CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- boneio black debian imagesUse of Default Credentials in boneIO7.1 High
- boneio black debian imagesImproper Privilege Assignment in boneIO9.3 Critical
- boneioCleartext Storage of Sensitive Information in boneIO6.9 Medium
- boneioMissing Authentication in Default Configuration in boneIO8.7 High
- boneioMissing Authentication for Node-RED in boneIO8.7 High
- iflytek astron-agentiFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization5.3 Medium
- sciener ttlockTTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure8.6 High
rekorSUSESecurity update for rekorNo score- lobster data gmbh proPrivilege escalation via request replaying in Lobster_pro5.6 Medium
- apache software foundation sisApache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files5.5 Medium
- red hat data grid 8Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store6.5 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreGssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon5.5 Medium
- iflytek astron-agentiFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist6.9 Medium
- mattermost, mattermost server +1 moreMattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator2.7 Low
- mattermost, mattermost server +1 moreUnbounded memory consumption during PDF text extraction6.5 Medium
- mattermost, mattermost server +1 moreMattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames6.5 Medium
- google mcp toolbox for databases (googleapis/mcp-toolbox)Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write9.3 Critical
- apache software foundation sisApache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store5.4 Medium
- mattermost, mattermost server +1 moreImproper post type validation on scheduled post endpoints3.5 Low
- vertiv avocent acs8000Avocent ACS8000 wsserver command injection9.8 Critical
- mongodb inc mongoshMongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs7.6 High
- No product listedKameleo Local API user-info information disclosure5.3 Medium
- mattermostInsufficient length validation when parsing Zoom chat transcriptions6.5 Medium
- benoitc hackneyUnbounded response body buffering and decompression in hackney8.2 High
- benoitc hackneyCustom cacerts or cacertfile do not restrict trust to the pinned CA in hackney9.1 Critical
- benoitc hackneyHTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney6.0 Medium
- benoitc hackneySSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney6.9 Medium
- benoitc hackneyCRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney2.1 Low
- No product listedKameleo Local API profiles information disclosure5.3 Medium
- fortinet fortisandbox, fortisandbox paas +1 moreAn authentication bypass using an alternate path or channel vulnerability in Fortinet...9.6 Critical
- harborSSRF in Harbor webhook delivery allows ProjectAdmin to reach internal servicesNo score
- mtrudel banditSETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit8.7 High
- wolfvision cynap pro, cynap core pro, cynap, cynap core +1 moreShared SSH Authentication Key in vSolution Matrix File Sharing9.2 Critical
- mtrudel banditClient-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit8.7 High
- mtrudel banditHTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit8.7 High
- mtrudel banditHTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit8.2 High
- mtrudel banditHTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit8.7 High
- mtrudel banditQuadratic bignum parsing of Content-Length and Host port values in Bandit8.7 High
- mtrudel banditWebSocket frames keep reaching the WebSock after a server-initiated close in Bandit6.3 Medium
- mtrudel banditWebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit8.7 High
- mtrudel banditChunk extensions accept bare LF and CR, enabling request smuggling in Bandit6.3 Medium
- mtrudel banditHTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit8.7 High
- mtrudel banditHTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit8.7 High
- No product listedKameleo Cookie Controller w.cs CookieController.ListCookies information disclosure5.3 Medium
- wolfvision cynap pro, cynap core pro, cynap receiver, cynap pure, cynap pure mini, cynap pure pro, cynap pure (next gen), cynap bridge, cynap videobar, firmware version +1 more +3 moreUnauthenticated RCE Vulnerability in WolfProt interface implementation9.3 Critical
- nxp mcuxsdk-middleware-usbNXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers7.0 High
- nxp mcuxsdk-middleware-usbNXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read5.1 Medium
- easymock objenesisObjenesis before 3.6 Type Confusion via Class Name Instantiator Cache2.0 Low
- huangxd- danmu apidanmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints9.3 Critical
- dolibarrDolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter8.6 High
- Show moreLoading…