.3CNA v4.00.3%2026-10-04Fix
CVE-2026-105206ZITADEL Cross-Organization Authentication Method Enumeration via User service5.3CNA v4.00.3%2026-10-04Fix
CVE-2026-105205SiYuan information disclosure via /API/block/getDocInfo and getDocsInfo6.9CNA v4.00.2%2026-10-04Fix
CVE-2026-105171kishor-23 food-waste-management-system Role attribute admin.php authorization5.3CNA v4.00.2%2026-10-04
CVE-2026-105170kishor-23 food-waste-management-system Admin Signup signup.php missing authentication6.9CNA v4.00.4%2026-10-04
CVE-2026-105169kishor-23 food-waste-management-system Take Order delivery.php SQL injection6.9CNA v4.00.3%2026-10-04
CVE-2026-105168kishor-23 food-waste-management-system Order Assignment block admin.php SQL injection5.3CNA v4.00.2%2026-10-04
CVE-2026-105167kishor-23 food-waste-management-system donate.php SQL injection6.9CNA v4.00.3%2026-10-04
CVE-2026-105166kishor-23 food-waste-management-system Food Donation form fooddonateform.php insert SQL injection6.9CNA v4.00.3%2026-10-04
CVE-2026-105165devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment5.3CNA v4.00.2%2026-10-04Fix
CVE-2026-105164NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds5.1CNA v4.00.5%2026-10-04
CVE-2026-105163crossplane crossplane-runtime ImageConfig client.go Get toctou6.9CNA v4.00.3%2026-10-04Fix
CVE-2026-105161invariant-systems-ai aiir Policy Gate signature verification6.9CNA v4.00.1%2026-10-04
CVE-2026-105158RainyGao DocSys Database Management SQL injection6.9CNA v4.00.4%2026-10-04
CVE-2026-105157RainyGao DocSys Document controller doGetTmpFile.do DocController.doGetTmp path traversal5.3CNA v4.00.4%2026-10-04
CVE-2026-105156YzmCMS MD5 system.func.php password weak password hash6.3CNA v4.00.2%2026-10-04
CVE-2026-105149mooSocial all-products SQL injection6.9CNA v4.00.3%2026-10-04
CVE-2026-105148SciPhi-AI R2R Retrieval Completion API endpoint llm.py server-side request forgery6.9CNA v4.00.3%2026-10-04
CVE-2026-105147SciPhi-AI R2R JWT Secret hard-coded credentials6.9CNA v4.00.3%2026-10-04
CVE-2026-105146Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit SQL injection5.1CNA v4.00.2%2026-10-04
CVE-2026-105145Weaviate Verba generate_stream endpoint util.py get_environment information disclosure6.9CNA v4.00.3%2026-10-04
CVE-2026-105144Drogon Static File Router StaticFileRouter.cc route path traversal6.9CNA v4.00.5%2026-10-04
CVE-2026-105141topoteretes cognee JWT Signing Key Handler hard-coded credentials5.3CNA v4.00.3%2026-10-04Fix
CVE-2026-105137Laradock Build Process Dockerfile code download2.3CNA v4.00.1%2026-10-04
CVE-2026-105135InternLM MindSearch Planner agent graph.py ExecutionAction.run code injection10.0CNA v4.00.8%2026-10-04
CVE-2026-105134Ahsay AhsayCBS command injection10.0CNA v4.038.3%2026-10-04KEVExploit codeKCVFix
CVE-2026-105133Ahsay AhsayCBS improper authentication6.9CNA v4.05.8%2026-10-04KEVNucleiExploit codeKCVFix
CVE-2026-105131mayswind ezBookkeeping privilege escalation via Token Refresh endpoint5.3CNA v4.00.2%2026-10-04Fix
CVE-2026-105099Omega Solution CoinEx Crypto Ticket Attachment Upload cross-site scripting5.1CNA v4.00.2%2026-10-04
CVE-2026-105098Omega Solution CoinEx Crypto Support Ticket API information disclosure5.3CNA v4.00.3%2026-10-04
CVE-2026-105097Omega Solution CoinEx Crypto Customer Information API authorization bypass5.3CNA v4.00.3%2026-10-04
CVE-2026-105096Omega Solution CoinEx Crypto Customer Profile API authorization bypass5.3CNA v4.00.3%2026-10-04
CVE-2026-105089WWBN AVideo stored XSS via trailer1 in YouPHPFlix2 templates9.3CNA v4.00.2%2026-10-04
CVE-2026-105086WWBN AVideo stored XSS via Double-Encoded Video Title9.3CNA v4.00.2%2026-10-04
CVE-2026-104402Mindio Magic MCP WordPress plugin sensitive data exposure4.3CNA v3.10.2%2026-10-04Fix
CVE-2026-104119Simple Shopping Cart WordPress plugin Admin+ stored XSS via PayPal API Credentials3.5CISA ADP v3.10.1%2026-10-04Fix
CVE-2026-104118Razorpay for WooCommerce WordPress plugin unauthenticated order Shipping modification via IDOR5.3CISA ADP v3.10.2%2026-10-04Fix
CVE-2026-103355Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin SQL injection9.3CNA v3.10.3%2026-10-04Exploit codeFix
CVE-2026-103354Gutenberg Blocks by Kadence Blocks WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-04Fix
CVE-2026-103344Unlimited Elements For Elementor WordPress plugin cross-site scripting7.1CNA v3.10.1%2026-10-04Fix
CVE-2026-103062TranslatePress WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-04Fix
CVE-2026-97332User Private Files plugin information disclosure5.3CISA ADP v3.10.2%2026-10-04Exploit codeFix
CVE-2026-97307Cost Calculator Builder WordPress plugin sensitive data exposure7.5CNA v3.10.2%2026-10-04Fix
CVE-2026-97276WP Statistics WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.1%2026-10-04Fix
CVE-2026-93549CoCart - Administrator Account Creation via REST API authentication bypass8.8CISA ADP v3.10.1%2026-10-04Fix
CVE-2026-88779Citrix NetScaler improper restriction of operations within the bounds of a memory buffer8.7CNA v4.00.6%2026-10-04KEVKCVFix
CVE-2026-86817Five Star Business Profile and Schema - Author+ sensitive data disclosure4.9CISA ADP v3.10.2%2026-10-04Fix
CVE-2026-17005Horizontal Scrolling Announcements WordPress plugin Contributor+ stored XSS via Style field6.8CISA ADP v3.10.2%2026-10-04
CVE-2026-105130LaraDashboard race condition Bypasses Per-IP Registration Limit6.3CNA v4.00.2%2026-10-03Fix
CVE-2026-105129LaraDashboard incorrect authorization exposes Secrets via Settings API7.1CNA v4.00.3%2026-10-03Fix
CVE-2026-105128LaraDashboard open redirect via Email Template Builder redirect_url5.3CNA v4.00.3%2026-10-03Fix
CVE-2026-105127LaraDashboard resource exhaustion via Password Recovery endpoints6.9CNA v4.00.4%2026-10-03Fix
CVE-2026-105126LaraDashboard privilege escalation via Superadmin Role tampering8.6CNA v4.00.5%2026-10-03Fix
CVE-2026-105125laradashboard path traversal6.3CNA v4.00.3%2026-10-03Fix
CVE-2026-105124W (wcms) unauthenticated stored XSS via Login Username and Comments5.3CNA v4.00.2%2026-10-03
CVE-2026-105123W (wcms) RCE and arbitrary file write via Media Upload API8.7CNA v4.00.5%2026-10-03
CVE-2026-105122OpenAM SSRF via OpenID Connect client jwks_uri5.3CNA v4.00.2%2026-10-03Fix
CVE-2026-105121OpenAM improper authorization in Delegated Session-Destroy Realm Scoping6.9CNA v4.00.3%2026-10-03Fix
CVE-2026-105120OpenAM Cross-Realm session disclosure via Sessions REST endpoint6.9CNA v4.00.3%2026-10-03Fix
CVE-2026-105119OpenAM PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows7.6CNA v4.00.2%2026-10-03Fix
CVE-2026-105118OpenAM open redirect via Unverified id_token_hint in endSession2.3CNA v4.00.1%2026-10-03Fix
CVE-2026-105117OpenAM email content injection via Users REST Self-Service Actions5.3CNA v4.00.2%2026-10-03Fix
CVE-2026-105116OpenAM Latent XSS in SAML Load-Balancer Cookie Bounce page5.1CNA v4.00.2%2026-10-03Fix
CVE-2026-105115OpenAM Unauthenticated arbitrary Class Instantiation via JAX-RPC interface8.8CNA v4.00.5%2026-10-03Fix
CVE-2026-105114OpenAM reflected XSS via OAuth2 Authorization Error page5.3CNA v4.00.2%2026-10-03Fix
CVE-2026-105113Nezha denial of service via Notification Mutex deadlock7.1CNA v4.00.2%2026-10-03Fix
CVE-2026-105112Nezha deadlock DoS via notification-group endpoints6.0CNA v4.00.2%2026-10-03Fix
CVE-2026-105105NASA-AMMOS AIT-Core ait-server ZeroMQ broker missing authentication9.8CNA v3.10.8%2026-10-03
CVE-2026-105090formbricks incorrect authorization5.1CNA v4.00.3%2026-10-03Fix
CVE-2026-105083ImageMagick and Security Policy Bypass via policy.xml DOCTYPE4.2NVD v3.10.1%2026-10-03Fix
CVE-2026-105080C4illin ConvertX inclusion of untrusted functionality9.4CNA v4.00.3%2026-10-03Fix
CVE-2026-104983Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal5.3CNA v4.00.4%2026-10-03Fix
CVE-2026-104982Linux Mint Xreader EPUB file epub-document.c g_strdup_printf path traversal5.3CNA v4.00.4%2026-10-03Fix
CVE-2026-104313WPC Estimated Delivery Date for WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-10-03Fix
CVE-2026-103913GeoDirectory WordPress plugin unauthenticated SQL injection7.5CNA v3.10.4%2026-10-03Fix
CVE-2026-103909Calculated Fields Form WordPress plugin reflected DOM-based cross-site scripting6.1CNA v3.10.3%2026-10-03Fix
CVE-2026-103888WPC Smart Quick View for WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-10-03Fix
CVE-2026-103519WP Ultimate Review WordPress plugin arbitrary shortcode execution via xs_reviw_summery parameter5.4CNA v3.10.3%2026-10-03Fix
