Skip to content
OpenAdvisories

Archive

29 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /29 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19443
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.7
    CVE-2026-92744 Public exploit

    Delinea Privilege Manager agent unauthenticated remote code execution vulnerability

    Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.

    Delinea Privilege Manager
  • Medium 6.5
    CVE-2026-119200 Public exploit

    Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

    Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved pa…

    nuxt nuxt nitro-server nuxt npm
  • Low 3.7
    CVE-2026-118776 Public exploit

    Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node…

    Digital Bazaar forge python-tensorboard node-forge Ubuntu Azure Linux npm
  • Critical 10.0
    CVE-2026-84295 Public exploit

    Improper Authentication in Progress WS_FTP Server

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

    Progress Software WS_FTP Server
  • High 7.1
    CVE-2026-61989 Public exploit

    WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

    Merv Barrett Easy Property Listings
  • High 7.8
    CVE-2026-114148 Public exploit

    ASP.NET Core Elevation of Privilege Vulnerability

    Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

    Microsoft .NET 11.0 installed on Windows .NET 11.0 installed on Linux .NET 11.0 installed on Mac OS Linux Windows macOS Ubuntu Alpine
  • Critical 9.8
    CVE-2026-93680 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

    IBM Langflow OSS
  • High 8.8
    CVE-2026-107326 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-107327 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-107328 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-107329 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-110186 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-110200 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.

    IBM Langflow OSS
  • High 7.5
    CVE-2026-119025 Public exploit

    open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

    open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint valu…

    Model Context Protocol sindresorhus anomalyco inspector Ubuntu Azure Linux
  • High 8.5
    CVE-2026-115965 Public exploit

    WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2.

    BuddyPress BuddyPress
  • Medium 4.8
    CVE-2026-71569 Public exploit

    Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name

    Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not agree. A host written as an …

    Apache Software Foundation Apache Camel