Skip to content
OpenAdvisories

Archive

26 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /26 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-110720 Public exploit

    Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

    Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and…

    HashiCorp Tooling
  • Critical 10.0
    CVE-2026-115905 Public exploit

    zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

    zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling th…

    zip-rs zip2 rust superset-6.1 Debian Ubuntu Azure Linux Wolfi crates.io
  • Critical 9.3
    CVE-2026-93328 Public exploit

    Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

    Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storag…

    Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)
  • Critical 9.1
    CVE-2026-116214 Public exploit

    MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

    MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via use…

    magicblack maccmspro MacCMS10 maccms10
  • Critical 9.8
    CVE-2026-31158 Public exploit

    SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbi…

  • Critical 9.8
    CVE-2026-107092 Public exploit

    NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.