CVE-2026-103514WP 2FA WordPress plugin Two-Factor authentication bypass via TOTP code Replay7.5CISA ADP v3.10.3%2026-10-03Fix
CVE-2026-103421WPMobile.App WordPress plugin unauthenticated stored cross-site scripting5.4CNA v3.10.2%2026-10-03Fix
CVE-2026-103342Unlimited Elements For Elementor WordPress plugin cross-site scripting7.1CNA v3.10.1%2026-10-03Fix
CVE-2026-103293MPG WordPress plugin Editor+ arbitrary file read via Project import6.8CISA ADP v3.10.4%2026-10-03Fix
CVE-2026-103065Kirki WordPress plugin arbitrary code execution8.2CNA v3.10.2%2026-10-03Fix
CVE-2026-101928Magic Tooltips For Contact Form 7 WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-03Fix
CVE-2026-101923VillaTheme Photo Reviews for WooCommerce missing authorization8.1CNA v3.10.3%2026-10-03Fix
CVE-2026-101357SEOPress WordPress plugin stored cross-site scripting4.9CNA v3.10.2%2026-10-03Fix
CVE-2026-101162WP Ultimate Review WordPress plugin Author+ stored XSS via Review Overview settings6.4CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-101161WP Ultimate Review WordPress plugin unauthenticated DoS7.5CISA ADP v3.10.3%2026-10-03Fix
CVE-2026-101160WP Ultimate Review WordPress plugin unauthenticated DoS via Non-Numeric Review Rating7.5CISA ADP v3.10.3%2026-10-03Fix
CVE-2026-101159WP Ultimate Review WordPress plugin unauthenticated stored XSS via Review Submission7.5CISA ADP v3.10.3%2026-10-03Fix
CVE-2026-100180Jeg Kit for Elementor WordPress plugin unauthenticated stored cross-site scripting via comment5.4CNA v3.10.2%2026-10-03Fix
CVE-2026-100157roxnor WP Ultimate Review code injection6.5CNA v3.10.3%2026-10-03Fix
CVE-2026-100152smub All in One SEO code injection6.5CNA v3.10.4%2026-10-03Fix
CVE-2026-100149WPZOOM Connect: AI Chat WordPress plugin information disclosure5.3CNA v3.10.3%2026-10-03Fix
CVE-2026-100148Rich Showcase for Google Reviews WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-10-03Fix
CVE-2026-97873Bouncy Castle for Java raw JCA provider resource exhaustion5.3CNA v4.00.3%2026-10-03Fix
CVE-2026-97660WPC Product Options for WooCommerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-03Fix
CVE-2026-97644Groundhogg WordPress plugin privilege escalation8.8CNA v3.10.5%2026-10-03Fix
CVE-2026-97344Wp Social Login and Register Social Counter WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-03Fix
CVE-2026-97343Burst Statistics WordPress plugin improper authentication to account Persistence4.3CNA v3.10.3%2026-10-03Fix
CVE-2026-97341Visitor Traffic Real Time Statistics WordPress plugin DOM-based cross-site scripting7.2CNA v3.10.3%2026-10-03Fix
CVE-2026-97337Simple Membership WordPress plugin unauthorized access7.5CNA v3.10.4%2026-10-03Fix
CVE-2026-96962Pie Register WordPress plugin unauthenticated user email disclosure via Invitation code3.7CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-96650Strong Testimonials WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-03Fix
CVE-2026-96575Transliterator WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-03Fix
CVE-2026-96564SEOPress WordPress plugin unauthenticated stored cross-site scripting via Author Display Name7.2CNA v3.10.2%2026-10-03Fix
CVE-2026-96451Ultimate Member WordPress plugin privilege escalation8.8CNA v3.10.3%2026-10-03Exploit codeFix
CVE-2026-96270Ultimate Member WordPress plugin unauthenticated stored cross-site scripting via form_id parameter7.2CNA v3.10.2%2026-10-03Fix
CVE-2026-96267WP Visitor Statistics (Real Time Traffic) WordPress plugin unauthenticated SQL injection7.5CNA v3.10.3%2026-10-03Fix
CVE-2026-95865Beaver Builder Page Builder WordPress plugin SQL injection6.5CNA v3.10.3%2026-10-03Fix
CVE-2026-94539SupportCandy WordPress plugin authenticated (Custom+) SQL injection via sort_by parameter6.5CNA v3.10.3%2026-10-03Fix
CVE-2026-94505Nelio Content WordPress plugin authorization bypass8.1CNA v3.10.3%2026-10-03Fix
CVE-2026-94378SupportCandy WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-03Fix
CVE-2026-94239Loco Translate WordPress plugin Translator+ stored XSS via Bundle Configuration6.8CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-94238Loco Translate WordPress plugin Translator+ limited file read via path parameter6.8CISA ADP v3.10.3%2026-10-03Fix
CVE-2026-93896WPFront Notification Bar WordPress plugin reflected cross-site scripting via REQUEST_URI6.1CNA v3.10.2%2026-10-03Fix
CVE-2026-93889Mail logging WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-03Fix
CVE-2026-93430GD Rating System WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-03Fix
CVE-2026-93428Ultimate Member WordPress plugin authorization bypass7.5CNA v3.10.5%2026-10-03Fix
CVE-2026-92977Real Cookie Banner: GDPR and ePrivacy Cookie Consent WordPress plugin stored cross-site scripting7.2CNA v3.10.2%2026-10-03Fix
CVE-2026-92974Photo Gallery by 10Web WordPress plugin reflected cross-site scripting via thumb_url parameter6.1CNA v3.10.2%2026-10-03Fix
CVE-2026-92923Unlimited Elements for Elementor - Subscriber+ SQLi via get_addon_output_data6.3CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-92826EWWW Image Optimizer WordPress plugin reflected cross-site scripting via REQUEST_URI parameter Key6.1CNA v3.10.2%2026-10-03Fix
CVE-2026-92767Twenty20 Image Before-After WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-03Fix
CVE-2026-92727EmbedPress WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-03Fix
CVE-2026-92551Paid Membership Plugin WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-10-03Fix
CVE-2026-92538LearnPress WordPress plugin reflected DOM-based cross-site scripting via orderby parameter6.1CNA v3.10.2%2026-10-03Fix
CVE-2026-92536Paid Membership Plugin WordPress plugin information disclosure8.8CNA v3.10.6%2026-10-03Fix
CVE-2026-92437Mailchimp for WooCommerce WordPress plugin unauthenticated Abandoned Cart modification and deletion5.3CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-92243Ivory Search WordPress plugin reflected DOM-based cross-site scripting via s parameter6.1CNA v3.10.2%2026-10-03Fix
CVE-2026-92084Beaver Builder Page Builder Sidebar module widget output code injection9.1CNA v3.10.5%2026-10-03Exploit codeFix
CVE-2026-91108Alt Text AI WordPress plugin missing authorization authenticated arbitrary post content modification4.3CNA v3.10.2%2026-10-03Fix
CVE-2026-91078TillKit WordPress plugin unauthenticated POS takeover via Hard-Coded Default Manager PIN8.2CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-89236SaveTo Wishlist Lite WordPress plugin unauthenticated SQLi via sort_column and sort_order parameters8.6CISA ADP v3.10.3%2026-10-03Fix
CVE-2026-88783Kubio AI Page Builder WordPress plugin unauthenticated stored XSS via comment content8.8CISA ADP v3.10.3%2026-10-03Fix
CVE-2026-88782Kubio AI Page Builder WordPress plugin Contributor+ stored XSS via Image Gallery Item URL attribute6.8CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-87115VikAppointments Services Booking Calendar WordPress plugin unauthenticated arbitrary file deletion9.1CNA v3.10.9%2026-10-03Fix
CVE-2026-87091Welcart e-Commerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-03Fix
CVE-2026-86834MetForm - Unauthenticated Debug File Disclosure via HubSpot Forms Integration3.7CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-86832MetForm WordPress plugin unauthenticated form Entry data disclosure via REST API5.3CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-85568Unlimited Elements for Elementor - unauthenticated SQLi via ucs parameter6.8CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-85515Legion of the Bouncy Castle Bouncy Castle for Java OpenPGP improper integrity check validation8.2CNA v4.00.2%2026-10-03Fix
CVE-2026-85015Unlimited Elements For Elementor WordPress plugin arbitrary file write6.6CISA ADP v3.10.4%2026-10-03Fix
CVE-2026-80518WP Ultimate CSV Importer WordPress plugin unauthenticated Imported data disclosure3.7CISA ADP v3.10.2%2026-10-03Fix
CVE-2026-80517WP Ultimate CSV Importer - Admin+ stored XSS via ZIP Import SVG upload3.5CISA ADP v3.10.1%2026-10-03Fix
CVE-2026-79113aswf OpenAPV integer overflow5.1CNA v4.00.1%2026-10-03Fix
CVE-2026-75028WPCafe WordPress plugin local file inclusion7.5CNA v3.10.7%2026-10-03Fix
CVE-2026-71892Legion of the Bouncy Castle Bouncy Castle for Java CMS key-transport recipient incorrect comparison6.9CNA v4.00.2%2026-10-03Fix
CVE-2026-71891Bouncy Castle BC-JAVA BLS12-381 key validation improper signature verification7.1CNA v4.00.2%2026-10-03Fix
CVE-2026-71890Legion of the Bouncy Castle BC-JAVA MLS external commit can remove an arbitrary group member8.7CNA v4.00.2%2026-10-03Fix
CVE-2026-71889Legion of the Bouncy Castle Bouncy Castle for Java improper certificate validation8.7CNA v4.00.2%2026-10-03Fix
CVE-2026-71888Legion of the Bouncy Castle Bouncy Castle for Java improper integrity check validation8.7CNA v4.00.1%2026-10-03Fix
CVE-2026-71887Bouncy Castle BC-JAVA OpenPGP API improper signature verification8.2CNA v4.00.1%2026-10-03Fix
CVE-2026-71886Bouncy Castle BC-JAVA OpenPGP certificate API incorrect authorization8.2CNA v4.00.2%2026-10-03Fix
CVE-2026-71885Legion of the Bouncy Castle BC-JAVA MLS X.509 credential not bound to the LeafNode signature key9.2CNA v4.00.2%2026-10-03Fix
CVE-2026-71883Legion of the Bouncy Castle BC-LTS-JAVA native AES packet cipher returns the raw AES key on an alias8.2CNA v4.00.3%2026-10-03Fix
CVE-2026-18443Smart Manager WordPress plugin SQL injection to privilege escalation8.8CNA v3.10.4%2026-10-03Fix
CVE-2026-18040Legion of the Bouncy Castle BC-JAVA HQC leaks private key information5.9CNA v4.00.1%2026-10-03Fix
CVE-2026-15795Responsive Plus WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-03Fix
CVE-2026-11601WPCafe WordPress plugin authorization bypass5.3CNA v3.10.4%2026-10-03Fix
CVE-2026-11399Helpdesk Support Ticket System for WooCommerce WordPress plugin insecure direct object reference4.3CNA v3.10.2%2026-10-03Fix
CVE-2026-105051Irdeto Denuvo Anti-Tamper use of a less trusted source1.9CNA v3.10.1%2026-10-02
CVE-2026-105050PeaZip OS command injection7.1CNA v4.00.5%2026-10-02Fix
CVE-2026-105049Zilliz Attu missing authentication5.8CNA v3.10.2%2026-10-02Fix
CVE-2026-105048Zilliz Attu improper equivalence validation4.0CNA v3.10.2%2026-10-02Fix
CVE-2026-105046Kentico Xperience forced browsing4.3CNA v3.10.2%2026-10-02Fix
CVE-2026-105043MathWorks Simulink UI misrepresentation3.6CNA v3.10.1%2026-10-02Fix
CVE-2026-105030Kener Hidden Monitor data disclosure via Dashboard API6.9CNA v4.00.3%2026-10-02Exploit codeFix
CVE-2026-105029UVdesk support-center-bundle rateTicket Ticket Rating Endpoint insecure direct object reference5.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104994aquasec Trivy path traversal2.5CNA v3.10.2%2026-10-02Fix
CVE-2026-104991Phproject missing authorization via issues REST API7.1CNA v4.00.2%2026-10-02Exploit codeFix
CVE-2026-104988Red Hat Certificate System Dogtag PKI CMCAuthForEST plugin authentication bypass8.1CNA v3.10.2%2026-10-02
CVE-2026-104914MISP MISP contains an improper access control5.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104912MISP Correlation authorization bypass exposes Restricted Event and Attribute Data7.1CNA v4.00.2%2026-10-02Fix
CVE-2026-104910MISP information disclosure via Related Events Listing Bypassing Per-Event Authorization5.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104908MISP decaying model import functionality improper input validation7.1CNA v4.00.3%2026-10-02Fix
CVE-2026-104907MISP: JavaScript injection via Remote Tag ID in Event Preview Inline handler4.8CNA v4.00.4%2026-10-02Fix
CVE-2026-104906MISP TAXII Object Viewer stored XSS via Unescaped JSON Output6.2CNA v4.00.4%2026-10-02Fix
CVE-2026-104901MISP ID Translator: Unescaped Remote Event ID enables cross-site scripting via Linked Server5.1CNA v4.00.3%2026-10-02Fix
CVE-2026-104900MISP stored XSS via Unescaped Count Field Value in Remote Event Preview Index5.3CNA v4.00.4%2026-10-02Fix
CVE-2026-104874Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction5.3CNA v3.10.3%2026-10-02Fix
CVE-2026-104873LangGraph SDK custom auth silently ignores actions= on resource decorators7.6CNA v4.00.3%2026-10-02Fix
CVE-2026-104872open-telemetry instrumentation-cassandra-driver sensitive information in log files5.8CNA v3.10.2%2026-10-02Fix
CVE-2026-104871Angular SSR: Path traversal to Sibling Directories in CommonEngine on Windows6.3CNA v4.00.4%2026-10-02Fix
CVE-2026-104861nodeca probe-image-size SVG parser denial of service7.5CNA v3.10.4%2026-10-02Fix
CVE-2026-104859Nx: OS command injection in the @nx/docker release pipeline7.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104855Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state2.0CNA v4.00.3%2026-10-02Fix
CVE-2026-104854Nx daemon and plugin worker sockets are accessible to other local users8.5CNA v4.00.1%2026-10-02Fix
CVE-2026-104853Nx: Path traversal in nx migrate package-migrations extraction5.8CNA v4.00.2%2026-10-02Fix
CVE-2026-104851fsspec filesystem_spec ReferenceFileSystem server-side template injection8.8CNA v3.10.3%2026-10-02Fix
CVE-2026-104849Tinypool: Prototype pollution Gadget to RCE in run options9.5CNA v4.00.4%2026-10-02Fix
CVE-2026-104848Tinypool: Prototype pollution gadget in worker options leads to remote code execution9.5CNA v4.00.5%2026-10-02Fix
CVE-2026-104847ProseMirror: XSS vulnerability in prosemirror-view's paste handling8.5CNA v4.00.3%2026-10-02Fix
CVE-2026-104846Seroval: `fromJSON` Promise thenable assimilation invokes plugin-produced callables (bypass of)9.8CNA v3.10.3%2026-10-02Fix
CVE-2026-104845Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization7.5CNA v3.10.4%2026-10-02Fix
CVE-2026-104844PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion5.9CNA v3.10.4%2026-10-02Fix
CVE-2026-104843astral-sh uv wheel extraction path traversal5.9CNA v4.00.4%2026-10-02Fix
CVE-2026-104733User Impersonation/authorization bypass in XMPP Server ejabberd7.4CNA v4.00.2%2026-10-02Fix
CVE-2026-104721QOS.CH Sarl Logback-classic Logback: Incomplete protection against6.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104638onetwothreeneth HospitalManagementSystem sessions.php improper authentication6.9CNA v4.00.4%2026-10-02
CVE-2026-104637onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload6.9CNA v4.00.3%2026-10-02
CVE-2026-104625CodeAstro Simple Loan Management System index.php SQL injection5.3CNA v4.00.2%2026-10-02
CVE-2026-104614CodeAstro Simple Pharmacy Management System delete.php SQL injection5.3CNA v4.00.2%2026-10-02
CVE-2026-104613CodeAstro Simple Pharmacy Management System view.php SQL injection5.3CNA v4.00.2%2026-10-02
CVE-2026-104612SourceCodester Student Result Management System Announcement Module cross-site scripting5.3CNA v4.00.3%2026-10-02
CVE-2026-104611Tenda AC9 POST request fast_setting_internet_set stack-based overflow9.4CNA v4.00.5%2026-10-02
CVE-2026-104610Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow10.0CNA v4.00.6%2026-10-02
CVE-2026-104609onetwothreeneth HospitalManagementSystem edit_accounts.php get SQL injection6.9CNA v4.00.3%2026-10-02
CVE-2026-104606itsourcecode Online Admission System Project confirm.php SQL injection5.3CNA v4.00.3%2026-10-02
CVE-2026-104480Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership9.4CNA v4.00.4%2026-10-02Fix
CVE-2026-104479Shopclass stored XSS via Listing Description field5.1CNA v4.00.2%2026-10-02Fix
CVE-2026-104478Formwork path traversal via BackupController Download and Delete7.1CNA v4.00.4%2026-10-02Fix
CVE-2026-104477Showdown XSS via unescaped quote in href and src attributes5.3CNA v4.00.2%2026-10-02
CVE-2026-104476Backdrop CMS information disclosure via Configuration Export Archive8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-104475IDURAR ERP CRM stored XSS via SVG upload5.1CNA v4.00.2%2026-10-02
CVE-2026-104474OpenLiteSpeed local privilege escalation via lsup.sh Auto-Update5.4CNA v4.00.1%2026-10-02Fix
CVE-2026-104473YesWiki Multiple reflected XSS via BazaR and listpages5.1CNA v4.00.2%2026-10-02Fix
CVE-2026-104472YesWiki missing authorization via Attachment Download handler8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-104471YesWiki unrestricted file upload via Bazar CSV Import8.6CNA v4.00.4%2026-10-02Fix
CVE-2026-104470YesWiki SSRF via Bazar valeur action URL parameter5.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104469YesWiki session fixation via Login in AuthController.php7.6CNA v4.00.2%2026-10-02Fix
CVE-2026-104468YesWiki Non-Expiring Password Reset Tokens via LostPasswordAction6.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104467YesWiki authorization bypass via Public API Mode9.2CNA v4.00.4%2026-10-02Fix
CVE-2026-104466YesWiki stored XSS via Wakka Markdown Image src attribute5.1CNA v4.00.2%2026-10-02Fix
CVE-2026-104465YesWiki reflected XSS via field parameter in mail handler5.1CNA v4.00.2%2026-10-02Fix
CVE-2026-104464YesWiki SSRF via Bazar abonnements sync actor parameter8.8CNA v4.00.3%2026-10-02Fix
CVE-2026-104463YesWiki unauthenticated SSRF via ActivityPub Inbox8.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104462YesWiki SQL injection via nuagetag tags parameter8.8CNA v4.00.3%2026-10-02Fix
CVE-2026-104461YesWiki stored XSS via Unsanitized SVG upload in Bazar FileField5.1CNA v4.00.2%2026-10-02Fix
CVE-2026-104460YesWiki unauthenticated blind SQL injection via newtextsearch8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-104459YesWiki SSRF via ActivityPub WebFinger actor_handle6.9CNA v4.00.4%2026-10-02Fix
CVE-2026-104458YesWiki SSRF Guard Bypass via IPv6 Transition Addresses8.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104457YesWiki SQL injection via filtertags filterN parameter8.8CNA v4.00.3%2026-10-02Fix
CVE-2026-104456YesWiki Second-order SQL injection via ACL Username7.2CNA v4.00.3%2026-10-02Fix
CVE-2026-104455YesWiki Read-ACL Bypass via recentchangesrssplus RSS action6.9CNA v4.00.4%2026-10-02Fix
CVE-2026-104454YesWiki ReDoS via wakka.php Edit-Preview endpoint6.9CNA v4.00.4%2026-10-02Fix
CVE-2026-104453YesWiki CSRF Tag Deletion via admintag action5.3CNA v4.00.1%2026-10-02Fix
CVE-2026-104452YesWiki CSRF Attachment Deletion via filemanager handler5.3CNA v4.00.1%2026-10-02Fix
CVE-2026-104451YesWiki CSRF Page Revision Restore via RevisionsHandler5.3CNA v4.00.1%2026-10-02Fix
CVE-2026-104450YesWiki ACL Bypass and stored XSS via pointimage action8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-104449YesWiki Unauthenticated Page Overwrite via Bazar id_fiche8.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104448YesWiki CSRF Page Deletion via ajaxdeletepage handler7.2CNA v4.00.2%2026-10-02Fix
CVE-2026-104447YesWiki CSRF Package Deletion via autoupdate UpdateAction7.1CNA v4.00.1%2026-10-02Fix
CVE-2026-104446YesWiki Unauthenticated Open Mail Relay via Contact Mail handler6.9CNA v4.00.4%2026-10-02Fix
CVE-2026-104445YesWiki authentication bypass via ActivityPub Inbox Actor spoofing8.8CNA v4.00.4%2026-10-02Fix
CVE-2026-104444YesWiki authorization bypass via Comments API editComment7.1CNA v4.00.3%2026-10-02Fix
CVE-2026-104443YesWiki Scope Bypass via Triples Delete API7.2CNA v4.00.4%2026-10-02Fix
CVE-2026-104442YesWiki unauthenticated SSRF via syndication action6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104441YesWiki unauthenticated SSRF via valeur action6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104440YesWiki blind SSRF via bazarlist API idtypeannonce parameter6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104439YesWiki User Enumeration via Lost-Password Flow7.1CNA v4.00.3%2026-10-02Fix
CVE-2026-104438YesWiki information disclosure via listpagestag and includepages Actions8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-104437Zebra Consensus Split via SIGHASH_SINGLE Missing-Output Handling8.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104436Zebra CPU Amplification via Uncapped getblocks/getheaders Locator Length6.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104435Zebra Consensus Divergence via V5 SIGHASH_SINGLE without Output8.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104434Zebra denial of service via z_listunifiedreceivers RPC7.1CNA v4.00.3%2026-10-02Fix
CVE-2026-104433Mooncake out-of-bounds read via P2P Handshake readString8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-104432Zebra False Readiness via Discarded One-Hash FindBlocks Response6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104431Zebra denial of service via Synchronous Script FFI Verification8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-104430Zebra Consensus Split via P2SH Sigop Overcount8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-104429Zebra Per-Peer Mempool Admission Bypass via P2P tx messages6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104428Zebra denial of service via getblock Verbosity 26.9CNA v4.00.4%2026-10-02Fix
CVE-2026-104427Zebra Chain Stall via Stale parent_error_map Entry8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-104426Zebra Quadratic Complexity DoS via Block Transparent Value Check8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-104425Zebra Batch-Verification Poisoning DoS via Unattributed Pushed Transactions6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104424Zebra Incorrect Block Size Calculation in getblocktemplate6.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104423Zebra denial of service via Uncapped V6 Shielded Proof Verification8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-104422Zebra Block Sync denial of service via Coinbase scriptSig Rewrite8.7CNA v4.00.2%2026-10-02Fix
CVE-2026-104421Zebra Block Download denial of service via KnownBlock SentHashes Lockout6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104420Zebra Peer Misbehavior Ban Bypass via Gossiped blocks6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-104419Zebra Honest Peer Banning via Far-Ahead FindBlocks Hashes6.3CNA v4.00.1%2026-10-02Fix
CVE-2026-104418Ghost from RCE via Theme Translation files8.6CNA v4.00.7%2026-10-02Fix
CVE-2026-104417Ghost path traversal via Locale setting6.9CNA v4.00.4%2026-10-02Fix
CVE-2026-104416Ghost Invite token disclosure via Admin API7.7CNA v4.00.3%2026-10-02Fix
CVE-2026-104415Ghost Password Hash Ordering Disclosure via Admin API2.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104414Ghost from stored XSS via oEmbed Photo Responses8.6CNA v4.00.3%2026-10-02Fix
CVE-2026-104413Ghost stored XSS via Bookmark Card Images8.5CNA v4.00.3%2026-10-02Fix
CVE-2026-104412Ghost privilege escalation via Staff Role Assignment5.3CNA v4.00.2%2026-10-02Fix
CVE-2026-104411Ghost stored XSS via Local Storage File Uploads8.5CNA v4.00.3%2026-10-02Fix
CVE-2026-104410SiYuan information disclosure via /API/export/preview8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-104403LearnPress WordPress plugin insecure direct object references (IDOR)5.3CNA v3.10.2%2026-10-02Fix
CVE-2026-104123SourceCodester Online Reviewer Management System btn_functions.php activity SQL injection6.9CNA v4.00.3%2026-10-02
CVE-2026-104120modelcontextprotocol mcp-server-fetch Fetch Tool server-side request forgery6.9CNA v4.00.3%2026-10-02
CVE-2026-104055Canonical postgresql-operator postgres_exporter information disclosure5.3CNA v4.00.3%2026-10-02Fix
CVE-2026-104054calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization5.3CNA v4.00.2%2026-10-02
CVE-2026-104053itsourcecode Pet Shop Management System admin_reservefilter.php SQL injection5.3CNA v4.00.2%2026-10-02
CVE-2026-104052itsourcecode Pet Shop Management System admin_reject_completed.php SQL injection5.3CNA v4.00.2%2026-10-02
CVE-2026-104026Meta Platforms Sapling SCM escape sequence injection7.8CISA ADP v3.10.1%2026-10-02Fix
CVE-2026-104019AWS sagemaker-distribution OS command injection9.3CNA v4.01.4%2026-10-02Fix
CVE-2026-103958Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS8.3CNA v4.00.3%2026-10-02Fix
CVE-2026-103957Server-side request forgery in the OAuth2 discovery handling in Loom for AWS8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-103956Missing authentication for critical function in Loom for AWS10.0CNA v4.00.5%2026-10-02NucleiExploit codeFix
CVE-2026-103918@orpc/zod: Prototype injection in smart coercion6.5CNA v3.10.2%2026-10-02Fix
CVE-2026-103885Apache Directory LDAP API: Denial of service via crafted telephone number values7.5CISA ADP v3.10.5%2026-10-02Fix
CVE-2026-103880Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords7.5CISA ADP v3.10.5%2026-10-02Fix
CVE-2026-103878Apache Directory LDAP API: Injection of plaintext responses during StartTLS7.5CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-103877Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements9.8CISA ADP v3.10.6%2026-10-02Fix
CVE-2026-103763SiYuan information disclosure via /API/notebook/getNotebookInfo6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-103762SiYuan missing authorization in Save-Path Resolver endpoints6.9CNA v4.00.2%2026-10-02Fix
CVE-2026-103648Improper limitation of a pathname to a restricted directory (path traversal) in image-downloader9.1CNA v3.10.4%2026-10-02Exploit codeFix
CVE-2026-103631Google Chrome WebRTC buffer overflow8.8CISA ADP v3.10.5%2026-10-02Fix
CVE-2026-103630Google Chrome FedCM use-after-free9.6CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-103629Google Chrome Skia integer overflow4.3CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-103628Google Chrome WebGL out-of-bounds write9.6CISA ADP v3.10.4%2026-10-02Fix
