Archive
2 November 2026
Vulnerabilities first published on this day (UTC), newest first.
35 results · Clear filters · Feed
-
Critical 9.8CVE-2026-86596 Public exploit
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?'…
-
Critical 9.3
Authentication bypass in Secure Access Servers
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
-
Critical 9.4
CSRF in Secure Access Server v14.60
CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
-
Critical 9.8
In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to rem…
-
Critical 9.8
In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote c…
-
Critical 9.8
In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code …
-
Critical 9.8CVE-2026-58868 Public exploit
In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This co…
-
Critical 9.8
Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated att…
-
Critical 9.5
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that expos…
-
Critical 9.3
Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3
Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.
-
Critical 9.4
Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3
Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.
-
Critical 9.1
CVE-2026-120630
CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request that injects a malicious URL to perform SSRF, such as with the ScrapWebsi…
-
Critical 9.3
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which…
-
Critical 9.1
Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy
Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,
-
Critical 9.8
CVE-2026-16306
Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted `imodular:// UR…
-
Critical 9.1
Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller
SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference…
-
Critical 9.4CVE-2026-120446 Scanner template
madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/ten…
-
Critical 9.8CVE-2026-120442 Scanner template
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to …
-
Critical 9.1
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds o…
-
Critical 9.8
Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via …
-
Critical 9.8
Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security san…
-
Critical 9.1
Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.…
-
Critical 9.8
Apache Syncope: Remote Code Execution via Flowable JUEL expression
Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression…
-
Critical 9.3
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modifi…
KEV Nov 10, 2026 -
Critical 9.1
@fastify/http-proxy vulnerable to prefix escape via decoded route parameters
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream pa…
-
Critical 9.4
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful e…
-
Critical 10.0
WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is …
-
Critical 10.0
WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The …
-
Critical 9.9
Termix-SSH Termix transferToHost path traversal
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated rem…
-
Critical 10.0
Linksys E8450 portal.cgi strcpy stack-based overflow
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. Th…
-
Critical 9.9
WAVLINK WN536AX6-A protocol.csp host_black os command injection
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has bee…
-
Critical 10.0
WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launche…
-
Critical 10.0
WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injec…
-
Critical 10.0
WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can …
-
Critical 9.8
A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a…