CVE-2026 list

CVE-2026 records published in October 2026

Page 14 of 14: records 13,001 to 13,324 of the 13,324 published in October 2026, newest first. The first page carries the figures for October 2026.

CVE-2026 records published in October 2026, newest first: records 13,001 to 13,324 of 13,324
CVE Summary CVSS EPSS Published Signals
CVE-2026-103345Pie Register WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-103343FluentForm WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-01Fix
CVE-2026-103341Unlimited Elements For Elementor WordPress plugin broken access control5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-103340Site Reviews WordPress plugin broken access control5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-103339Metform WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-01Fix
CVE-2026-103338Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin SQL injection8.5CNA v3.10.2%2026-10-01Fix
CVE-2026-103336WP Ultimate CSV Importer WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-103292Ghost cross-site scripting via ghost_head8.6CNA v4.00.2%2026-10-01Fix
CVE-2026-103291Ghost SSRF via image-size fetch5.3CNA v4.00.1%2026-10-01Fix
CVE-2026-103290Ghost path traversal via ImageSize5.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103289Ghost authorization bypass via Comments7.1CNA v4.00.2%2026-10-01Fix
CVE-2026-103288Ghost authorization bypass via Comment Like7.1CNA v4.00.2%2026-10-01Fix
CVE-2026-103287Ghost server-side request forgery via Webhook5.1CNA v4.00.2%2026-10-01Fix
CVE-2026-103286Ghost privilege escalation via Notifications8.5CNA v4.00.2%2026-10-01Fix
CVE-2026-103285Ghost cross-site request forgery5.3CNA v4.00.1%2026-10-01Fix
CVE-2026-103284Ghost information disclosure via Feedback5.3CNA v4.00.2%2026-10-01Fix
CVE-2026-103283Ghost authentication bypass via Session Handling8.6CNA v4.00.3%2026-10-01Fix
CVE-2026-103282Ghost multiple Account Creation via Invite Token5.3CNA v4.00.1%2026-10-01Fix
CVE-2026-103281Ghost API key exposure via Admin API5.3CNA v4.00.2%2026-10-01Fix
CVE-2026-103280Ghost information disclosure via Setup endpoint6.9CNA v4.00.2%2026-10-01Fix
CVE-2026-103279Ghost Session Invalidation Bypass7.6CNA v4.00.2%2026-10-01Fix
CVE-2026-103278Ghost Staff account takeover via Admin iframe8.5CNA v4.00.3%2026-10-01Fix
CVE-2026-103277Ghost Untrusted Script Execution via oEmbed8.6CNA v4.00.3%2026-10-01Fix
CVE-2026-103276Ghost File Read via URL Encoding Bypass6.9CNA v4.00.2%2026-10-01Fix
CVE-2026-103275Ghost password hash disclosure5.3CNA v4.00.2%2026-10-01Fix
CVE-2026-103274Ghost Unauthenticated Comment Read6.9CNA v4.00.2%2026-10-01Fix
CVE-2026-103273Ghost incorrect authorization via Staff Token5.3CNA v4.00.3%2026-10-01Fix
CVE-2026-103272Ghost Staff Enumeration via Content API8.7CNA v4.00.4%2026-10-01Fix
CVE-2026-103271Ghost Restricted Content Bypass8.7CNA v4.00.4%2026-10-01Fix
CVE-2026-103269Ghost missing authorization via Post Excerpts6.9CNA v4.00.2%2026-10-01Fix
CVE-2026-103268Ghost Suspension Bypass via Password Reset8.7CNA v4.00.3%2026-10-01Fix
CVE-2026-103267Ghost arbitrary Email Registration via Staff Invite5.3CNA v4.00.3%2026-10-01Fix
CVE-2026-103266Ghost Unauthenticated Stripe Checkout Account Modification7.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103265Fleet information disclosure via MDM command results5.3CNA v4.00.2%2026-10-01Fix
CVE-2026-103264Fleet authentication bypass via Device Identifiers9.3CNA v4.00.3%2026-10-01Fix
CVE-2026-103263Tornado StaticFileHandler path traversal via Symlink8.2CNA v4.00.5%2026-10-01Fix
CVE-2026-103262Tornado denial of service via CurlAsyncHTTPClient8.7CNA v4.00.5%2026-10-01Fix
CVE-2026-103261Tornado denial of service via Query String6.9CNA v4.00.5%2026-10-01Fix
CVE-2026-103260n8n and.x Approval Bypass via Send and Wait Node6.3CNA v4.00.3%2026-10-01Fix
CVE-2026-103259n8n and.x Session token leak via Dynamic Credentials8.5CNA v4.00.2%2026-10-01Fix
CVE-2026-103258n8n and.x Filter Bypass via Parameter Interpolation6.9CNA v4.00.3%2026-10-01Fix
CVE-2026-103257n8n,, and path traversal via n8n Node8.1CNA v4.00.4%2026-10-01Fix
CVE-2026-103256n8n and.x credentials leak via preAuthentication Hook7.1CNA v4.00.2%2026-10-01Fix
CVE-2026-103255n8n,, and path traversal and Query injection via Supabase7.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103254n8n,, and path traversal via Resume URL Generation7.0CNA v4.00.3%2026-10-01Fix
