Skip to content
OpenAdvisories

Archive

10 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /10 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-108598 Public exploit

    Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates

    Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template…

    floci-io floci
  • Medium 5.3
    CVE-2026-108592 Public exploit

    mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

    mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make…

    SWE-agent mini-swe-agent
  • Critical 9.8
    CVE-2026-106610 Public exploit

    WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

    miniOrange miniorange otp verification
  • Critical 9.8
    CVE-2026-108551 Public exploit

    openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

    openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a s…

    ferdikoomen openapi-typescript-codegen
  • High 7.5
    CVE-2026-91136 Public exploit Scanner template

    Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

    The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback …

    Divi Essential Divi Plus Web / CMS
  • Critical 9.8
    CVE-2026-103889 Public exploit

    3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

    The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_load…

    expivi 3D Product configurator for WooCommerce Web / CMS