CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- davea42 libdwarflibdwarf through 2.3.3 Heap Out-of-Bounds Read via dwarf_debug_addr_table4.8 Medium
- tildearrow furnaceFurnace through 0.6.8.3 Out-of-Bounds Write via FamiTracker GROOVES Block Import6.9 Medium
- tildearrow furnaceFurnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import6.8 Medium
- libyal libfvdelibfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a4.8 Medium
- libyal libfvdelibfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x00246.8 Medium
- mmitch gbsplaygbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c4.8 Medium
- mmitch gbsplaygbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title4.8 Medium
- mmitch gbsplaygbsplay through 0.0.103 Out-of-Bounds Read via mapper_map ROM Bank Index6.8 Medium
- fltkFLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow8.5 High
- fltkFLTK through 1.4.5 Stack Buffer Overflow via Fl_BMP_Image colors_used Field8.5 High
- xerial snappy-javasnappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite5.9 Medium
- itsourcecode airline reservation systemitsourcecode Airline Reservation System book_flight.php cross site scripting5.3 Medium
- totolink a950rgTOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow10.0 Critical
- datadog dd-trace-pyDatadog dd-trace-py: IAST instrumentation can lead to application DOS8.2 High
- datadog dd-trace-pyDatadog dd-trace-py: ReDOS in URL query string obfuscation8.7 High
- totolink a950rgTOTOLINK A950RG global.so getLanguageCfg information disclosure6.9 Medium
- go-joseGo JOSE: DoS when parsing JWKs that contain RSA keys7.5 High
- go-joseGo JOSE: Panics in JSON parsing6.9 Medium
- go-joseGo JOSE: Panic during CBC-HMAC processing6.9 Medium
- totolink a950rgTOTOLINK A950RG firewall.so apmib_set command injection9.4 Critical
- lxsmnsyc serovalSeroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length7.5 High
- lxsmnsyc serovalSeroval: Code injection through a typed array's own constructor property5.3 Medium
- lxsmnsyc serovalSeroval: Script injection through RegExp sources in serialized output4.7 Medium
- totolink a950rgTOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection9.4 Critical
- apple ipados, macos, visionos +2 more +4 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple ipados, macos, visionos +2 more +4 moreA buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2...7.8 High
- apple macosAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...5.5 Medium
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2,...8.4 High
- apple macosAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...7.5 High
- apple ipados, macos, tvos +4 more +6 moreA buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2...7.8 High
- apple macosA path handling issue was addressed with improved validation. This issue is fixed in macOS Golden...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreAn out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in...7.1 High
- apple macosAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...7.1 High
- apple ipados, macos, tvos +4 more +6 moreA null pointer dereference was addressed with improved input validation. This issue is fixed in...7.5 High
- apple ipados, macos, safari +5 more +7 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in...4.3 Medium
- apple ipados, macos, visionos +2 more +4 moreAn authorization issue was addressed with improved access control. This issue is fixed in iOS 27...5.5 Medium
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2,...5.5 Medium
- apple macosAn information leakage was addressed with additional validation. This issue is fixed in macOS...6.5 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreAn out-of-bounds write issue was addressed with improved input validation. This issue is fixed in...7.8 High
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...7.5 High
- apple macosAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...6.5 Medium
- apple ipados, macos, visionos +3 more +5 moreAn input validation issue was addressed with improved input validation. This issue is fixed in...7.5 High
- apple visionosAn integer overflow was addressed with improved input validation. This issue is fixed in visionOS...7.8 High
- apple macosAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...9.8 Critical
- apple macosAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...7.8 High
- apple ipados, macos, safari +3 more +5 moreA type confusion issue was addressed with improved state management. This issue is fixed in...8.8 High
- apple macosAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...8.8 High
- apple macosA logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2,...7.8 High
- apple macosAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS...7.1 High
- apple ipados, macos, visionos +2 more +4 moreA buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2...7.5 High
- Show moreLoading…