Skip to content
OpenAdvisories

Archive

5 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /5 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-21589 Exploited Public exploit Scanner template EPSS 100%

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Sof…

    Atlassian Confluence Data Center Jira Service Management Data Center Bitbucket Data Center Web / CMS
    KEV Oct 15, 2026
  • Critical 9.9
    CVE-2026-105697 Public exploit

    Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

    Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c…

    langflow-ai langflow langflow-base lfx PyPI
  • Critical 9.8
    CVE-2026-104711 Public exploit

    Apache Struts: OGNL injection in the legacy RESTful action mapper

    Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OG…

    Apache Software Foundation Apache Struts
  • Critical 9.3
    CVE-2026-102428 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

    ordasoft.com OrdaSoft Joomla CCK Web / CMS