CVE-2026-103253n8n,, and SQL injection via Oracle Database Drop Table7.0CNA v4.00.2%2026-10-01Fix
CVE-2026-103252n8n,, and information disclosure via Credential Test endpoint7.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103251n8n,, and Package Install Validation Bypass via PubSub7.5CNA v4.00.2%2026-10-01Fix
CVE-2026-103250n8n,, and NoSQL injection via MongoDB Chat Memory7.0CNA v4.00.2%2026-10-01Fix
CVE-2026-103249n8n,, and Stored DOM XSS via Resource Locator6.9CNA v4.00.2%2026-10-01Fix
CVE-2026-103248n8n,, and PostgREST Filter injection via Supabase7.1CNA v4.00.3%2026-10-01Fix
CVE-2026-103247n8n Credential tampering via Duplicate Node IDs5.8CNA v4.00.2%2026-10-01Fix
CVE-2026-103246n8n and.x credential disclosure via Node-Tool Introspection8.3CNA v4.00.3%2026-10-01Fix
CVE-2026-103245n8n,, and Missing Webhook signature verification6.9CNA v4.00.2%2026-10-01Fix
CVE-2026-103244ground-station authentication bypass via setup.restore9.3CNA v4.00.6%2026-10-01Fix
CVE-2026-103082LA-Studio Element Kit for Elementor WordPress plugin server side request forgery (SSRF)7.2CNA v3.10.2%2026-10-01Fix
CVE-2026-103068ByteCoreStack MCP Connector for AI Tools WordPress plugin privilege escalation8.8CNA v3.10.2%2026-10-01Fix
CVE-2026-103067Memberful - Membership WordPress plugin cross-site request forgery (CSRF)8.0CNA v3.10.1%2026-10-01Fix
CVE-2026-103064ElementsKit Elementor addons Lite WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-01Fix
CVE-2026-103063ElementsKit Elementor addons Lite WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-01Fix
CVE-2026-103004next.js cache leak on warm `use cache` handlers accessing root param6.3CNA v4.00.3%2026-10-01Fix
CVE-2026-102671Joyland AI WebView accepts invalid SSL certificates6.9CNA v4.00.1%2026-10-01
CVE-2026-102670Joyland.ai cleartext transmission of sensitive information5.3CNA v4.00.1%2026-10-01
CVE-2026-102669Joyland AI hostname checking disabled6.9CNA v4.00.2%2026-10-01
CVE-2026-102668Joyland AI accepts TLS certificates without validation6.9CNA v4.00.1%2026-10-01
CVE-2026-102667Joyland AI WebView command injection9.0CNA v4.00.2%2026-10-01
CVE-2026-102666Joyland AI hard-coded credentials for push notifications6.9CNA v4.00.2%2026-10-01
CVE-2026-102628Cadmos LTI exposure of sensitive information via debug mode9.2CNA v4.00.3%2026-10-01Fix
CVE-2026-102514Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive8.4CNA v4.00.1%2026-10-01Fix
CVE-2026-102505Perl Imager i_gsampf_fp vulnerability6.3CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-102504Perl Imager i_readraw_wiol vulnerability7.5CISA ADP v3.10.4%2026-10-01Fix
CVE-2026-102394Essential Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.1%2026-10-01Fix
CVE-2026-102390AFFI Affiliate Marketing for WooCommerce WordPress plugin broken access control5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-102382Majestic Support WordPress plugin insecure direct object references (IDOR)4.3CNA v3.10.2%2026-10-01Fix
CVE-2026-102381Majestic Support WordPress plugin broken access control5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-102379BuildKit Product Builder for WooCommerce Custom PC Builder WordPress plugin SQL injection8.5CNA v3.10.2%2026-10-01Fix
CVE-2026-102378Parallax Section block WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-01Fix
CVE-2026-102370Physical UART Access leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC715.4CNA v4.00.2%2026-10-01Fix
CVE-2026-102369Unauthenticated remote code execution via MacTool command injection in TP-Link Tapo C120 and C2008.7CNA v4.00.2%2026-10-01Fix
CVE-2026-102294Authenticated OS command injection in TL-WR841N IPv6 WAN Configuration8.5CNA v4.00.9%2026-10-01Fix
CVE-2026-101925bbp style pack WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-01Fix
CVE-2026-101890Prime Mover stored XSS via Package Metadata5.1CNA v4.00.2%2026-10-01Fix
CVE-2026-101889Prime Mover path traversal via wprime-config.json7.0CNA v4.00.3%2026-10-01Fix
CVE-2026-101888Prime Mover Zip Slip path traversal File Write8.6CNA v4.00.6%2026-10-01Fix
CVE-2026-101887arkq bluez-alsa BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS2.1CNA v4.00.2%2026-10-01
