Skip to content
OpenAdvisories

Archive

30 October 2026

Vulnerabilities first published on this day (UTC), newest first.

← September 2026 2026 / October /30 November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14824
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19444
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 7.9
    CVE-2026-62958 Public exploit

    libriscv: Out of bounds read vuln in the ELF parser (Denial of service)

    libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-hea…

    libriscv libriscv
  • High 8.2
    CVE-2026-116244 Public exploit

    pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

    When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account r…

    pgadmin.org pgAdmin 4
  • Critical 9.3
    CVE-2026-39732 Public exploit

    WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

    Ivijan-Stefan Stipic Transliterator
  • Critical 10.0
    CVE-2026-112816 Public exploit

    Improper certificate validation in the HTTPS listener in LXD

    Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed v…

    Canonical LXD lxd Debian
  • Medium 6.3
    CVE-2026-104623 Public exploit

    Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster

    A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possible olde…

    SUSE Rancher
  • Medium 6.4
    CVE-2026-119712 Public exploit

    PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents

    PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTM…

    pipeshub-ai pipeshub-ai
  • High 7.2
    CVE-2026-118238 Public exploit

    CVE-2026-118238

    The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validation of JSON fields. An authenticated user can inject shell metacharacters into the protocol or targetDevice fields, whi…

    Tenda W18E
  • Critical 9.5
    CVE-2026-116366 Public exploit Scanner template

    Unauthenticated RCE vulnerability against ClickHouse Server

    An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

    ClickHouse ClickHouse ClickHouse Cloud clickhouse Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2026-103039 Public exploit

    Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field

    The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unr…

    Gravity Forms Gravity Forms Web / CMS
  • Medium 4.3
    CVE-2026-107268 Public exploit

    Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, fro…

    Drupal Two Factor Authentication - TFA / Passwordless Login drupal/miniorange_2fa Packagist
  • High 8.1
    CVE-2026-108097 Public exploit

    Drupal core - Critical - Remote code execution - SA-CORE-2026-014

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.4
    CVE-2026-118569 Public exploit

    Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282

    Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • Medium 6.5
    CVE-2026-118570 Public exploit

    Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.

    Drupal Fasttoggle drupal/fasttoggle Packagist
  • High 7.5
    CVE-2026-117183 Public exploit

    A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape th…

  • High 7.5
    CVE-2026-117184 Public exploit

    An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a craf…

  • Medium 5.4
    CVE-2026-117182 Public exploit

    An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 al…