CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- yeswikiYesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax6.9 Medium
- yeswikiYesWiki before 4.7.0 CSRF via despam Admin Action7.2 High
- yeswikiYesWiki before 4.7.0 Stored XSS via filtertags Action Parameters5.3 Medium
- yeswikiYesWiki before 4.7.0 Stored XSS via ImageField SVG Upload5.1 Medium
- grokability snipe-itSnipe-IT before 8.5.0 SAML Assertion Replay via Race Condition8.7 High
- grokability snipe-itSnipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()8.2 High
- grokability snipe-itSnipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback9.2 Critical
- grokability snipe-itSnipe-IT before 8.7.0 Missing Encryption via Api AssetsController store5.3 Medium
- edgelesssys contrastContrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection2.1 Low
- rcloneRclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url6.0 Medium
- rcloneRclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim7.0 High
- rcloneRclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback7.6 High
- rcloneRclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests6.9 Medium
- rclonerclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots8.2 High
- rcloneRclone before 1.75.2 Path Traversal via serve webdav MKCOL8.7 High
- rclonerclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect6.3 Medium
- rclonerclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS7.7 High
- rclonerclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow6.9 Medium
- rcloneRclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads6.1 Medium
- thorsten phpmyfaqphpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID8.7 High
- thorsten phpmyfaqphpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching5.3 Medium
- vllmvLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_ids7.1 High
- vllmvLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors8.3 High
- vllmvLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override8.7 High
- vllmvLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholders8.2 High
- vllmvLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass8.7 High
- vllmvLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector8.8 High
- vllmvLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions7.1 High
- vllmvLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate8.2 High
- vllmvLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_ids8.2 High
- vllmvLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n8.2 High
- siyuan-note siyuanSiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix5.9 Medium
- siyuan-note siyuanSiYuan before v3.8.7 SQL Injection via History Search op and query6.9 Medium
- siyuan-note siyuanSiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks5.1 Medium
- siyuan-note siyuanSiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool6.9 Medium
- siyuan-note siyuanSiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter7.6 High
- siyuan-note siyuanSiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting7.6 High
- parse-community parse-serverParse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB8.8 High
- parse-community parse-serverParse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes6.3 Medium
- parse-community parse-serverParse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses9.1 Critical
- parse-community parse-serverParse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login2.1 Low
- parse-community parse-serverParse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions6.0 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate4.8 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option4.8 Medium
- imagemagickImageMagick before 7.1.2-33 Memory Leak in magick compare2.0 Low
- imagemagickImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading4.8 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option4.8 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile6.9 Medium
- imagemagickImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit6.9 Medium
- imagemagickImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit2.0 Low
- Show moreLoading…