Skip to content
OpenAdvisories

Archive

28 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /28 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19443
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.4
    CVE-2026-118669 Public exploit

    OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

    OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an…

    oauthlib oauthlib oauthlib python-oauthlib Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2026-118650 Public exploit

    Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

    Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decod…

    labstack echo golang-github-labstack-echo golang-github-labstack-echo.v2 Ubuntu Go
  • High 7.7
    CVE-2026-100105 Public exploit

    Alerting contact point authorization bypass via schema downgrade

    A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

    Grafana Grafana OSS Grafana Enterprise grafana Web / CMS Alpine
  • High 7.1
    CVE-2026-115596 Public exploit

    WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Reflected XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.4.

    impleCode eCommerce Product Catalog
  • High 7.1
    CVE-2026-63286 Public exploit

    Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are st…

    Axis Communications AB AXIS Camera Station Pro AXIS Camera Station 5
  • High 8.8
    CVE-2026-109384 Public exploit

    The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload

    The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a …

    melograno The Innovative Form Builder – IvyForms Web / CMS
  • High 7.8
    CVE-2026-118378 Public exploit

    Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

    Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted conten…

    TabularisDB tabularis