CVE-2026-103627Google Chrome SVG information disclosure6.5CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-103626Google Chrome FileSystem incorrect authorization9.6CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-103625Google Chrome V8 type confusion8.8CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-103624Google Chrome Contextual Tasks use-after-free8.3CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-103623Google Chrome MediaStream use-after-free8.8CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-103622Google Chrome SVG use-after-free8.8CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-103621Google Chrome Compositing integer overflow4.3CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-103604Legion of the Bouncy Castle bc-csharp algorithmic complexity8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-103603Legion of the Bouncy Castle bc-csharp HSS/LMS signature code excessive memory allocation8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-103602Legion of the Bouncy Castle bc-csharp PkixNameConstraintValidator improper certificate validation8.2CNA v4.00.2%2026-10-02Fix
CVE-2026-103601Legion of the Bouncy Castle bc-csharp improper integrity check validation8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-103600Legion of the Bouncy Castle bc-csharp ASN.1 parser uncontrolled recursion8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-103552Apache Directory LDAP API stack-based buffer overflow7.3CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-103426Relevanssi Premium WordPress plugin unauthenticated stored cross-site scripting via _rt parameter7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-103098GV-Eye sensitive information exposure in URL query parameter7.5CNA v3.10.2%2026-10-02Fix
CVE-2026-103097GV-Eye Relay Payment API Key vulnerability7.5CNA v3.10.2%2026-10-02Fix
CVE-2026-103096GV-Eye Hard-coded API Key vulnerability7.5CNA v3.10.2%2026-10-02Fix
CVE-2026-103036@orpc/json-schema: Prototype injection in smart coercion6.5CNA v3.10.2%2026-10-02Fix
CVE-2026-102798ThemeREX Addons WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-02Fix
CVE-2026-102797ThemeREX Addons WordPress plugin server side request forgery (SSRF)6.4CNA v3.10.1%2026-10-02Fix
CVE-2026-102795Apache Traffic Server: SNI to host header matching policy is not properly enforced7.0CNA v4.00.3%2026-10-02Fix
CVE-2026-102772CMB2 WordPress plugin unauthenticated stored cross-site scripting via textarea_code field7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-102731Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode7.5CISA ADP v3.10.4%2026-10-02Fix
CVE-2026-102626LimeSurvey Community Edition stored XSS through the Date/Time date_min question attribute7.2CNA v4.00.3%2026-10-02
CVE-2026-102565BA Book Everything WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-102002Otter Blocks WordPress plugin sensitive information exposure in form Submissions Dashboard widget3.1CNA v3.10.3%2026-10-02Fix
CVE-2026-101104Missing authorization in Meari IoT Cloud Platform OpenAPI Service6.3CNA v4.00.3%2026-10-02
CVE-2026-100182Download Monitor WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-100107Kubio AI Page Builder WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-97876GNU GRUB2 serial command untrusted pointer dereference6.4CNA v3.10.1%2026-10-02Fix
CVE-2026-97663Customer Reviews for WooCommerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-97652WP Statistics WordPress plugin reflected cross-site scripting via REQUEST_URI Query-Parameter Key6.1CNA v3.10.3%2026-10-02Fix
CVE-2026-97641Relevanssi WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-97637JSON API Auth WordPress plugin unauthenticated authentication bypass9.8CNA v3.10.6%2026-10-02Fix
CVE-2026-97634Event Tickets and Registration WordPress plugin SQL injection6.5CNA v3.10.3%2026-10-02Fix
CVE-2026-97363Monta Monta.app improper restriction of excessive authentication attempts8.7CNA v4.00.3%2026-10-02
CVE-2026-97342JetFormBuilder WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-97338Download Manager WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-02Fix
CVE-2026-97336CMB2 WordPress plugin unauthenticated stored cross-site scripting via file_list field type7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-97318Giveaways and Contests by RafflePress WordPress plugin unauthenticated stored open redirect6.1CISA ADP v3.10.1%2026-10-02Fix
CVE-2026-97317Giveaways and Contests by RafflePress WordPress plugin information disclosure5.3CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-97219MStore API - Subscriber+ Payment Bypass via status parameter4.3CNA v3.10.2%2026-10-02Fix
CVE-2026-97212Monta Monta.app insufficient session expiration6.9CNA v4.00.2%2026-10-02
CVE-2026-96990Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-96940Microsoft Exchange Server elevation of privilege8.8CNA v3.10.5%2026-10-02Exploit codeFix
CVE-2026-96871Mang Board WordPress plugin unauthenticated stored cross-site scripting via data_type parameter7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-96647Webilia Listdom lsd[remark] parameter stored cross-site scripting6.4CNA v3.10.2%2026-10-02Fix
CVE-2026-96613Missing authorization in Meari IoT Cloud Platform OpenAPI Service7.1CNA v4.00.2%2026-10-02
CVE-2026-96578GSpeech TTS WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-96567MW WP Form WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-96566Newsletter WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-96294Apache Thrift: Nodejs web server: No `error` listener on an upgraded WebSocket connection8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-96292Apache Thrift Lua bindings denial of service8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-96289Apache Thrift: Php `--gen PHP:inlined` struct readers have no recursion-depth guard8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-96288Apache Thrift: Erlang generated struct reads have no recursion-depth guard (unbounded memory)8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-96287Apache Thrift algorithmic complexity8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-96286Apache Thrift: Perl servers end `serve` when serving one connection fails8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-96277Apache Thrift: Ruby `SimpleServer` ends `serve` on any non-Transport/Protocol exception8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-95817DoFollow Case by Case WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-95670No External Links WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-95662Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-95512Red Hat Hardened Images freetype: Freetype: Denial of service5.5CNA v3.10.2%2026-10-02Fix
CVE-2026-95102Monta Monta.app missing authentication for critical function9.3CNA v4.00.3%2026-10-02
CVE-2026-94658Apache Thrift: Lua `TFramedTransport`/`THttpTransport` re-slice the buffer on every read (quadratic)8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-94657Apache Thrift: Javame `TJsonProtocol`/`TJSONProtocol` has no string size bound8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94656Apache Thrift: Rb `TJsonProtocol`/`TJSONProtocol` has no string size bound8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94655Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94654Apache Thrift infinite loop8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94653Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94652Apache Thrift memory leak6.3CNA v4.00.4%2026-10-02Fix
CVE-2026-94651Apache Thrift TSaslNonblockingServer missing resource release8.2CNA v4.00.5%2026-10-02Fix
CVE-2026-94650Apache Thrift uncontrolled recursion8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94648Apache Thrift: Dart `TJsonProtocol`/`TJSONProtocol` has no string size bound8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94646Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)8.7CNA v4.00.5%2026-10-02Fix
CVE-2026-94645Apache Thrift input improper input validation8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94644Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94642Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-94639Apache Thrift: Java `TSaslNonblockingServer`: Residual of8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94638Apache Thrift: PHP `thrift_protocol` C extension ignores the configured `maxStringSize`6.3CNA v4.00.4%2026-10-02Fix
