Skip to content
OpenAdvisories

Archive

6 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /6 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-106445 Public exploit

    Handlebars: JavaScript Injection via Own Property Check Bypass

    Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of F…

    handlebars-lang handlebars.js renovate prism Debian Ubuntu Wolfi npm
  • Critical 9.3
    CVE-2026-105844 Public exploit

    Payload: Prototype pollution in Payload Import Export plugin

    Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user can submit prototype-sensitive field paths when @payloadcms/plugin-import-export is …

    Payload CMS payload plugin-import-export @payloadcms/plugin-import-export npm
  • Critical 10.0
    CVE-2026-105484 Public exploit

    TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

    A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name …

    Toto Link X6000R