Archive
October 2026
Vulnerabilities first published in this month (UTC), newest first.
17,198 results · Feed
-
Medium 6.1
WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-…
-
High 8.2
Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)
Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by `XmlFacto…
-
Medium 5.3
WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attack…
-
Medium 5.9
Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a pat…
-
None 0.0
asn1c: ASAN crash with decode of open types
mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get…
-
High 7.5
AdminNeo: version-cache array injection causes persistent denial of service
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `…
-
Medium 5.3
Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/ser…
-
Medium 6.5
NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to c…
-
Medium 6.5
Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check
A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDV…
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-boun…
-
Medium 6.3
Crass: Non-ASCII characters cause superlinear CPU consumption
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` result in superlinear p…
-
Medium 6.3
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An att…
-
Medium 6.3
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or …
-
High 8.9
Crass: Large numeric exponents cause CPU and memory denial of service
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use…
-
High 7.5
OpenAM Authentication Bypass via RADIUS Spoofing
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify t…
-
Medium 6.5
Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an inv…
-
Medium 6.5
Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of p…
-
High 7.5
PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key` authentic…
-
High 8.8
WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
-
High 7.2
WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
-
High 8.8
WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
-
High 7.5
WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
-
High 7.5
WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
-
Medium 6.5
WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
-
Medium 6.5
WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
-
High 7.1
WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
-
Critical 9.1
WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
-
High 7.1
WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.
-
Medium 6.5
WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
-
High 7.1
WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
-
High 7.5
WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
-
Critical 9.8
WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
-
Medium 6.5
WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
-
Medium 5.0
WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.
-
Medium 6.5
WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.
-
Medium 5.3
WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
-
High 7.1
WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
-
High 7.1
WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
-
Critical 9.8
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
-
High 8.8
WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.