Skip to content
OpenAdvisories

Archive

2 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /2 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-84411 Public exploit

    MikroTik RouterOS Integer Underflow

    The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution …

    MikroTik RouterOS Network devices
  • Critical 10.0
    CVE-2026-103956 Public exploit Scanner template

    Missing authentication for critical function in Loom for AWS

    Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration crede…

    AWS loom
  • Critical 9.5
    CVE-2026-104849 Public exploit

    Tinypool: Prototype Pollution Gadget to RCE in run() options

    Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace th…

    tinylibs tinypool tinypool npm
  • Critical 9.1
    CVE-2026-103648 Public exploit

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

    Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

    demsking image-downloader
  • Critical 9.9
    CVE-2026-90970 Public exploit EPSS 17%

    Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

    GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user wi…

    GitLab GitLab AI Gateway Web / CMS
  • Critical 9.8
    CVE-2026-94541 Public exploit

    WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

    The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes i…

    amauric WPMobile.App – Android and iOS App Builder Android iOS Web / CMS
  • Critical 9.8
    CVE-2026-19660 Public exploit

    Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

    The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN…

    Divi Engine Divi Membership Web / CMS
  • Critical 9.8
    CVE-2026-14378 Public exploit

    DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

    The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` coo…

    dplugins DevKit Pro Web / CMS