Skip to content
OpenAdvisories

Archive

9 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /9 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19443
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2026-62367 Public exploit

    Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

    Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+…

    go-vikunja vikunja code.vikunja.io/api Go
  • High 8.0
    CVE-2026-107821 Public exploit

    MariaDB: insufficient validation of binary frm data when opening a table

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM fi…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • High 8.8
    CVE-2026-55797 Public exploit

    Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured wit…

    argoproj Argo CD argo-cd-3.2-compat argo-cd-3.2 Wolfi Go
  • High 7.2
    CVE-2026-104082 Public exploit

    SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount

    SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary Fil…

    SmarterTools SmarterMail
  • High 7.1
    CVE-2026-94641 Public exploit

    WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

    Stiofan UsersWP