Skip to content
OpenAdvisories

Archive

14 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /14 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 8.1
    CVE-2026-103977 Public exploit

    FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

    FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credent…

    error311 FileRise
  • High 8.5
    CVE-2026-0322 Exploited Public exploit

    PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

    A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by thi…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
    KEV Oct 14, 2026
  • High 7.7
    CVE-2026-91159 Public exploit

    Discourse: Stored oEmbed HTML injection via allowed iframe

    Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured al…

    Discourse Discourse
  • High 7.0
    CVE-2026-53613 Public exploit

    util-linux mount target TOCTOU allows local privilege escalation

    util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before…

    util-linux util-linux util-linux util-linux Linux Debian Ubuntu Azure Linux Alpine
  • High 8.1
    CVE-2026-97205 Public exploit

    NGINX ngx_http_core_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.1
    CVE-2026-15176 Public exploit

    NGINX ngx_http_core_module vulnerability

    A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-73802 Public exploit

    Gitea Runner host isolation bypass through container options

    Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being f…

    Gitea Gitea Runner gitea.com/gitea/runner Go
  • High 8.4
    CVE-2026-86476 Public exploit

    Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

    A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-che…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2026-92392 Public exploit

    HTTP/2 upload Use-After-Free

    During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi