Skip to content
OpenAdvisories

Archive

23 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /23 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-115893 Public exploit

    Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

    Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. …

    bytecodealliance wasmtime rust wasmtime Debian Ubuntu Azure Linux Wolfi crates.io
  • Critical 9.9
    CVE-2026-115889 Public exploit

    Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

    Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with ma…

    bytecodealliance wasmtime rust wasmtime Debian Ubuntu Azure Linux crates.io
  • High 7.4
    CVE-2026-106069 Public exploit

    A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.3
    CVE-2026-106073 Public exploit

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.6
    CVE-2026-106071 Public exploit

    A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.7
    CVE-2026-106070 Public exploit

    A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after t…

    Node.js node nodejs nodejs Ubuntu Alpine Wolfi
  • Medium 6.7
    CVE-2026-106072 Public exploit

    A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.8
    CVE-2026-106074 Public exploit

    A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-105483 Public exploit

    A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2026-105481 Public exploit

    A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.4
    CVE-2026-105482 Public exploit

    A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-57845 Public exploit

    Hugging Face Datasets < 5.2.0 Pickle Deserialization RCE via Pandas Builder

    Hugging Face Datasets before 5.2.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pick…

    Hugging Face datasets
  • High 7.2
    CVE-2026-39902 Public exploit

    Cacti: Authenticated RCE on Data Input

    Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_str…

    Cacti cacti cacti cacti Debian Ubuntu
  • Critical 9.8
    CVE-2026-53921 Public exploit

    odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

    odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to n…

    openwrt odhcpd
  • Unscored —
    CVE-2026-98937 Public exploit

    perf/core: Check kernel access when kernel callchains are requested

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-93489 Public exploit

    Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge …

    ASUS Router
  • High 7.5
    CVE-2026-50787 Public exploit

    e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/…