CVE-2026-94637Apache Thrift: Go `THeaderTransport` does not bound the inflated size of a ZLIB frame8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94636Apache Thrift Python TZlibTransport decompression bomb8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94635Apache Thrift Lua bindings improper length parameter handling8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-94634Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-94633Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-94594Armatura LLC Armatura One insertion of sensitive information into log file5.1CNA v4.00.1%2026-10-02Fix
CVE-2026-94593Armatura LLC Armatura One insertion of sensitive information into log file8.5CNA v4.00.1%2026-10-02Fix
CVE-2026-94592Armatura LLC Armatura One use of hard-coded credentials8.6CNA v4.00.1%2026-10-02Fix
CVE-2026-94591Armatura LLC Armatura One use of hard-coded cryptographic key8.6CNA v4.00.1%2026-10-02Fix
CVE-2026-94544vercel next.js sensitive information in cache6.3CNA v4.00.2%2026-10-02Fix
CVE-2026-94543Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications6.3CNA v4.00.3%2026-10-02Fix
CVE-2026-94541WPMobile.App WordPress plugin unauthenticated admin account takeover via wpapp_category[] parameter9.8CNA v3.10.5%2026-10-02Reported exploitedFix
CVE-2026-94486Next.js: Information disclosure in the Next.js development server's Model Context protocol endpoint2.3CNA v4.00.1%2026-10-02Fix
CVE-2026-94485Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass6.3CNA v4.00.1%2026-10-02Fix
CVE-2026-94484vercel next.js sensitive information in cache6.3CNA v4.00.2%2026-10-02Fix
CVE-2026-94483Next.js: Server-side request forgery in Image Optimization8.3CNA v4.00.2%2026-10-02Fix
CVE-2026-94432Appointment Booking Plugin WordPress plugin insecure direct object reference5.3CNA v3.10.3%2026-10-02Fix
CVE-2026-94422Fedora xdg-dbus-proxy: Message filtering bypass via reply serial allows sandbox escape8.7CNA v4.00.7%2026-10-02Fix
CVE-2026-94405Download Manager WordPress plugin sensitive data exposure5.3CNA v3.10.3%2026-10-02Fix
CVE-2026-94298BuildKit WordPress plugin Contributor+ stored SQLi via list_content parameter6.2CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-94180Advanced Ads WordPress plugin sensitive data exposure4.3CNA v3.10.3%2026-10-02
CVE-2026-93926Apache Thrift: C++ `THeaderTransport::untransform` leaks the zlib stream on the error path8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-93925Apache Thrift: C++ `THeaderTransport::writeVarint32` stack buffer overflow on a negative protocol id8.7CNA v4.00.5%2026-10-02Fix
CVE-2026-93880Greenshift WordPress plugin reflected cross-site scripting6.1CNA v3.10.2%2026-10-02Fix
CVE-2026-93875JetAppointment WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-93756Smash Balloon Social Post Feed WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-93698WebPros cPanel OS command injection9.9CNA v3.00.6%2026-10-02Fix
CVE-2026-93697WebPros cPanel WHM Mass Modify Accounts interface stored cross-site scripting9.0CNA v3.00.5%2026-10-02Fix
CVE-2026-93474Monta Monta.app insufficiently protected credentials6.9CNA v4.00.2%2026-10-02
CVE-2026-93367Visitors Traffic Real Time Statistics Pro WordPress plugin stored cross-site scripting7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-93029WebPros cPanel WHM Manage SSL Hosts interface stored cross-site scripting9.0CNA v3.00.5%2026-10-02Fix
CVE-2026-92924Unlimited Elements For Elementor get_addon_output_data vulnerability5.4CNA v3.10.2%2026-10-02Fix
CVE-2026-92834Apache Thrift: C++ WebSocket server transport does not read a full request length6.3CNA v4.00.4%2026-10-02Fix
CVE-2026-92820Ninja Forms - File Uploads WordPress plugin unauthenticated arbitrary file upload8.1CNA v3.10.5%2026-10-02Fix
CVE-2026-92174SiteOrigin Widgets Bundle WordPress plugin local file inclusion7.5CNA v3.10.6%2026-10-02Fix
CVE-2026-91828OMGF WordPress plugin unauthenticated DoS via do_optimize7.5CISA ADP v3.10.3%2026-10-02Fix
CVE-2026-91784Argument injection leading to arbitrary process termination in gotop4.8CNA v4.00.2%2026-10-02
CVE-2026-91137Apache Thrift: PHP `thrift_protocol` accelerator: Zero-byte container elements8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-91135Apache Thrift: C++ `THeaderTransport::transform` heap buffer overflow (write direction)9.2CNA v4.00.5%2026-10-02Fix
CVE-2026-91023Motors WordPress plugin stm_make_featured vulnerability3.1CISA ADP v3.10.1%2026-10-02Fix
CVE-2026-91022Motors WordPress plugin Listing Manager+ stored XSS via Badge Color6.8CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-91020WebToffee Gift Cards for WooCommerce web parameter tampering5.3CNA v3.10.3%2026-10-02Fix
CVE-2026-90988Request a Quote emd_get_std_pagenum AJAX handler vulnerability5.3CISA ADP v3.10.2%2026-10-02
CVE-2026-90987Easy PayPal and Stripe Buy Now Button web parameter tampering5.3CNA v3.10.2%2026-10-02Fix
CVE-2026-90970Improper neutralization of special elements used in a template engine in GitLab AI Gateway9.9CNA v3.10.9%2026-10-02Fix
CVE-2026-90952WP Edit Password Protected - Unauthenticated Site-Wide Access Mode Bypass via REST API5.3CNA v3.10.2%2026-10-02Fix
CVE-2026-90440Apache Thrift TNonblockingServer denial of service8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-90438Ninja Forms WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-02Fix
CVE-2026-87920W3 Total Cache WordPress plugin unauthenticated stored cross-site scripting via comment content7.2CNA v3.10.2%2026-10-02Fix
CVE-2026-87117Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-86537Apache Thrift D language bindings denial of service8.7CNA v4.00.6%2026-10-02Fix
CVE-2026-86536Apache Thrift JavaScript bindings prototype pollution6.3CNA v4.00.5%2026-10-02Fix
CVE-2026-86535Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-86326Moxa MGate MB3170 Series An improper signature verification8.6CNA v4.00.2%2026-10-02Fix
CVE-2026-86325Moxa MGate MB3170 Series stack-based buffer overflow9.4CNA v4.00.3%2026-10-02Fix
CVE-2026-85494Apache Thrift framed transport and binary protocol excessive memory allocation8.7CNA v4.00.5%2026-10-02Fix
CVE-2026-85493Apache Thrift uncontrolled recursion8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-85492All in One SEO WordPress plugin reflected DOM-based cross-site scripting via URL Pathname6.1CNA v3.10.2%2026-10-02Fix
CVE-2026-85483Apache Thrift: C_glib TZlibTransport reports a full read after a premature stream end6.3CNA v4.00.4%2026-10-02Fix
CVE-2026-85476Apache Thrift: C_glib `read_all` spins when the underlying read returns 08.2CNA v4.00.4%2026-10-02Fix
CVE-2026-85215SQL injection in GG Soft's PaperWork7.1CNA v3.10.2%2026-10-02
CVE-2026-85209IDOR in AVEZ Electronics's LMS6.5CNA v3.10.2%2026-10-02
CVE-2026-85088Apache Thrift C++ and D libraries improper certificate host validation6.9CNA v4.00.2%2026-10-02Fix
CVE-2026-85087Apache Thrift: Python host-name check silently becomes a no-op6.9CNA v4.00.2%2026-10-02Fix
CVE-2026-85086Apache Thrift: Perl TLS client disables certificate verification by default6.9CNA v4.00.3%2026-10-02Fix
CVE-2026-85016Unlimited Elements For Elementor WordPress plugin Contributor+ stored XSS via Icon Library parameter6.8CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-85005Popup Maker WP - Subscriber+ Zero-Argument PHP Callable Invocation via missing authorization5.4CNA v3.10.2%2026-10-02
CVE-2026-85004Popup Maker WP WordPress plugin Subscriber+ missing authorization via sgpm_connect4.3CISA ADP v3.10.2%2026-10-02
CVE-2026-84925Avada Website Builder For WordPress and WooCommerce theme reflected cross-site scripting6.1CNA v3.10.2%2026-10-02Fix
CVE-2026-84740The Events Calendar - Unauthenticated arbitrary Shortcode Execution via view_data parameter6.5CNA v3.10.2%2026-10-02Reported exploitedFix
CVE-2026-84411MikroTik RouterOS integer underflow9.3CNA v4.00.9%2026-10-02Fix
CVE-2026-83745Apache Thrift WebSocket frame decoders excessive memory allocation8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-83663Apache Thrift uncontrolled recursion8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-83632Apache Thrift: C++ THttpTransport grows its line buffer without bound9.2CNA v4.00.4%2026-10-02Fix
CVE-2026-82459Apache Thrift C++ THeaderTransport integer underflow8.2CNA v4.00.4%2026-10-02Fix
CVE-2026-82458Apache Thrift excessive memory allocation8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-82045UTMStack JPQL injection via searchPropertyValues7.1CNA v4.00.3%2026-10-02Fix
CVE-2026-82044UTMStack server-side request forgery via downloadPdf6.3CNA v4.00.3%2026-10-02Fix
CVE-2026-82043UTMStack Account Enumeration via Password Reset endpoint6.9CNA v4.00.2%2026-10-02Fix