CVE-2026-101322Eclipse BaSyx AAS Web UI information disclosure8.3CNA v4.00.3%2026-10-01Fix
CVE-2026-101148BackupSheep WordPress plugin unauthenticated arbitrary file deletion and Backup Exfiltration10.0CISA ADP v3.10.3%2026-10-01
CVE-2026-101147Featured Image from URL (FIFU) Free and Premium Administrator Account Creation via CSRF8.8CISA ADP v3.10.1%2026-10-01Fix
CVE-2026-100517Photo Reviews for WooCommerce WordPress plugin insecure direct object references (IDOR)7.5CNA v3.10.3%2026-10-01Fix
CVE-2026-100514REST API Log WordPress plugin insecure direct object references (IDOR)7.5CNA v3.10.3%2026-10-01Fix
CVE-2026-100251Wormhole Wormhole.app SSRF6.9CNA v4.00.3%2026-10-01Fix
CVE-2026-100184Calculated Fields Form WordPress plugin reflected DOM-based cross-site scripting4.7CNA v3.10.2%2026-10-01Fix
CVE-2026-100179Calculated Fields Form WordPress plugin reflected DOM-based cross-site scripting6.1CNA v3.10.2%2026-10-01Fix
CVE-2026-97662AWS security-agent-mcp-server diff scan operation argument injection6.9CNA v4.00.1%2026-10-01Fix
CVE-2026-97661Business Essentials for Contact Form 7 WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-10-01Fix
CVE-2026-97297Gratisfaction WordPress plugin broken access control7.6CNA v3.10.3%2026-10-01Fix
CVE-2026-97284Icegram WordPress plugin PHP object injection8.8CNA v3.10.3%2026-10-01Fix
CVE-2026-97281WP Project Manager WordPress plugin broken access control6.3CNA v3.10.2%2026-10-01Fix
CVE-2026-97280Review Schema WordPress plugin broken access control6.5CNA v3.10.2%2026-10-01Fix
CVE-2026-97277Social Boost WordPress plugin broken access control7.6CNA v3.10.3%2026-10-01Fix
CVE-2026-97273Premmerce Wishlist for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-01Fix
CVE-2026-97269WPFunnels WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.2%2026-10-01Fix
CVE-2026-97268Premmerce Wishlist for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-01Fix
CVE-2026-97260MaxGalleria WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2026-10-01Fix
CVE-2026-97258Aruba Migration Tool WordPress plugin broken access control6.5CNA v3.10.3%2026-10-01Fix
CVE-2026-97251Bus Ticket Booking with Seat Reservation WordPress plugin insecure direct object references (IDOR)6.5CNA v3.10.2%2026-10-01Fix
CVE-2026-96813Form Maker by 10Web WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-01Fix
CVE-2026-96780patorjk figlet.js figlet is vulnerable to denial of service8.2CNA v4.00.4%2026-10-01Fix
CVE-2026-96659Foreman: Excessive permissions for viewer role on preview9.1CNA v3.10.3%2026-10-01Fix
CVE-2026-96658Foreman: Foreman: Arbitrary code execution via safemode sandbox bypass8.8CNA v3.10.7%2026-10-01Fix
CVE-2026-96577Red Hat OpenShift Container Platform missing authentication7.1CNA v3.10.2%2026-10-01Fix
CVE-2026-96573Appointment Hour Booking WordPress plugin unauthenticated stored DOM-based cross-site scripting7.2CNA v3.10.3%2026-10-01Fix
CVE-2026-96561AI Engine WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-01Fix
CVE-2026-96268Awesome Support WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-01Fix
CVE-2026-96256Gutenberg Essential Blocks WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-10-01Fix
CVE-2026-96255Payments for Hubtel WordPress plugin unauthenticated Payment Gateway credentials disclosure7.5CISA ADP v3.10.3%2026-10-01Fix
CVE-2026-96200Hubtel Payments for Hubtel payment callback vulnerability5.3CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-96173Payments for Hubtel WordPress plugin unauthenticated order key disclosure via IDOR5.3CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-95687WPC Shop as a Customer for WooCommerce WordPress plugin privilege escalation8.8CNA v3.10.5%2026-10-01Fix
CVE-2026-95588AcyMailing SMTP Newsletter WordPress plugin arbitrary file deletion8.6CNA v3.10.3%2026-10-01Fix
CVE-2026-94620foundation50 classroom50 gh teacher download arbitrary file overwrite9.4CNA v4.00.4%2026-10-01Fix
CVE-2026-94390Hide Shipping Method For WooCommerce WordPress plugin PHP object injection7.2CNA v3.10.4%2026-10-01Fix
CVE-2026-94276Apache APISIX: Openid-connect introspection validation issue5.1CNA v4.00.5%2026-10-01Fix
CVE-2026-94269Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch6.3CNA v4.00.4%2026-10-01Fix
CVE-2026-94250Apache APISIX: Batch response aggregation can exhaust worker memory8.2CNA v4.00.3%2026-10-01Fix
CVE-2026-94220Apache APISIX: Session fixation issue in feishu-auth and dingtalk-auth plugin2.1CNA v4.00.2%2026-10-01Fix
CVE-2026-94212Apache APISIX: Unauthenticated impersonation issue in saml-auth6.4CNA v4.00.3%2026-10-01Fix
CVE-2026-93882LearnPress WordPress plugin insecure direct object reference7.5CNA v3.10.4%2026-10-01Fix
CVE-2026-93832Motorola Setup App missing authorization4.8CNA v4.00.1%2026-10-01Fix
CVE-2026-93546Apache HTTP Server: Mod_dav_fs namespace overflow8.8CISA ADP v3.10.4%2026-10-01Fix
CVE-2026-93495ASUS Motherboard(PRIME Z390-A ) improper initialization7.0CNA v4.00.2%2026-10-01
CVE-2026-92966LatePoint Appointment Booking Plugin First/Last Name field code injection9.1CNA v3.10.4%2026-10-01Exploit codeFix
CVE-2026-92548WP Popular Posts WordPress plugin information disclosure5.3CNA v3.10.3%2026-10-01Fix
CVE-2026-92537Newsletter WordPress plugin unauthenticated insufficiently protected credentials5.3CNA v3.10.3%2026-10-01Fix
CVE-2026-92412Five Star Restaurant Reviews WordPress plugin reflected XSS7.1CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-92245Simply Schedule Appointments WordPress plugin information disclosure7.5CNA v3.10.4%2026-10-01Fix
CVE-2026-92244PDF Invoices and Packing Slips for WooCommerce WordPress plugin stored cross-site scripting7.2CNA v3.10.3%2026-10-01Fix
CVE-2026-92144Forminator Forms WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-10-01Fix
CVE-2026-91109Simply Schedule Appointments WordPress plugin insecure direct object reference6.5CNA v3.10.3%2026-10-01Fix
CVE-2026-90992Redux Framework WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-01Fix
CVE-2026-90974WP Fusion Lite - Unauthenticated CRM Integration Settings Update6.5CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-90972WP Fusion Lite WordPress plugin Subscriber+ user email disclosure and Cross-User CRM data deletion5.4CISA ADP v3.10.1%2026-10-01Fix
CVE-2026-89427Ad Inserter WordPress plugin reflected cross-site scripting via s Search parameter6.1CNA v3.10.3%2026-10-01Fix
CVE-2026-89424Duplicate Post WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-10-01Fix
CVE-2026-89296Pro Like Button WordPress plugin unauthenticated SQLi via postid parameter8.6CISA ADP v3.10.3%2026-10-01Fix
CVE-2026-89047Social Media Share Buttons and Social Sharing Icons WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-10-01Fix
CVE-2026-88999Redux Framework WordPress plugin missing authorization authenticated arbitrary Attachment deletion4.3CNA v3.10.3%2026-10-01Fix
CVE-2026-88789Apache Camel Quarkus XSLT support extension XML external entity injection8.6CNA v3.10.5%2026-10-01Exploit codeFix
CVE-2026-87973If-So Dynamic Content - Editor+ stored XSS via Conversion Name3.1CISA ADP v3.10.1%2026-10-01Fix
CVE-2026-87970If-So Dynamic Content - reflected XSS via render_ifso_shortcodes4.7CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-86610Download Manager WordPress plugin Author+ stored XSS via Package Icon6.4CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-86345Red Hat 389-ds-base StartTLS plaintext buffer improper channel restriction9.0CNA v3.10.4%2026-10-01
CVE-2026-86344Red Hat 389-ds-base worker thread pool denial of service7.5CNA v3.10.3%2026-10-01
CVE-2026-85679Extendify WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-01Fix
CVE-2026-85235Forminator Forms WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-10-01Fix
CVE-2026-84682TDDPv2 setProductVer command injection in Archer AX907.7CNA v4.01.0%2026-10-01Fix
CVE-2026-83589Red Hat OpenShift Container Platform oauth-proxy: Open redirect6.1CNA v3.10.3%2026-10-01Fix
CVE-2026-82829Hitachi Coding Software Suite hard-coded credentials9.3CNA v4.00.3%2026-10-01Fix
CVE-2026-82828Hitachi Coding Software Suite incorrect authorization8.7CNA v4.00.2%2026-10-01Fix
CVE-2026-82827Hitachi Coding Software Suite hard-coded cryptographic key9.3CNA v4.00.3%2026-10-01Fix
CVE-2026-82826Hitachi Coding Software Suite cleartext transmission of sensitive information8.7CNA v4.00.2%2026-10-01Fix
CVE-2026-82825Hitachi Coding Software Suite critical APIs missing authentication9.3CNA v4.00.3%2026-10-01Fix
CVE-2026-82824Hitachi Coding Software Suite path traversal9.3CNA v4.00.4%2026-10-01Fix
CVE-2026-82806Apache APISIX: Cross-request permission pollution via static permission list mutation5.3CNA v4.00.4%2026-10-01Fix
