CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- wolfvision cynap pro, cynap core proUnauthorized Access to vSolution Matrix RTSP7.1 High
- omega solution restro posOmega Solution Restro POS sale-invoice logic error5.3 Medium
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API7.5 High
- onnxONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs6.2 Medium
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- villatheme photo reviews for woocommerceWordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability3.7 Low
- onnxONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute6.2 Medium
- villatheme customer coupons for woocommerceWordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability4.3 Medium
- bplugins typing text – give your texts many typing effectsWordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins button blockWordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins content slider blockWordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- onnxONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank6.2 Medium
- onnxONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)6.2 Medium
- vllmvLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs6.5 Medium
- vllmvLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server3.4 Low
- nosduco nforwardauthnforwardauth: Unvalidated r parameter allows post-authentication open redirect6.1 Medium
- vllmvLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)6.5 Medium
- vllmvLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE8.1 High
- bdtask garage 24 garage management softwareBdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting5.1 Medium
- padok-team burritoBurrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset9.9 Critical
- vllmvLLM DeepSeek-OCR image processing vulnerable to denial of service6.5 Medium
- nlnet labs routinatorRoutinator may exit on malformed ranges7.5 High
- nlnet labs routinatorRoutinator HTTP server becomes unavailable with many unclosed connections5.3 Medium
- nlnet labs routinatorRoutinator exits on malformed rsync URIs7.5 High
- nlnet labs routinatorRoutinator stores TA certificate in cache without validation3.8 Low
- nlnet labs routinatorRoutinator exits when parsing an incorrect or very large CRL file7.5 High
- nlnet labs routinatorRoutinator incorrectly handles delta updates8.2 High
- nlnet labs routinatorRoutinator exits when requesting the output repeatedly6.5 Medium
- bdtask garage 24 garage management softwareBdtask Garage 24 Garage Management Software Backend improper authorization5.3 Medium
- vllmvLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine6.5 Medium
- vllmvLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled7.5 High
- gstreamer project gst-editing-servicesA flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can...7.8 High
- vllmvLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool6.5 Medium
- bplugins lightbox blockWordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- octoprintOctoPrint API Key settings.py getSettings information disclosure6.9 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability5.3 Medium
- python-social-auth social-corePython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim6.8 Medium
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability5.4 Medium
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability5.3 Medium
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- aws aws-cdk/aws-redshift-alphaSQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha7.0 High
- awesomemotive easy digital downloads, easy digital downloads digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability5.9 Medium
- zip-rs zip2zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)7.4 High
- zip-rs zip2zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size7.5 High
- zip-rs zip2zip: AES Entry HMAC Authentication Bypass on Premature EOF6.5 Medium
- akuvox akubela hypanel ps51Akuvox Akubela HyPanel PS51 login improper authentication5.3 Medium
- zip-rs zip2zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE10.0 Critical
- johnson controls kantech entrapassUse of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows...8.5 High
- johnson controls kantech entrapassCleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech...5.3 Medium
- Show moreLoading…