Skip to content
OpenAdvisories

Archive

15 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /15 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.8
    CVE-2026-110922 Public exploit

    Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code…

    Google Chrome chromium Browsers Debian
  • Critical 9.0
    CVE-2026-111283 Public exploit

    BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

    BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can subm…

    BMC Helix BMC Helix Network Management
  • Critical 9.1
    CVE-2026-94134 Public exploit

    Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

    The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. A…

    Apache Software Foundation Apache Airflow SFTP provider Apache Airflow SSH provider
  • Critical 9.3
    CVE-2026-102764 Exploited Public exploit Scanner template EPSS 79%

    Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

    The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations…

    BeyondTrust Remote Support
    KEV Oct 16, 2026
  • Critical 10.0
    CVE-2026-110958 Public exploit

    Wavlink WN530HG4B api.cgi heap-based overflow

    A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made pu…

    WAVLINK WN530HG4B
  • Critical 9.9
    CVE-2026-57155 Public exploit

    OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to cons…

    opnsense core
  • High 7.1
    CVE-2026-53582 Public exploit

    OPNsense: XPATH Injection can disclose any secret in config.xml

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPN…

    opnsense core
  • Medium 6.7
    CVE-2026-110936 Exploited Public exploit

    A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application load…

    Siemens Siemens Software Center ICS / OT
    KEV Oct 20, 2026
  • Critical 9.3
    CVE-2026-99999 Public exploit

    ipv4: validate checksum_start before completing checksum

    In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-98432 Public exploit

    ipv4: free inet_opt and ireq_opt after an RCU grace period

    In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 6.4
    CVE-2026-17001 Public exploit

    Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields

    The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This…

    carazo Import and export users and customers Web / CMS
  • High 7.1
    CVE-2026-110912 Public exploit

    In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether…

    DragonFlyBSD DragonFlyBSD
  • Critical 9.8
    CVE-2026-104586 Public exploit

    AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.

  • High 7.5
    CVE-2026-36436 Public exploit

    An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative config…

  • Medium 5.0
    CVE-2026-78850 Public exploit

    An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / Site…

    matomo matomo Debian Ubuntu
  • Medium 6.5
    CVE-2026-78851 Public exploit

    Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive informat…