CVE-2026-82358RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass7.1CNA v4.00.2%2026-10-01Fix
CVE-2026-82357RT-Labs AB C-Open CANopen null pointer dereference7.1CNA v4.00.3%2026-10-01Fix
CVE-2026-81809Paytm Payment Gateway WordPress plugin unauthenticated SQLi via Payment Callback7.5CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-81739Paytm Payment Gateway WordPress plugin unauthenticated stored XSS via Payment Callback7.5CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-80276Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface7.5CNA v3.10.4%2026-10-01
CVE-2026-80275Comelit Group 1456B Multi-User Gateway password-change function forced browsing8.8CNA v3.10.3%2026-10-01
CVE-2026-79901Predictable Active Directory service-account passwords in BoKS Manager9.9CNA v3.10.3%2026-10-01Fix
CVE-2026-79900Fortra BoKS Manager boks-server heap overflow in KSL checksum initialization6.5CNA v3.10.2%2026-10-01Fix
CVE-2026-79899Fortra BoKS Manager bccgethostcert insecure temporary file7.9CNA v3.10.1%2026-10-01
CVE-2026-79898Fortra BoKS Manager crlserver command injection9.1CNA v3.11.0%2026-10-01
CVE-2026-79896Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read7.5CNA v3.10.3%2026-10-01
CVE-2026-79768Apache HTTP Server: Mod_userdir information disclosure5.3CISA ADP v3.10.6%2026-10-01Fix
CVE-2026-78578TP-Link Tapo C120 and C200 HTTPS onboarding connect denial of service7.1CNA v4.00.2%2026-10-01Fix
CVE-2026-78577Unauthenticated Onboarding Scan information disclosure in TP-Link Tapo C120 and C2005.3CNA v4.00.1%2026-10-01Fix
CVE-2026-78249FUJIFILM Business Innovation Apeos 3060 / 2560 / 1860 Japan model path traversal6.8CNA v4.00.2%2026-10-01
CVE-2026-78242Apache APISIX: Data-mask may fail to redact request headers in logger output5.7CNA v4.00.2%2026-10-01Fix
CVE-2026-78210Octopus Deploy Octopus Server incorrect authorization7.1CNA v4.00.3%2026-10-01Fix
CVE-2026-77387geopy geopy.Point denial of service4.0CNA v3.10.2%2026-10-01Fix
CVE-2026-76147Genians, Inc Genian NAC/ZTNA remote code execution5.9CNA v4.00.4%2026-10-01Fix
CVE-2026-76146Genians, Inc Genian SSL PNS OS command injection8.4CNA v4.01.9%2026-10-01Fix
CVE-2026-76145Genians, Inc Genian SSL PNS improper privilege management7.5CNA v4.00.2%2026-10-01Fix
CVE-2026-76144Genians, Inc Genian SSL PNS unrestricted file upload1.8CNA v4.00.1%2026-10-01Fix
CVE-2026-76143Genians, Inc Genian SSL PNS Multi Factor authentication bypass7.3CNA v4.00.3%2026-10-01Fix
CVE-2026-76142Genians, Inc. Genian NAC/ZTNA improper access control on the Internal interface9.3CNA v4.00.3%2026-10-01Fix
CVE-2026-75957Ultimate Multisite WordPress plugin unauthenticated authentication bypass9.8CNA v3.10.6%2026-10-01Fix
CVE-2026-75786Pandora FMS SQL injection in Grafana Integration endpoint (query.php)7.2CNA v4.00.2%2026-10-01
CVE-2026-739764TUResearchData djehuty search API vulnerability7.1CNA v4.00.4%2026-10-01Fix
CVE-2026-739754TUResearchData djehuty session editing vulnerability8.4CNA v4.00.3%2026-10-01Fix
CVE-2026-73637Apache HTTP Server: Mod_auth_digest DoS attack7.3CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-73636Apache HTTP Server: Mod_auth_digest one-time-nonce replay attack8.1CISA ADP v3.10.4%2026-10-01Fix
CVE-2026-71542GetSimpleCMS-CE GetSimple CMS: Stored cross-site scripting8.7CNA v4.00.4%2026-10-01
CVE-2026-71454CAPEC-63 cross-site scripting5.8CNA v4.00.2%2026-10-01Fix
CVE-2026-71453Johnson Controls EasyIO FS32 external control of a file path5.6CNA v4.00.1%2026-10-01Fix
CVE-2026-71452Johnson Controls EasyIO FS32 OS command injection7.2CNA v4.00.7%2026-10-01Fix
CVE-2026-71451Johnson Controls EasyIO FS32 OS command injection5.6CNA v4.00.4%2026-10-01Fix
CVE-2026-71449Johnson Controls EasyIO FS32 hard-coded cryptographic key9.3CNA v4.00.3%2026-10-01Fix
CVE-2026-71448Johnson Controls EasyIO FS32 insecure default initialization5.6CNA v4.00.1%2026-10-01Fix
CVE-2026-71426GetSimpleCMS-CE GetSimple CMS: Authenticated stored local file inclusion7.1CNA v4.00.3%2026-10-01
CVE-2026-70650GetSimpleCMS-CE GetSimple CMS: Authenticated stored XSS in backup viewer8.8CNA v4.00.3%2026-10-01
CVE-2026-68496FasterXML jackson-dataformats-binary Smile parser denial of service7.5CNA v3.10.7%2026-10-01Fix
CVE-2026-68495FasterXML jackson-dataformats-binary CBOR parser denial of service7.5CNA v3.10.7%2026-10-01Fix
CVE-2026-67172HCL BigFix Service Management API endpoints information disclosure3.7CNA v3.10.2%2026-10-01Fix
CVE-2026-67171HCL BigFix Service Management API endpoint information disclosure5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-67106HCL BigFix Service Management API endpoints information disclosure5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-67105HCL BigFix Service Management cleartext transmission of sensitive information7.4CNA v3.10.2%2026-10-01Fix
CVE-2026-67104HCL BigFix Service Management information disclosure5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-67075HCL Digital Experience is affected by improper input sanitation6.5CNA v3.10.2%2026-10-01
CVE-2026-66253HCL Software iControl insufficient session expiration3.1CNA v3.10.1%2026-10-01
CVE-2026-66249HCL iControl is affected by a Missing Secure attribute vulnerability3.1CNA v3.10.1%2026-10-01
CVE-2026-66248HCL iControl is affected by an improper error handling3.1CNA v3.10.2%2026-10-01
CVE-2026-66247HCL Software iControl permissive cross-domain policy4.3CNA v3.10.2%2026-10-01
CVE-2026-66246HCL Software iControl privilege escalation8.8CNA v3.10.3%2026-10-01
CVE-2026-64950Pandora FMS stored cross-site scripting via Directory Name in File Manager Create Directory8.4CNA v4.00.2%2026-10-01
CVE-2026-64949Pandora FMS unrestricted file upload leading to remote code execution in Admin tools File Manager8.6CNA v4.00.3%2026-10-01
CVE-2026-64948Pandora FMS module data retrieval missing authorization7.1CNA v4.00.2%2026-10-01
CVE-2026-64947Pandora FMS CSRF Bypass leading to remote code execution7.5CNA v4.00.3%2026-10-01
CVE-2026-64946Pandora FMS CSRF Bypass leading to stored cross-site scripting7.4CNA v4.00.2%2026-10-01
CVE-2026-64893Johnson Controls EasyIO NEO cleartext transmission of sensitive information7.3CNA v4.00.1%2026-10-01Fix
CVE-2026-64892Johnson Controls EasyIO NEO information disclosure6.3CNA v4.00.2%2026-10-01Fix
CVE-2026-63718Apache HTTP Server: Mod_proxy_uwsgi Transfer-Encoding response smuggling7.5CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-63686Apache HTTP Server: Mod_xml2enc crash on charset conversion failure7.5CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-63292Apache HTTP Server: Mod_vhost_alias stack overflow7.5CISA ADP v3.10.9%2026-10-01Exploit codeFix
CVE-2026-63045Apache HTTP Server: Mod_proxy_ftp PASV address handling7.5CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-62073WP Full Stripe Free WordPress plugin broken access control7.5CNA v3.10.2%2026-10-01Fix
CVE-2026-62071WordPress File Upload plugin SQL injection9.3CNA v3.10.2%2026-10-01Fix
CVE-2026-62063WpTravelly WordPress plugin broken access control5.4CNA v3.10.2%2026-10-01Fix
CVE-2026-62061ProfileGrid WordPress plugin insecure direct object references (IDOR)5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-62060Captivate Sync WordPress plugin SQL injection7.6CNA v3.10.2%2026-10-01Fix
CVE-2026-62059Ultimate Member WordPress plugin SQL injection7.6CNA v3.10.3%2026-10-01Fix
CVE-2026-62058CF7 Apps WordPress plugin sensitive data exposure5.3CNA v3.10.2%2026-10-01Fix
CVE-2026-59797Apache HTTP Server: Mod_ssl SSLRequire allows .htaccess ap_expr file-function9.8CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-59685Apache HTTP Server out-of-bounds write7.5CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-58415Apache HTTP Server: Mod_dav_fs property database read access5.3CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-57941Apache HTTP Server use-after-free9.8CISA ADP v3.10.6%2026-10-01Fix
CVE-2026-56662GetSimple CMS CE UpdateCE update form cross-site request forgery9.6CNA v3.10.2%2026-10-01Fix
CVE-2026-56661GetSimpleCMS-CE GetSimple CMS: Server-side request forgery in the UpdateCE update endpoint7.5CNA v3.10.3%2026-10-01Fix
CVE-2026-56660GetSimpleCMS-CE GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction9.1CNA v3.10.5%2026-10-01Fix
CVE-2026-56599HCL BigFix Service Management sensitive cookie without the Secure attribute2.2CNA v3.10.1%2026-10-01Fix
CVE-2026-56589HCL BigFix Service Management stored cross-site scripting7.2CNA v3.10.2%2026-10-01Fix
CVE-2026-56449Apache HTTP Server: Mod_proxy_html: Crash in dump_content7.5CISA ADP v3.10.6%2026-10-01Fix
