Skip to content
OpenAdvisories

Archive

October 2026

Vulnerabilities first published in this month (UTC), newest first.

← September 2026 2026 / October November 2026 →
  1. 1400
  2. 2405
  3. 3114
  4. 464
  5. 5421
  6. 61017
  7. 7330
  8. 8492
  9. 9332
  10. 10412
  11. 11234
  12. 12683
  13. 132293
  14. 14825
  15. 15550
  16. 16480
  17. 17100
  18. 18552
  19. 19443
  20. 201925
  21. 21549
  22. 22488
  23. 23502
  24. 2476
  25. 25133
  26. 26768
  27. 27629
  28. 28636
  29. 29544
  30. 30688
  31. 31113
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-118776 Public exploit

    Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node…

    Digital Bazaar forge python-tensorboard node-forge Ubuntu Azure Linux npm
  • Low 3.7
    CVE-2026-116105 Public exploit

    HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission

    A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive informa…

  • Low 3.5
    CVE-2026-116004 Public exploit

    onyx-dot-app Onyx PreviewTab.tsx cross site scripting

    A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remo…

    onyx-dot-app onyx
  • Low 3.6
    CVE-2026-116012 Public exploit

    Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser

    Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sl…

    National Security Agency ghidra
  • Low 3.3
    CVE-2026-106073 Public exploit

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.6
    CVE-2026-106071 Public exploit

    A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.7
    CVE-2026-106070 Public exploit

    A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after t…

    Node.js node nodejs nodejs Ubuntu Alpine Wolfi
  • Low 3.5
    CVE-2026-105950 Public exploit

    getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

    A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument…

    getformwork Formwork