CVEs published in October 2026
17,265 vulnerabilities, 1,617 critical, 20 exploited.
- No product listed XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder No score
- ken678 yzncms ken678 YznCMS Auth Group Group.php Backend privileges management 5.1 Medium
- apache software foundation thrift Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default 8.2 High
- apache software foundation mina Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder 9.8 Critical
- microsoft visual studio 2017 version 15.9, visual studio 2019 version 16.11, visual studio 2022 version 17.14 +1 more +3 more Visual Studio Spoofing Vulnerability 7.4 High
- ffmpeg FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path 5.3 Medium
- anji-plus aj-report AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token 9.3 Critical
- strukturag libheif libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder 7.7 High
- thelia page module Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes 7.0 High
- thelia, thelia back-office default template, back-office default twig template +2 more +4 more Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions 5.9 Medium
- thelia, thelia core +1 more Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name 7.4 High
- deepseek-ai deepinfer DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter 6.3 Medium
- showdoc ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates 8.7 High
- highflame-ai ramparts Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc 7.1 High
- dromara jpom Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header 9.3 Critical
- gnmyt nexterm Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes 5.3 Medium
- learnhouse LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API 5.3 Medium
- opengear acm7000, cm7100, im7200 +2 more Pre-Auth Heap Buffer Overflow in the Multipart Request 8.4 High
- No product listed WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page 7.5 High
- No product listed WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages 9.8 Critical
- No product listed WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting 6.1 Medium
- No product listed WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback 9.8 Critical
- No product listed WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes 5.4 Medium
-
ant-releasescrates.io `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip) 8.2 High -
codeqcrates.io `codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service) 5.3 Medium - shamalli web 2.0 directory plugin for wordpress Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter 6.5 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +4 more +6 more Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 High
- gnome epiphany epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install 5.5 Medium
- gnome epiphany epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access 6.5 Medium
- themehigh woocommerce extra product options pro WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter 6.1 Medium
- qriouslad debug log manager – conveniently monitor and inspect errors Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint 7.2 High
- vendidero germanized for woocommerce Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change 4.3 Medium
- wppool flexstock – product stock sync with google sheets for woocommerce FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint 6.4 Medium
- boss media buddyboss platform BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name 6.4 Medium
- wpdirectorykit wp directory kit WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter 7.5 High
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter 6.1 Medium
- smub photo gallery, sliders, proofing and themes – nextgen gallery Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal 8.8 High
- paoltaia geodirectory – wp business directory plugin and classified listings directory GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection 6.4 Medium
- No product listed Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone 8.0 High
- No product listed Konflux-ci: remote code execution via eval() in manifest scripts 8.4 High
- No product listed Konflux-ci: jq filter injection in github workflow issue management 8.8 High
- No product listed Konflux-ci: github token plaintext exposure in ci/cd scripts 8.6 High
- radgeek feedwordpress FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content 7.2 High
- contrid newsletters Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter 5.3 Medium
- melapress wp activity log WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting 7.2 High
- shapedplugin smart post – post grid, post carousel, post slider gutenberg blocks for blog & news Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block 6.4 Medium
- acadlix lms – ai quiz maker, online exam & course plugin for wordpress Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter 9.1 Critical
- wpazleen simpleform – form maker to chat apps with quiz, poll and multi lead notifications SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data 9.8 Critical
- smub all in one seo – ai seo plugin to boost seo rankings & traffic (schema, local seo, sitemap & seo insights) All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter 5.3 Medium
- ameliabooking booking for appointments and events calendar – amelia Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter 5.3 Medium
- Show olderLoading…