CVE-2026-56154Apache HTTP Server use-after-free9.8CISA ADP v3.10.6%2026-10-01Fix
CVE-2026-56153Apache HTTP Server: Mod_charset_lite: Heap overflow in finish_partial_char7.5CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-56098Red Hat Satellite rubygem-katello: Improper authorization logic allows resource enumeration4.3CNA v3.10.3%2026-10-01Fix
CVE-2026-56097Red Hat Satellite rubygem-katello: Sql injection in registry proxy via labels6.5CNA v3.10.3%2026-10-01Fix
CVE-2026-55396Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware28.5CNA v4.00.1%2026-10-01
CVE-2026-55395Hard-coded passwords in Teledyne FLIR Robots running Aware29.4CNA v4.00.2%2026-10-01
CVE-2026-55394Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware25.3CNA v4.00.1%2026-10-01
CVE-2026-55393Local file inclusion in Teledyne FLIR Robots running Aware210.0CNA v4.00.4%2026-10-01
CVE-2026-55252OpenRun: Redirect URL validation bypass using //host paths leads to open redirect5.1CNA v4.00.3%2026-10-01Fix
CVE-2026-55251NetBox Device Type Library CI workflow code injection6.5CNA v3.10.1%2026-10-01
CVE-2026-55232Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl in editor oEmbed proxy7.6CNA v3.10.3%2026-10-01Fix
CVE-2026-55231Vvveb: Path traversal in Vvveb7.2CNA v3.10.5%2026-10-01Fix
CVE-2026-55230Vvveb: Stored XSS in Vvveb via sanitizeHTML filter bypass using a quoted greater-than character8.7CNA v3.10.3%2026-10-01Fix
CVE-2026-55083DHIS2: Unsafe Java deserialization remote code execution (RCE)9.1CNA v3.10.6%2026-10-01Fix
CVE-2026-54049Sakai Conversations has a stored XSS issue8.7CNA v3.10.3%2026-10-01Fix
CVE-2026-53964adfinis document-merge-service document Merge service vulnerable to RCE via SSTI (xlsx tempaltes)7.2CNA v3.10.5%2026-10-01Fix
CVE-2026-53953GetSimple CMS CE password reset endpoint weak password recovery9.1CNA v3.10.3%2026-10-01
CVE-2026-51897RAGFlow evaluation_app api improper access control9.8CISA ADP v3.10.7%2026-10-01
CVE-2026-51896infiniflow ragflow connector_app.py improper access control6.5CISA ADP v3.10.2%2026-10-01
CVE-2026-51895Ragflow update_metadata_setting improper access control6.5CISA ADP v3.10.2%2026-10-01
CVE-2026-51894infiniflow ragflow run_mindmap vulnerability6.5CISA ADP v3.10.2%2026-10-01
CVE-2026-51893infiniflow ragflow trace_mindmap vulnerability9.8CISA ADP v3.10.3%2026-10-01
CVE-2026-51892infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/.6.5CISA ADP v3.10.2%2026-10-01
CVE-2026-51888langflow-ai langflow knowledge_bases.py directory traversal7.5CISA ADP v3.10.6%2026-10-01
CVE-2026-51886Langflow: Title Authenticated remote code execution in validate_code9.8CISA ADP v3.10.4%2026-10-01Reported exploitedFix
CVE-2026-51884Langchain Chatchat temporary document upload endpoint path traversal9.8CISA ADP v3.10.5%2026-10-01
CVE-2026-51883Langchain-Chatchat knowledge base creation and document upload interfaces path traversal9.1CISA ADP v3.10.3%2026-10-01
CVE-2026-51882Langchain-Chatchat file upload endpoint path traversal9.1CISA ADP v3.10.4%2026-10-01
CVE-2026-51881deeptutor ExecTool.execute code injection9.8CISA ADP v3.10.3%2026-10-01
CVE-2026-51880deeptutor EditFileTool.execute path traversal9.8CISA ADP v3.10.4%2026-10-01
CVE-2026-51879deeptutor TutorBotManager.write_bot_file authorization bypass9.1CISA ADP v3.10.3%2026-10-01
CVE-2026-51878deeptutor TurnRuntimeManager.regenerate_last_turn authorization bypass4.3CISA ADP v3.10.2%2026-10-01
CVE-2026-51876DeepTutor book confirmation flow authorization bypass9.1CISA ADP v3.10.3%2026-10-01
CVE-2026-51875Devika Feature Agent save_code_to_project function path traversal9.1CISA ADP v3.10.3%2026-10-01
CVE-2026-51874Devika Patcher Agent save_code_to_project function path traversal7.5CISA ADP v3.10.3%2026-10-01
CVE-2026-51873Devika Coder.save_code_to_project function directory traversal8.8CISA ADP v3.10.7%2026-10-01
CVE-2026-48005Apache HTTP Server: Mod_auth_digest reauthentication attack7.5CISA ADP v3.10.6%2026-10-01Fix
CVE-2026-47360Apache HTTP Server: Mod_session: Session cookie not removed during internal redirect7.5CISA ADP v3.10.4%2026-10-01Fix
CVE-2026-46729Apache HTTP Server: Mod_heartmonitor denial of service7.5CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-42528Apache HTTP Server: Mod_dav shared lock overflow4.3CISA ADP v3.10.4%2026-10-01Fix
