Skip to content
OpenAdvisories

Archive

5 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /5 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-105761 Public exploit

    Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

    Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied se…

    langgenius dify
  • High 7.3
    CVE-2026-102262 Public exploit

    Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

    Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim…

    Newell Brands DYMO ID
  • High 8.1
    CVE-2026-104905 Public exploit

    FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

    FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. A…

    NeoRazorX facturascripts
  • High 7.1
    CVE-2026-102282 Public exploit

    adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation

    adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passe…

    cthackers adm-zip adm-zip npm
  • High 8.5
    CVE-2026-63277 Public exploit

    RCE via calcext:data-mappings, sql provider and jdbc connector

    LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a link to be loaded from a remote location, so opening the document could run Java code from that l…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • High 7.5
    CVE-2026-105314 Public exploit

    Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload cal…

    papermerge Papermerge