CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- pyrus syncCVE-2026-116596No score
- 2k games sid meier's civilization vi, 2k sid meiers civilization vi +1 more2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion5.3 Medium
- zephyrproject zephyrCross-session AES key confusion in the Espressif ESP32 hardware crypto driver3.7 Low
- zephyrproject zephyrBluetooth Classic HFP AG wipes an object still linked in the SDP request list on connect failure, causing a NULL dereference6.5 Medium
- zephyrproject zephyrUse of a released HFP HF object after a failed RFCOMM connect in the Bluetooth Classic host5.3 Medium
- zephyrproject zephyrIPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key3.7 Low
- zephyrproject zephyrBluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses7.1 High
- zephyrproject zephyrBluetooth Host connection reservation leak when multiple connectable advertising sets share an identity4.3 Medium
- github-kanban-mcp-serverSunwood-ai-labs github-kanban-mcp-server issue-handlers.ts handleListIssues os command injection5.3 Medium
- magepeople inc. wpeventlyWordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability5.3 Medium
- mattermostTeam admin can escalate a team member's permissions via the team member roles endpoint3.8 Low
- syncplify, inc. syncplify server!Syncplify Server! 6.0.0 < 8.8.0 Symbolic Link Jail Escape7.6 High
- syncplify, inc. syncplify server!Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing8.6 High
- keil mdk-middlewareArm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data...6.5 Medium
- keil mdk-middlewareArm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX Buffer6.5 Medium
- deepseek harnessDeepSeek Harness Browser Auth browser-auth.ts improper authorization6.9 Medium
- keil mdk-middlewareArm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds read in SNMP...5.3 Medium
- openhands software agent sdkOpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE9.3 Critical
- deepseek harnessDeepSeek Harness sandbox.ts createContext5.3 Medium
- apache software foundation vysperApache Vysper: Authorization bypass8.8 High
- apache software foundation vysperApache Vysper: Unbounded allocation7.5 High
- open5gsOpen5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output6.3 Medium
- open5gsOpen5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser8.7 High
- netty netty-tcnative, netty-tcnative-boringssl-static +1 moreNetty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding6.9 Medium
- netty netty-tcnative, netty-tcnative-boringssl-static +1 morenetty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount8.2 High
- netty netty-tcnativenetty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback8.2 High
- netty netty-tcnative, netty-tcnative-boringssl-static +1 moreNetty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO8.2 High
- mganss htmlsanitizerHtmlSanitizer before 9.2.1039 XSS via SanitizeDom Body and HTML Attributes2.3 Low
- timescale pgvectorscaleTimescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes7.7 High
- google cloud cloud run mcpBucket Squatting in Cloud Run MCP leads to Service Account Takeover7.7 High
- linuxx86/CPU/AMD: Fix AMD TLBI Erratum #17187.8 High
- linuxdm-integrity: fix buffer overflow in inline mode with large tag sizeNo score
- linuxtee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()No score
- linuxio_uring/register: don't exempt disabled rings from task restrictionsNo score
- linuxdrm/vc4: drain the hangcheck timer and works on V3D unbindNo score
- linuxBluetooth: btintel_pcie: fix TX descriptor bounds check7.5 High
- linuxmm: don't schedule deferred kernel page table freeing while bootingNo score
- linuxriscv: patch: fix handling of bpf-jit execmem addressesNo score
- linuxBluetooth: MGMT: Fix status of pending commands flushed on power offNo score
- linuxdrm/amdgpu: serialize vblank counter reads against GPU resetNo score
- linuxASoC: samsung: i2s: enable op_clk in probe to balance runtime PMNo score
- linuxnet: openvswitch: validate transport header presence in set_ipv6_addrNo score
- apache software foundation camelApache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity…7.5 High
- boneioClickjacking in boneIO6.9 Medium
- apache software foundation camelApache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache4.8 Medium
- boneioMissing Authentication for Critical Function in boneIO5.3 Medium
- boneio black debian imagesIncorrect Permission Assignment for Critical Resource in boneIO6.8 Medium
- boneioTOCTOU Race Condition in boneIO8.8 High
- boneioCross-Site Request Forgery (CSRF) in boneIO5.1 Medium
- boneioImproper Restriction of Excessive Authentication Attempts in boneIO2.3 Low
- Show moreLoading…