CVE-2026-42356Apache HTTP Server: Limited RCE for some internal redirects to non-CGI files in CGI directories3.7CISA ADP v3.10.5%2026-10-01Fix
CVE-2026-34494Johnson Controls Neo Series MVP2 On-Chip Debug Interface vulnerability7.2CNA v4.00.2%2026-10-01Fix
CVE-2026-34493Johnson Controls EasyIO FS32 On-Chip Debug Interface vulnerability7.2CNA v4.00.2%2026-10-01Fix
CVE-2026-34190Pandora FMS CSRF in Alert Command Deletion5.9CNA v4.00.2%2026-10-01
CVE-2026-34189Pandora FMS CSRF in Event Response Deletion5.9CNA v4.00.2%2026-10-01
CVE-2026-27874Johnson Controls EasyIO FS32 hard-coded credentials5.0CNA v4.00.1%2026-10-01Fix
CVE-2026-27873Johnson Controls EasyIO FG hard-coded credentials5.6CNA v4.00.1%2026-10-01Fix
CVE-2026-27872Johnson Controls EasyIO FG improper privilege management5.6CNA v4.00.1%2026-10-01Fix
CVE-2026-21833HCL AION is susceptible to a Missing Content-Security-Policy header vulnerability3.7CNA v3.10.2%2026-10-01
CVE-2026-19902Ad Inserter WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2026-10-01Fix
CVE-2026-19807ByteCoreStack WordPress plugin privilege escalation8.8CNA v3.10.4%2026-10-01Fix
CVE-2026-19253Cache Enabler cache_enabler_clear_page_cache_by_url vulnerability8.7CISA ADP v3.10.2%2026-10-01Fix
CVE-2026-18397SConnect: Native host unauthenticated remote code execution9.4CNA v4.00.3%2026-10-01Fix
CVE-2026-17053zephyrproject Zephyr SMBus driver missing authorization4.4CNA v3.10.1%2026-10-01Fix
CVE-2026-15989Super Forms WordPress plugin unauthenticated privilege escalation via role parameter9.8CNA v3.10.3%2026-10-01Exploit codeFix
CVE-2026-15983Super Forms WordPress plugin arbitrary File/Directory deletion via subdir / path parameter8.1CNA v3.10.5%2026-10-01Fix
CVE-2026-15911Confluent Kafka Python Improper TLS Certificate Validation7.4CNA v3.10.2%2026-10-01Exploit codeFix
CVE-2026-14995Autoptimize WordPress plugin unauthenticated stored cross-site scripting via REQUEST_URI path7.2CNA v3.10.3%2026-10-01Fix
CVE-2026-14984Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware29.4CNA v4.00.1%2026-10-01
CVE-2026-14983Missing authentication in Teledyne FLIR Robots running Aware27.1CNA v4.00.2%2026-10-01
CVE-2026-14316Fortra Core Privileged Access Manager heap buffer overflow in boks_sshd revoked-key error handling8.1CNA v3.10.2%2026-10-01Fix
CVE-2026-14157ASUS Router format string9.4CNA v4.00.8%2026-10-01
CVE-2026-13313ASUS Router certain ASUS active debug code8.9CNA v4.00.7%2026-10-01
CVE-2026-13043WatchGuard Endpoint Security Kernel Memory Access driver missing authentication9.3CNA v4.00.1%2026-10-01Fix
CVE-2026-12627Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow9.8CNA v3.10.4%2026-10-01
CVE-2026-12545Red Hat Satellite rubygem-hammer_cli: Command injection via insecure editor invocation6.7CNA v3.10.5%2026-10-01Fix
CVE-2026-12544Foreman: Ssti and insecure deserialization in foreman-rake configuration7.7CNA v3.10.2%2026-10-01Fix
CVE-2026-12542Red Hat Satellite foreman: Command injection in foreman-tail5.3CNA v3.10.6%2026-10-01Fix
CVE-2026-12541Foreman: Command injection in foreman-rake database tasks8.2CNA v3.11.2%2026-10-01Fix
CVE-2026-12540Foreman: Command injection in foreman-rake errors:fetch_log via request_id parameter8.2CNA v3.11.2%2026-10-01Fix
CVE-2026-12423Foreman: Unauthenticated information disclosure via provisioning token validation flaw7.5CNA v3.10.4%2026-10-01Fix
CVE-2026-12405Red Hat Satellite rubygem-foreman_remote_execution: Command injection in job invocations8.8CNA v3.11.5%2026-10-01Fix
CVE-2026-12241Advanced Woo Labels WordPress plugin unauthorized access5.4CNA v3.10.2%2026-10-01Fix
CVE-2026-9864Fortra BoKS Server agent adjoin machine-account password generation vulnerability4.8CNA v3.10.1%2026-10-01
CVE-2026-9032TP-Link Tapo C120 and C200 HTTPS onboarding connect request parser null pointer dereference7.1CNA v4.00.1%2026-10-01Fix
CVE-2026-8618TP-Link Systems Deco M9 Plus V2 TDDPv2 service stack-based buffer overflow7.7CNA v4.00.2%2026-10-01Fix
CVE-2026-7176Crocantickets Entradium custom form editor cross-site scripting4.8CNA v4.00.2%2026-10-01
CVE-2026-7175Crocantickets Entradium My Profile section cross-site scripting4.8CNA v4.00.2%2026-10-01
CVE-2026-7174Crocantickets Entradium discount_config endpoint stored cross-site scripting4.8CNA v4.00.3%2026-10-01
CVE-2026-7173Crocantickets Entradium cross-site scripting4.8CNA v4.00.3%2026-10-01