CVE-2026-82042UTMStack authentication bypass via InternalApiKeyFilter9.3CNA v4.00.5%2026-10-02Fix
CVE-2026-82041UTMStack missing authorization via Command WebSocket6.5CNA v4.00.4%2026-10-02Fix
CVE-2026-82040UTMStack SSRF via IdentityProviderService5.3CNA v4.00.2%2026-10-02Fix
CVE-2026-82039UTMStack SQL injection via searchGroupsByFilter8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-81740Paytm Payment Gateway WordPress plugin improper authentication5.3CISA ADP v3.10.2%2026-10-02Fix
CVE-2026-80464API Tool Runner SSRF in HAVELSAN's Sef AI Chatbot Platform4.9CNA v3.10.3%2026-10-02Fix
CVE-2026-80443Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef AI Chatbot Platform7.4CNA v3.10.2%2026-10-02Fix
CVE-2026-80337Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef AI Chatbot Platform5.3CNA v3.10.2%2026-10-02Fix
CVE-2026-80298SQL injection in HAVELSAN's Sef AI Chatbot Platform8.8CNA v3.10.3%2026-10-02Fix
CVE-2026-79618WP User Frontend WordPress plugin Subscriber+ post creation via Subscription-Gated form4.3CNA v3.10.2%2026-10-02Fix
CVE-2026-78471Autoptimize WordPress plugin unauthenticated stored cross-site scripting via comment Author Name5.4CNA v3.10.2%2026-10-02Fix
CVE-2026-75937OS command injection in Digi Accelerated Linux (DAL OS)9.4CNA v4.00.5%2026-10-02Fix
CVE-2026-67989crmne ruby_llm Mistral model capability matching denial of service7.5CISA ADP v3.10.3%2026-10-02
CVE-2026-66859Apache Thrift: C_glib multiplexed processor crashes on a message it cannot route8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-66858Apache Thrift protocol skip routine uncontrolled recursion8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-66837Apache Thrift: PHP accelerator sizes a stack buffer from a wire-controlled string length8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-66331Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize6.9CNA v4.00.4%2026-10-02Fix
CVE-2026-66081Apache Thrift: C_glib read_message_begin leaves output parameters unset for non-versioned messages8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-66055Apache Thrift resource exhaustion8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-66054Apache Thrift: C++ THeaderTransport does not enforce configured maxFrameSize6.9CNA v4.00.4%2026-10-02Fix
CVE-2026-63772Apache Thrift: Unauthenticated single-packet crash of Go Thrift servers8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-63578Legion of the Bouncy Castle bc-csharp PbeUtilities.GenerateCipherParameters denial of service7.1CNA v4.00.3%2026-10-02Fix
CVE-2026-63577Legion of the Bouncy Castle bc-csharp improper certificate validation8.2CNA v4.00.2%2026-10-02Fix
CVE-2026-63576Legion of the Bouncy Castle bc-csharp URI name constraints checked against a mis-parsed host8.2CNA v4.00.2%2026-10-02Fix
CVE-2026-63575Legion of the Bouncy Castle bc-csharp PKCS#12 key derivation infinite loop7.1CNA v4.00.2%2026-10-02Fix
CVE-2026-63574Legion of the Bouncy Castle bc-csharp excessive memory allocation8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-63573Legion of the Bouncy Castle bc-csharp observable discrepancy8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-63572Legion of the Bouncy Castle bc-csharp Pkcs12Store.Load denial of service7.1CNA v4.00.3%2026-10-02Fix
CVE-2026-63571Legion of the Bouncy Castle bc-csharp improper signature verification8.7CNA v4.00.2%2026-10-02Fix
CVE-2026-63570Legion of the Bouncy Castle bc-csharp Pkcs12Store.GetCertificateChain infinite loop7.1CNA v4.00.2%2026-10-02Fix
CVE-2026-63569Legion of the Bouncy Castle bc-csharp DHAgreement.CalculateAgreement improper input validation9.1CNA v4.00.4%2026-10-02Fix
CVE-2026-63568Legion of the Bouncy Castle bc-csharp CMP/CRMF password-based MAC verifier resource exhaustion8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-63567Legion of the Bouncy Castle bc-csharp IesEngine block-cipher mode checks padding before MAC8.2CNA v4.00.5%2026-10-02Fix
CVE-2026-63566Legion of the Bouncy Castle bc-csharp DTLS handshake reassembly excessive memory allocation8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-61374Apache Thrift: Java TSaslTransport post-auth data-frame missing size limit7.1CNA v4.00.2%2026-10-02Fix
CVE-2026-61373Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation8.7CNA v4.00.4%2026-10-02Fix
CVE-2026-59673Repasat application cross-site scripting4.8CNA v4.00.4%2026-10-02Fix
CVE-2026-59672Repasat application cross-site scripting4.8CNA v4.00.4%2026-10-02Fix
CVE-2026-59671Repasat application cross-site scripting4.8CNA v4.00.3%2026-10-02Fix
CVE-2026-59670Repasat application cross-site scripting4.8CNA v4.00.3%2026-10-02Fix
CVE-2026-59669Repasat application cross-site scripting4.8CNA v4.00.3%2026-10-02Fix
CVE-2026-59668Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59667Repasat application cross-site scripting4.8CNA v4.00.3%2026-10-02Fix
CVE-2026-59666Repasat application cross-site scripting4.8CNA v4.00.3%2026-10-02Fix
CVE-2026-59665Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59664Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59663Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59662Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59661Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59660Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59659Repasat application cross-site scripting4.8CNA v4.00.2%2026-10-02Fix
CVE-2026-59265Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover8.8CISA ADP v3.10.4%2026-10-02Fix
CVE-2026-51922agentscope execute_shell_command code injection9.8CISA ADP v3.10.9%2026-10-02
CVE-2026-51918FinRobot CodingUtils.create_file_with_code code injection9.8CISA ADP v3.10.6%2026-10-02
CVE-2026-51917FinRobot CodingUtils.modify_code code injection7.3CISA ADP v3.10.3%2026-10-02
CVE-2026-51916TransformerOptimus SuperAGI knowledges.py vulnerability7.5CISA ADP v3.10.4%2026-10-02
CVE-2026-51915TransformerOptimus SuperAGI tool controller vulnerability9.8CISA ADP v3.10.6%2026-10-02
CVE-2026-51914TransformerOptimus SuperAGI agent template controller vulnerability8.8CISA ADP v3.10.5%2026-10-02
CVE-2026-51911vanna VannaBase.get_plotly_figure code injection9.8CISA ADP v3.10.9%2026-10-02
CVE-2026-51907TaskingAI QR Code Generator plugin path traversal8.1CISA ADP v3.10.4%2026-10-02
CVE-2026-51906TaskingAI DALL-E 3 image generation tool path traversal9.1CISA ADP v3.10.3%2026-10-02
CVE-2026-51904SuperAGI agent execution controller improper access control9.8CISA ADP v3.10.4%2026-10-02
CVE-2026-51901SuperAGI agent execution controller endpoint vulnerability8.1CISA ADP v3.10.3%2026-10-02
CVE-2026-51899SuperAGI controller endpoints vulnerability4.3CISA ADP v3.10.2%2026-10-02
CVE-2026-51898sinaptik-ai pandas-ai CodeExecutor.execute code injection9.8CISA ADP v3.10.3%2026-10-02
CVE-2026-39718Wallstreet WordPress theme cross-site request forgery (CSRF)8.8CNA v3.10.1%2026-10-02
CVE-2026-39717LearnPress WordPress plugin broken access control4.3CNA v3.10.2%2026-10-02
CVE-2026-39601Booking Calendar WordPress plugin race condition3.7CNA v3.10.2%2026-10-02Fix
CVE-2026-39600Aculect AI Companion WordPress plugin Unvalidated Redirects and Forwards vulnerability4.7CNA v3.10.2%2026-10-02Fix
CVE-2026-39444PublishPress Series WordPress plugin insecure direct object references (IDOR)5.4CNA v3.10.2%2026-10-02Fix
CVE-2026-39439WebSamurai WordPress plugin broken access control6.5CNA v3.10.2%2026-10-02
CVE-2026-32585Airano MCP Bridge WordPress plugin broken access control6.5CNA v3.10.2%2026-10-02
CVE-2026-32584Smart One Click Setup Complete Demo Import and Export WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-02
CVE-2026-21140Samsung Mobile Devices ManagedProvisioning improper access control6.9CNA v4.00.1%2026-10-02
CVE-2026-19856All in One SEO WordPress plugin unauthenticated arbitrary shortcode execution via Search Query6.5CNA v3.10.2%2026-10-02Fix
CVE-2026-19660Divi Membership WordPress plugin unauthenticated authentication bypass via paypal_param parameter9.8CNA v3.10.4%2026-10-02Exploit codeFix
CVE-2026-19652Divi Membership WordPress plugin unauthenticated privilege escalation via form_id parameter9.8CNA v3.10.3%2026-10-02Fix
CVE-2026-18036Bouncy Castle BC-JAVA NTRU timing side channel8.2CNA v4.00.3%2026-10-02Fix
CVE-2026-17508Legion of the Bouncy Castle Bouncy Castle for Java resource exhaustion5.3CNA v4.00.4%2026-10-02Fix
CVE-2026-17507Bouncy Castle BC-JAVA MLS implementation incorrect comparison8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-16001Legion of the Bouncy Castle bc-csharp IesEngine improper integrity check validation8.2CNA v4.00.2%2026-10-02Fix
