CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- imagemagickImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path6.9 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder6.3 Medium
- imagemagickImageMagick before 7.1.2-33 Memory Leak in FPX Encoder2.3 Low
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images7.2 High
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options4.8 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder6.3 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder6.3 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix1.8 Low
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder4.8 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders4.8 Medium
- imagemagickImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box4.8 Medium
- imagemagickImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder6.9 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing4.8 Medium
- wwbn avideoWWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering5.1 Medium
- linkstackorg linkstackLinkStackOrg LinkStack cross-site request forgery5.3 Medium
- cthackers adm-zipadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names6.3 Medium
- projectsendProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking6.0 Medium
- leon-ai leonLeon before commit 50df142 Path Traversal via /download model Command6.9 Medium
- docile-alligator infinity for redditInfinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity5.3 Medium
- rotkirotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption8.2 High
- dqzboy docker-proxyDocker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config6.9 Medium
- albert-weasker niubigeoNiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field6.9 Medium
- dokployDokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router8.7 High
- ananthakumaran paisaPaisa before 0.7.8 Path Traversal via Editor and Sheet API8.8 High
- firecrawlFirecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service7.0 High
- krupalshah employee recruitment systemkrupalshah Employee Recruitment System Registration registerform3.php sql injection6.9 Medium
- krupalshah employeerecruitmentsystemkrupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection6.9 Medium
- krupalshah employeerecruitmentsystemkrupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection6.9 Medium
- privoce vocechatPrivoce Vocechat Query Parameter widget.html cross site scripting5.3 Medium
- eventcatalog sdkeventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal4.8 Medium
- 1999azzar designer-mcp1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal5.3 Medium
- unknown duplicatorDuplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade7.2 High
- unknown datawiza proxy auth pluginDatawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers9.8 Critical
- qodeinteractive qi addons for elementorQi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget2.4 Low
- instawp connect, unknown instawp connect +1 moreInstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings3.1 Low
- unknown wpvrWP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR2.7 Low
- unknown wpvrWP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR3.8 Low
- unknown wpvrWP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard4.9 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses2.7 Low
- stellarwp givewpGiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant5.5 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color6.8 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import6.0 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route5.3 Medium
- unknown chikkili- google pay india for woocommerceChikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature5.3 Medium
- unknown wp stripe checkoutWP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret5.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.8.0 - Admin+ Stored XSS3.5 Low
- prasathmani tinyfilemanagerprasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload5.3 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication6.3 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication6.9 Medium
- onyx-dot-app onyxonyx-dot-app Onyx PreviewTab.tsx cross site scripting5.1 Medium
- Show moreLoading…