CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability6.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability8.5 High
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability5.4 Medium
- wp smart widgets better post & filter widgets for elementorWordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kevin weber lazy load for videosWordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- geesondog rhaphpgeesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery6.9 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability8.5 High
- ad inserter inserter, igor funa ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp smart widgets better post & filter widgets for elementorWordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability6.5 Medium
- magepeople inc. booking and rental managerWordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability5.3 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pgyer codefeverPGYER codefever URI Sanitizer doc.php _detail path traversal6.9 Medium
- villatheme bopo – woocommerce product bundle builderWordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability5.3 Medium
- kadence wp gutenberg blocks by kadence blocksWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins image gallery block – create and display photo gallery/photo album.WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp discussion board discussion boardWordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability5.3 Medium
- zuinq studio ismygymReflected Cross-Site Scripting in software IsMyGym by Zuinq Studio5.1 Medium
kubernetes-oldSUSESecurity update for kubernetes-oldNo score- rathena fluxcprathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation6.9 Medium
- bizerba brain2Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files4.4 Medium
- No product listedDedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection6.9 Medium
- regional parliament of castile-la mancha video library of the regional parliament of castile-la manchaReflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha5.1 Medium
- oray pugongying x5 proOray Pugongying X5 Pro Dnsmasq crlf injection9.3 Critical
runcSUSESecurity update for runcNo score- oray pugongying x5 proOray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload8.6 High
- rt-labs ab soemMultiple Out-of-Bounds Reads in Frame Processing7.1 High
- implem inc. pleasanterPleasanter provided fails to properly verify passwords in LDAP authentication when processing...6.9 Medium
- rt-labs ab soemNull Pointer Dereference in Mailbox Error Handling6.5 Medium
- rt-labs ab soemMemory Corruption via FMMU Configuration Table Overflow6.5 Medium
- apache camelApache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)5.4 Medium
- rt-labs ab soemBuffer Overflow in CoE SDO Upload Multi-Segment Data Transfers8.8 High
- andy ha departWordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability4.3 Medium
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- jordy meow ai engineWordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability4.3 Medium
- oray pugongying x5 proOray Pugongying X5 Pro L2TP Authentication crlf injection9.4 Critical
- apache camelApache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory5.4 Medium
- apache camelApache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry4.8 Medium
- rt-labs ab soemOut-of-Bounds Read via Unchecked Length Values6.5 Medium
- apache camelApache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions5.4 Medium
- apache camelApache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions5.3 Medium
- misp misp-guardMISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules7.7 High
- rt-labs ab soemMemory Corruption via Integer Underflow in Message Length Validation8.3 High
- oray pugongying x5 proOray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection9.4 Critical
- oray pugongying x5 proOray Pugongying X5 Pro Dnsmasq crlf injection9.4 Critical
- opnsense firewallMultiple cross-site scripting (XSS) in OPNsense5.6 Medium
- oray pugongying x5 proOray Pugongying X5 Pro SNMP snmp_set crlf injection9.4 Critical
- Show moreLoading…