CVE-2026-16000Legion of the Bouncy Castle bc-csharp DSTU missing cryptographic step8.7CNA v4.00.3%2026-10-02Fix
CVE-2026-15999Legion of the Bouncy Castle bc-csharp AES-CCM implementation improper integrity check validation8.2CNA v4.00.2%2026-10-02Fix
CVE-2026-15897Super Forms Drag and Drop Form Builder WordPress plugin privilege escalation8.8CNA v3.10.3%2026-10-02Fix
CVE-2026-15896Super Forms WordPress plugin unauthenticated path traversal to arbitrary file read9.1CNA v3.10.9%2026-10-02Fix
CVE-2026-14378DevKit Pro WordPress plugin unauthenticated authentication bypass to Administrator account takeover9.8CNA v3.10.5%2026-10-02Exploit codeFix
CVE-2026-13718Tabs Responsive WordPress plugin Shop Manager+ stored XSS via WooCommerce Product Tab content6.8CISA ADP v3.10.2%2026-10-02
CVE-2026-13413CMP Coming Soon & Maintenance authentication bypass5.3CNA v3.10.2%2026-10-02Fix
CVE-2026-12951MultiVendorX WordPress plugin authenticated (Store Manager+) SQL injection via order_by parameter6.5CNA v3.10.3%2026-10-02Fix
CVE-2026-12392RPC secret disclosure via vendor data endpoint in Canonical MAAS5.3CNA v3.10.3%2026-10-02Fix
CVE-2026-11795Softtr Informatics Trading E-Commerce Pack observable discrepancy5.3CNA v3.10.2%2026-10-02Fix
CVE-2026-10026CTX Feed Pro WordPress plugin authenticated (Administrator+) remote code execution7.2CNA v3.10.3%2026-10-02
CVE-2026-5782Reflected XSS in MRV Technology's TurkHotspot5.2CNA v3.10.1%2026-10-02
CVE-2026-1661WP Mail Logging WordPress plugin unauthenticated HTML injection4.3CNA v3.10.2%2026-10-02Fix
CVE-2026-104356PictShare Predictable Delete Code via rand8.2CNA v4.00.3%2026-10-01Exploit codeFix
CVE-2026-104286Fortinet FortiMail path traversal9.8CNA v3.12.2%2026-10-01KEVFix
CVE-2026-104183uhop stream-json Assembler prototype pollution5.1CNA v3.10.2%2026-10-01Fix
CVE-2026-104182uhop stream-json JSONC parser and verifier algorithmic complexity6.2CNA v3.10.1%2026-10-01Fix
CVE-2026-104181Filament: Multi-factor authentication management actions do not require password reauthentication5.4CNA v3.10.3%2026-10-01Fix
CVE-2026-104059Lektor CSRF via Admin API endpoints7.0CNA v4.00.1%2026-10-01
CVE-2026-104058Podgrab missing authentication on WebSocket /ws endpoint6.3CNA v4.00.2%2026-10-01
CVE-2026-104057Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket handler8.7CNA v4.00.3%2026-10-01
CVE-2026-104056authlib discovery JSON metadata cache vulnerability9.8CISA ADP v3.10.2%2026-10-01
CVE-2026-104051PictShare sensitive information disclosure via info API8.8CNA v4.00.4%2026-10-01Exploit codeFix
CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Python8.7CNA v4.00.4%2026-10-01Fix
CVE-2026-104018VxWorks 7 improper privilege management8.8CNA v3.10.6%2026-10-01
CVE-2026-104002Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)6.0CNA v4.00.3%2026-10-01Fix
CVE-2026-103923KaTeX: Existing prototype pollution can bypass trust restrictions2.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103922ionic-team Capacitor WebView navigation guard origin validation error9.3CNA v3.10.2%2026-10-01Fix
CVE-2026-103921ardatan graphql-tools executor-legacy-ws improper certificate validation7.4CNA v3.10.3%2026-10-01Fix
CVE-2026-103884Red Hat Keycloak X.509 client certificate authenticator path traversal6.5CNA v3.10.2%2026-10-01
CVE-2026-103858MISP Incomplete Thread Authorization allows Unauthorized Read and Post Access to Discussions5.3CNA v4.00.2%2026-10-01Fix
CVE-2026-103766MacWarrior clipbucket-v5 ClipBucket v5#197 SQL injection via ads_manager.php delete parameter8.6CNA v4.00.4%2026-10-01
CVE-2026-103765Mooncake missing authentication in HTTP Metadata Server8.8CNA v4.00.5%2026-10-01
CVE-2026-103764Mooncake transfer engine Unauthenticated arbitrary Memory Read/Write via TCP Transport9.3CNA v4.00.6%2026-10-01Fix
CVE-2026-103761Mooncake transfer engine memory exhaustion via Unbounded Notify Queue8.7CNA v4.00.4%2026-10-01
CVE-2026-103760Mooncake transfer engine denial of service via P2P Handshake Daemon Response Write8.2CNA v4.00.4%2026-10-01
CVE-2026-103758Obot authorization bypass via /mcp-connect-composite/ route8.6CNA v4.00.2%2026-10-01Fix
CVE-2026-103757Budibase SSRF via uploadUrl in AI Table Generation8.3CNA v4.00.3%2026-10-01Fix
CVE-2026-103754Red Hat Ansible Automation Platform 2 ansible-runner path traversal5.9CNA v3.10.3%2026-10-01
CVE-2026-103752Authorizer WordPress plugin privilege escalation9.8CNA v3.10.3%2026-10-01Fix
CVE-2026-103690itsourcecode Leave Management System controller.php SQL injection5.3CNA v4.00.3%2026-10-01
CVE-2026-103687rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php URL incomplete blacklist6.9CNA v4.00.5%2026-10-01Fix
CVE-2026-103686rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross-site scripting5.1CNA v4.00.4%2026-10-01Fix
CVE-2026-103680Tnef: Heap buffer overflow in find_free_number via numbered-backup suffix generation6.5NVD v3.10.3%2026-10-01
CVE-2026-103679tnef get_body_files use-after-free6.5CNA v3.10.3%2026-10-01
CVE-2026-103678Tnef: Heap out-of-bounds read in get_rtf_data_from_buf via uncompressed rtf mapi value8.1NVD v3.10.2%2026-10-01
CVE-2026-103664MISP reflected cross-site scripting via Unsanitized Analyst Data Seed parameter4.8CNA v4.00.3%2026-10-01Fix
CVE-2026-103662MISP reflected XSS in Taxonomy Tag Confirmation forms5.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103659MISP: Object Distribution ACL Bypass via Event Flattening exposes Organisation-Only attributes7.1CNA v4.00.2%2026-10-01Fix
CVE-2026-103655MISP TOTP Code Replay allows Duplicate Authentication within Validity Period9.3CNA v4.00.3%2026-10-01Fix
CVE-2026-103651MISP HOTP Token Replay via Stale Session-Cached Counter allows Second-Factor authentication bypass7.6CNA v4.00.2%2026-10-01Fix
CVE-2026-103641GEGL Radiance HDR loader out-of-bounds read5.5CNA v3.10.1%2026-10-01
CVE-2026-103544datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session5.3CNA v4.00.2%2026-10-01Fix
CVE-2026-103543itsourcecode Leave Management System controller.php SQL injection5.3CNA v4.00.2%2026-10-01
CVE-2026-103542formtools.org Form Tools AJAX endpoint actions.php smart_fill server-side request forgery5.3CNA v4.00.2%2026-10-01
CVE-2026-103541formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload5.3CNA v4.00.2%2026-10-01
CVE-2026-103540Form Tools Client Settings server-side template injection5.3CNA v4.00.2%2026-10-01
CVE-2026-103539ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication5.3CNA v4.00.3%2026-10-01
CVE-2026-103538ZongXR SuperMarket Order Deletion Endpoint missing authentication6.9CNA v4.00.4%2026-10-01
CVE-2026-103536ZongXR SuperMarket save Endpoint missing authentication6.9CNA v4.00.4%2026-10-01
CVE-2026-103534David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control5.3CNA v4.00.2%2026-10-01Fix
CVE-2026-103533David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal2.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103532immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization6.9CNA v4.00.3%2026-10-01
CVE-2026-103531OpenSC card-setcos.c setcos_construct_fci_44 stack-based overflow5.1CNA v4.00.2%2026-10-01Fix
CVE-2026-103505AWS EFS CSI Driver Mount option injection via mounttargetipmap6.9CNA v4.00.4%2026-10-01Fix
CVE-2026-103497JetBrains YouTrack server-side request forgery5.5CNA v3.10.2%2026-10-01Fix
CVE-2026-103496JetBrains YouTrack insecure direct object reference5.4CNA v3.10.1%2026-10-01Fix
CVE-2026-103495JetBrains YouTrack missing authorization4.3CNA v3.10.2%2026-10-01Fix
CVE-2026-103494JetBrains YouTrack incorrect privilege assignment6.6CNA v3.10.2%2026-10-01Fix
CVE-2026-103493JetBrains YouTrack cross-site scripting8.1CNA v3.10.2%2026-10-01Fix
CVE-2026-103492JetBrains YouTrack infinite loop6.5CNA v3.10.7%2026-10-01Fix
CVE-2026-103491JetBrains YouTrack insecure direct object reference6.5CNA v3.10.2%2026-10-01Fix
CVE-2026-103490JetBrains YouTrack missing authorization7.2CNA v3.10.4%2026-10-01Fix
CVE-2026-103489JetBrains YouTrack cross-site scripting2.0CNA v3.10.3%2026-10-01Fix
CVE-2026-103488JetBrains YouTrack incorrect authorization7.1CNA v3.10.3%2026-10-01Fix
CVE-2026-103484pgvector buffer overflow in IVFFlat index build8.8CNA v3.10.4%2026-10-01Fix
CVE-2026-103431collectl colmux escape sequence injection7.7CNA v3.10.2%2026-10-01Fix
CVE-2026-103353FluentForm WordPress plugin broken access control5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-103347hCaptcha for WP WordPress plugin bypass vulnerability vulnerability5.3CNA v3.10.2%2026-10-01Fix