Skip to content
OpenAdvisories

Archive

22 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /22 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19443
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.2
    CVE-2026-104068 Public exploit

    JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

    JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup …

    JetBackup JetBackup Web / CMS
  • High 7.5
    CVE-2026-113872 Public exploit

    multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

    multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while o…

    multer multer multer node-multer Debian npm
  • High 7.5
    CVE-2026-114656 Public exploit

    Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher

    Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by Requ…

    traefik traefik traefik-3.6 Wolfi
  • High 8.1
    CVE-2026-51954 Public exploit

    An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth …