Archive
October 2026
Vulnerabilities first published in this month (UTC), newest first.
382 results · Clear filters · Feed
-
Critical 9.2
Laravel TokenGuard authentication bypass through non-string API credentials
Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can matc…
-
Critical 9.1CVE-2026-91403 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.7CVE-2026-96778 Public exploit
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte b…
-
High 8.8CVE-2026-114140 Public exploit
nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata f…
-
High 7.8CVE-2026-92183 Public exploit
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that …
-
High 7.8CVE-2026-92209 Public exploit
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code…
-
High 8.8CVE-2026-92208 Public exploit
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability
NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability.…
-
Critical 9.8CVE-2026-76466 Public exploit
Cisco Expressway Series Remote Code Execution Vulnerability
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due …
-
Critical 9.2
RCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…
KEV Oct 26, 2026 -
Critical 9.2
RCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…
KEV Oct 26, 2026 -
High 8.1CVE-2026-94300 Public exploit
Concurrent GSS-TSIG messages corrupt memory
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker…
-
High 7.5CVE-2026-97206 Public exploit
DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.
NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh…
-
High 7.1CVE-2026-110899 Public exploit
WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
-
Medium 6.8CVE-2026-111943 Public exploit
Distrust compromised intermediate certificates in crypto/x509
On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…
-
Medium 4.0CVE-2026-114101 Public exploit
Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''…
-
High 7.5CVE-2026-114102 Public exploit
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a…
-
Critical 9.8CVE-2026-101767 Public exploit
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported …
-
Medium 4.3CVE-2026-101678 Public exploit
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is a…
-
Medium 4.8CVE-2026-107692 Public exploit
War Thunder Account Impersonation
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and d…
-
High 7.2CVE-2026-92162 Public exploit
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured (most common on Fedora systems), a malicious local user in an active local ses…
-
Medium 6.1CVE-2026-112936 Public exploit
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who ca…
-
Medium 6.9CVE-2026-112071 Public exploit
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the…
-
Medium 6.9CVE-2026-113468 Public exploit
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. Thi…
-
High 7.5CVE-2026-93300 Public exploit
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the ex…
-
High 7.1CVE-2026-113386 Public exploit
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated a…
-
Medium 5.5CVE-2026-86962 Public exploit
A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS…
-
Critical 9.2CVE-2026-112900 Public exploit
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe abso…
-
Critical 9.2CVE-2026-112403 Public exploit
Pillow: Heap buffer overflow in ImagingJpegDecode
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is re…
-
Critical 9.2CVE-2026-112398 Public exploit
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode c…
-
High 8.2CVE-2026-53995 Public exploit
MLflow 3.17.1 and prior Path Traversal via Trace ID API
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/t…
-
High 8.5CVE-2026-105810 Public exploit
Authenticated Local Stack Overflow in TP-Link Tapo C320WS
Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite…
-
Medium 4.7CVE-2026-112195 Public exploit
FusionPBX Dialplan Editor dialplan.php os command injection
A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The a…
-
Critical 9.8CVE-2026-111058 Public exploit
Mercury: Unauthenticated Remote Code Execution via /api/kernels
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The …
-
Medium 5.4CVE-2026-112222 Public exploit
WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
-
High 8.8CVE-2026-88900 Public exploit
Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution
Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. JGroupsEndpoint.createExchange(Message), which CamelJGroupsReceiver calls for every …
-
Medium 6.5CVE-2026-91858 Public exploit
Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's …
-
High 8.2CVE-2026-88901 Public exploit
Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component (camel-smo…
-
Medium 4.8CVE-2026-85317 Public exploit
Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache
Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several o…
-
Medium 4.8CVE-2026-85316 Public exploit
Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching
Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The component decided whether an endpoint ran in proxy mode by testing whet…
-
Medium 5.3CVE-2026-85315 Public exploit
Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. When a route behind a gRPC consumer failed, the exception's messag…