CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- yeswikiYesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand6.9 Medium
- yeswikiYesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import8.2 High
- yeswikiYesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile8.2 High
- yeswikiYesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox8.3 High
- yeswikiYesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler5.3 Medium
- yeswikiYesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback5.3 Medium
- yeswikiYesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter6.9 Medium
- yeswikiYesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames7.1 High
- yeswikiYesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter6.9 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Credential Disclosure via notification.rules Query8.4 High
- openpanel-dev openpanelOpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket8.8 High
- openpanel-dev openpanelOpenPanel before 3.0.0 Missing Authentication on Worker Bull Board6.9 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts5.3 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs7.1 High
- openpanel-dev openpanelOpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts7.1 High
- openpanel-dev openpanelOpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter7.1 High
- openpanel-dev openpanelOpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template8.7 High
- openpanel-dev openpanelOpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences6.9 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure6.9 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values8.6 High
- openpanel-dev openpanelOpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query7.0 High
- openpanel-dev openpanelOpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation5.3 Medium
- openpanel-dev openpanelOpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list5.3 Medium
- cure53 dompurifyDOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees5.1 Medium
- parse-community parse-serverParse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query5.3 Medium
- wwbn avideoWWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header6.9 Medium
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System delete.php unlink path traversal6.9 Medium
- No product listedArgilla TextField.vue cross site scripting4.8 Medium
- No product listedArgilla Sandbox.vue cross site scripting4.8 Medium
- kubernetesStatefulSet and ControllerRevision write permissions allow cross-namespace pod creation5.9 Medium
- kubernetesSubpath symlinking on Windows nodes permits NTLM coercion5.8 Medium
- No product listedArgilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting5.1 Medium
- itsourcecode online book storeitsourcecode Online Book Store book.php sql injection5.3 Medium
- klauspost compresscompress zstd: Panic on two-block frames8.7 High
- transmissionTransmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token8.7 High
- rajnandan1 kenerKener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret9.2 Critical
- qloappsQloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview6.9 Medium
- qloappsQloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation6.9 Medium
- ntop ndpintop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector6.9 Medium
- libyal libmsiecflibyal libmsiecf through 20260525 Double Free via libmsiecf_url_values_read_data6.8 Medium
- samtools htslibHTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count4.8 Medium
- xiph speexSpeex through 1.2.1 Out-of-Bounds Write via speex_bits_read_whole_bytes8.3 High
- netsurf-browser libcsslibcss through 0.9.2 NULL Pointer Dereference via Media-Query Parser7.1 High
- kisli vmimeVMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder5.3 Medium
- kisli vmimeVMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder8.7 High
- libyal libphdilibphdi through 20260902 Heap Out-of-Bounds Read via Extent Data File Path6.9 Medium
- libyal libpfflibpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_values_array6.9 Medium
- libyal libpfflibpff through 20260926 Heap Out-of-Bounds Read via libpff_table_read_6c_record_entries6.9 Medium
- dvidelabs flatccflatcc through 0.6.4 Out-of-Bounds Read via verifier check_header6.3 Medium
- dvidelabs flatccflatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number6.3 Medium
- Show moreLoading…