Skip to content
OpenAdvisories

Archive

21 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /21 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.7
    CVE-2026-96778 Public exploit

    Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

    Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte b…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.8
    CVE-2026-114140 Public exploit

    nbconvert: File write via path traversal in cell output filenames

    The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata f…

    jupyter nbconvert kubeflow-pipelines-visualization-server nbconvert Debian Ubuntu Wolfi PyPI
  • High 7.8
    CVE-2026-92183 Public exploit

    GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

    GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that …

    GIMP GIMP gimp gimp Debian Ubuntu
  • High 7.8
    CVE-2026-92209 Public exploit

    NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability

    NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code…

    NoMachine NoMachine
  • High 8.8
    CVE-2026-92208 Public exploit

    NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability

    NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.…

    NoMachine NoMachine
  • High 8.1
    CVE-2026-94300 Public exploit

    Concurrent GSS-TSIG messages corrupt memory

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…

    ISC BIND 9 bind9 bind9 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-97206 Public exploit

    DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

    NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh…

    NLnet Labs Unbound unbound unbound Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-110899 Public exploit

    WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.

    Kevin Stover Ninja Forms
  • High 7.5
    CVE-2026-114102 Public exploit

    adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event

    adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a…

    cthackers adm-zip adm-zip npm