Skip to content
OpenAdvisories

Archive

16 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /16 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-111823 Public exploit

    Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

    Mage mage-ai
  • High 8.8
    CVE-2026-102607 Public exploit

    ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature

    ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters whe…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu
  • High 7.7
    CVE-2026-59970 Public exploit

    Tandoor Recipes: Blind SSRF via AI provider URL (api_base)

    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an aut…

    Tandoor Recipes recipes
  • Critical 9.9
    CVE-2026-92262 Public exploit

    MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encod…

    MariaDB server mariadb-10.3 mariadb-10.0 Debian Ubuntu
  • Medium 5.3
    CVE-2026-110896 Public exploit

    WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.18.

    WP Chill Passster
  • Critical 10.0
    CVE-2026-94169 Public exploit Scanner template

    WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.

    ThemeOne The Grid
  • High 7.8
    CVE-2026-104715 Public exploit

    Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

    A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sa…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2026-89079 Public exploit Scanner template

    Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

    The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it pos…

    jfarthing84 Theme My Login Web / CMS
  • High 8.1
    CVE-2026-104745 Public exploit

    Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

    The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the `alg_wc_ev_verify_email` parameter in versions up to, and including, 3.3.0. The vulnerability exists because `alg_wc_ev_generate_user_code()` ge…

    wpcodefactory Customer Email Verification for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2026-111444 Public exploit

    Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent…

    Wheels Wheels python-wheel Azure Linux
  • High 7.7
    CVE-2026-111389 Public exploit

    Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

    Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafte…

    Frappe Technologies hrms
  • Medium 5.4
    CVE-2025-52097 Public exploit

    Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary …