Skip to content
OpenAdvisories

Archive

7 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /7 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-107284

    AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invali…

    AsyncHttpClient async-http-client async-http-client async-http-client Debian Ubuntu
  • Low 3.7
    CVE-2026-107283

    AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, Realm.Builder generates the HTTP Digest client nonce with ThreadLocalRandom rather than a cryptog…

    AsyncHttpClient async-http-client async-http-client async-http-client Debian Ubuntu Maven
  • Low 3.7
    CVE-2026-107269

    Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

    Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bc…

    gophish gophish
  • Low 2.9
    CVE-2026-107170

    M17n-lib: null dereference in minput_open_im() after failed m17n_init()

    A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Low 2.1
    CVE-2026-78243

    Apache YuniKorn: LDAP Group provider panics on lowercase attribute name

    Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the …

    Apache Software Foundation Apache YuniKorn
  • Low 2.0
    CVE-2026-92393

    Apache YuniKorn: Admission control bypass via workload UPDATE operation

    Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemon…

    Apache Software Foundation Apache YuniKorn
  • Low 2.7
    CVE-2026-104678

    CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update

    The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change …

    Web / CMS