CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- dolibarrDolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field7.2 High
- francoisjacquet rosariosisRosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php5.3 Medium
- maccmspro maccms10MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment6.9 Medium
- maccmspro maccms10MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption2.3 Low
- maccmspro maccms10MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code9.3 Critical
- webasyst frameworkWebasyst Framework through 4.4.0 Arbitrary File Read via waArchiveTar Symlinks6.9 Medium
- webasyst frameworkWebasyst Framework through 4.4.0 Stored XSS via Photos Album URL5.1 Medium
- webasyst frameworkWebasyst Framework through 4.4.0 Photos App CSRF via Backend Actions7.1 High
- No product listedKameleo Profile Controller t.cs ListProfiles information disclosure4.8 Medium
- qtOut-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework2.0 Low
- No product listedAn Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied wit…5.4 Medium
- No product listedA broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restrict…6.5 Medium
- No product listedA path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API…6.5 Medium
- No product listedA stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integrati…8.2 High
- No product listedAn SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in th…7.1 High
- No product listedKameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery5.1 Medium
- No product listedA SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly…7.1 High
- No product listedAn insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the d…8.0 High
- No product listedA server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg)…8.8 High
- No product listedAn unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicl…9.9 Critical
- allenai allennlpAllenAI AllenNLP Registrable Configuration Machinery registrable.py Registrable.resolve_class_name code injection5.3 Medium
- churchcrm crmFrappe CRM before 1.89.1 Missing Authorization via Phone Lookup API7.1 High
- creditnirvana collections platform (collectionworkz)Improper Authentication Vulnerability in CreditNirvana Collections Platform9.3 Critical
- No product listedJIZHICMS Front-end Order OrderController.php pay improper authorization5.3 Medium
- creditnirvana agentic ai call centreHardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application8.7 High
- frappe builderFrappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect5.3 Medium
- hascheksolutions pictshareHaschekSolutions PictShare File Upload core.php architect race condition2.1 Low
cargo-nextestcrates.ioArbitrary code execution when rerunning tests from a portable recording7.8 Highrustls-fficrates.ioUse-after-free of caller-owned server name in client connection constructorsNo score- innotim software, telecommunications and consulting trade ltd. co. logsign siemArbitrary File Read in Innotim Software's Logsign SIEM6.5 Medium
libimobiledeviceDebianlibimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow5.3 Medium- frappe builderFrappe Builder before 1.36.1 SSRF via convert_to_webp6.3 Medium
- frappe builderFrappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt5.3 Medium
- qtNull pointer dereference vulnerability in QNetworkAccessManager impacts Qt2.1 Low
libimobiledeviceDebianlibimobiledevice AFC File afc.c afc_file_open out-of-bounds5.1 Medium- havelsan liman mysHost Header Injection in HAVELSAN's Liman MYS8.1 High
libimobiledeviceAlmaLinux,libimobiledevice-debuginfoRed Hat,libimobiledevice-debugsourceRed Hat +2 more +4 morelibimobiledevice AFC Service afc.c service_receive double free6.9 MediumlibimobiledeviceDebianlibimobiledevice Device Info afc.c afc_get_device_info_key memory corruption4.8 MediumlibimobiledeviceDebianlibimobiledevice AFC afc.c heap-based overflow5.3 Medium- siemens mendix saml (mendix 10 compatible), mendix saml (mendix 11 compatible), mendix saml (mendix 9 compatible) +2 moreA vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4)...7.6 High
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- supsystic contact form by supsysticWordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability5.3 Medium
- misp misp-guardMISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding7.1 High
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability5.3 Medium
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability4.3 Medium
- bplugins advanced post block - post grid for wordpress block editorWordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins panorama viewer – 360 degree image + video viewerWordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins b sliderWordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- No product listedBillaBear Installation InstallController.php processInstall missing authentication6.9 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…