Archive
October 2026
Vulnerabilities first published in this month (UTC), newest first.
123 results · Clear filters · Feed
-
Critical 9.8CVE-2026-101767 Public exploit
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported …
-
Critical 9.2CVE-2026-112900 Public exploit
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe abso…
-
Critical 9.2CVE-2026-112403 Public exploit
Pillow: Heap buffer overflow in ImagingJpegDecode
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is re…
-
Critical 9.2CVE-2026-112398 Public exploit
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode c…
-
Critical 9.8CVE-2026-111058 Public exploit
Mercury: Unauthenticated Remote Code Execution via /api/kernels
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The …
-
Critical 10.0CVE-2026-78162 Public exploit
Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)
Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it …
-
Critical 9.8CVE-2026-107083 Public exploit
SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/…
-
Critical 9.8CVE-2026-107081 Public exploit
SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/…
-
Critical 9.8
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through …
-
Critical 9.8CVE-2026-111823 Public exploit
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
-
Critical 9.9CVE-2026-92262 Public exploit
MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encod…
-
Critical 10.0
WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
-
Critical 9.8
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it pos…
-
Critical 9.8CVE-2026-111444 Public exploit
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent…
-
Critical 9.0CVE-2026-111283 Public exploit
BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can subm…
-
Critical 9.1CVE-2026-94134 Public exploit
Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. A…
-
Critical 9.3
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations…
KEV Oct 16, 2026 -
Critical 10.0CVE-2026-110958 Public exploit
Wavlink WN530HG4B api.cgi heap-based overflow
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made pu…
-
Critical 9.9CVE-2026-57155 Public exploit
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to cons…
-
Critical 9.3CVE-2026-99999 Public exploit
ipv4: validate checksum_start before completing checksum
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…
-
Critical 9.8CVE-2026-98432 Public exploit
ipv4: free inet_opt and ireq_opt after an RCU grace period
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…
-
Critical 9.8CVE-2026-104586 Public exploit
AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.
-
Critical 9.8
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email…
KEV Oct 14, 2026 -
Critical 9.8
Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea ser…
-
Critical 9.8CVE-2026-110634 Public exploit
git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions tha…
-
Critical 9.8CVE-2026-104748 Public exploit
SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the `wp_ajax_nopriv_simpleform_wp_register` AJAX actio…
-
Critical 9.2
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code executio…
KEV Oct 23, 2026 -
Critical 9.8CVE-2026-97657 Public exploit
Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recove…
-
Critical 9.8CVE-2026-105016 Public exploit
Microsoft QUIC Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
-
Critical 10.0CVE-2026-103849 Public exploit
Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the vict…
-
Critical 9.4CVE-2026-106173 Public exploit
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.…
-
Critical 9.4CVE-2026-105445 Public exploit
Docker Hub account conversion could reassign an active personal access token to another user
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the …
-
Critical 10.0
Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…
KEV Oct 29, 2026 -
Critical 9.8CVE-2026-104584 Public exploit
reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Co…
-
Critical 9.8CVE-2026-104585 Public exploit
Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic A…
-
Critical 9.8CVE-2026-37107 Public exploit
An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php co…
-
Critical 9.8CVE-2026-109566 Public exploit
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the …
-
Critical 9.8CVE-2026-108598 Public exploit
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template…
-
Critical 9.8CVE-2026-106610 Public exploit
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
-
Critical 9.8CVE-2026-108551 Public exploit
openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a s…