CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- zylon privategptZylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery6.9 Medium
- mansi-k restaurant imsmansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection6.9 Medium
- pig-mesh pigpig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection5.3 Medium
- unitree robotics go2, unitreerobotics unitree go2 +1 moreUnitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation6.3 Medium
- unitree robotics go2, unitreerobotics unitree go2 +1 moreUnitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection9.4 Critical
- No product listedphpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting5.3 Medium
- No product listedphpIPAM index.php cross site scripting4.8 Medium
container-suseconnectSUSESecurity update for container-suseconnectNo scorekubernetesSUSESecurity update for kubernetesNo score@babel/templateTuxCare,@babel/cliTuxCare,@babel/helpersTuxCare +2 moreTuxCare security update for @babel/template (1 CVE)No score- oracle corporation graalvm enterprise edition, graalvm for jdk, java se +2 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...9.1 Critical
- faveosuite faveo helpdeskFaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery6.9 Medium
- faveosuite faveo helpdeskFaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization6.9 Medium
- travisun opptrixTravisun Opptrix preParsing handler webhook Buffer.concat denial of service6.9 Medium
- travisun opptrixTravisun Opptrix Import Endpoint import code injection6.9 Medium
- travisun opptrixTravisun Opptrix Schedule API setup command injection6.9 Medium
- gitroomhq postiz-appForged signed tokens let any registered user take over other users and organizations9.9 Critical
- python software foundation cpythonDistrust compromised intermediate certificates in ssl module9.4 Critical
- christoph vielgrader relevanssiWordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability7.2 High
- magepeople inc. wpeventlyWordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability6.5 Medium
- knit pay upi qr code payment gateway for woocommerceWordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability7.5 High
libweb-simple-perlDebianWeb::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters7.5 High- gitroomhq postiz-appPath traversal in post media lets any registered user read server files9.6 Critical
skiplistcrates.ioUse-after-free from a comparator that answers inconsistently6.3 Mediumskiplistcrates.ioAliasing violations in splice, mutable iteration and cursors2.1 Low- bookstackapp bookstackBookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages5.3 Medium
- getgrav gravGrav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives8.7 High
- onearmy community-platformONEARMY community-platform before 2.165.2 IDOR via notification read endpoint5.3 Medium
- xinnan-tech xiaozhi-esp32-serverXiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint5.3 Medium
- yunaiv yudao-cloudyudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header7.1 High
- yunaiv yudao-cloudyudao-cloud through 2026.09 IDOR via after-sale-log list endpoint5.3 Medium
- o6 automation gmbh open62541open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType9.2 Critical
- openresty lua-resty-dnsOpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing6.3 Medium
- nationalsecurityagency ghidraGhidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser2.0 Low
- crowcpp crowCrow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load()8.7 High
- francoisjacquet rosariosisRosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers5.3 Medium
- owen2345 camaleon-cmsCamaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action8.7 High
- bottelet daybydaycrmDaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign5.3 Medium
- kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builderaBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute8.8 High
libio-compress-brotli-perlDebian[Unknown description]No score- quadlayers wp social feed galleryWordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability6.5 Medium
- cervantessec cervantesIDOR: User reads and modifies findings from other people's projects4.3 Medium
- ad inserter inserter, igor funa ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cervantessec cervantesBOLA Allows Cross-Project Target Tampering5.4 Medium
- cervantessec cervantesStored XSS in the “Notes” field of project checklists6.8 Medium
- infomaniak network vod infomaniakWordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- pixelite events managerWordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- david de boer paytiumWordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability9.8 Critical
- quarka qa analyticsWordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- plugins360 all-in-one video galleryWordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…