CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- smci x12spiSupermicro BMC contains a SMCRAKP Fixed Key vulnerability7.5 High
- qtOut-of-bounds read vulnerability in QTextCodec TSCII encoding impacts Qt4.3 Medium
- smci mbd-x12stw-fSupermicro BMC's syslog feature contains a command injection vulnerability7.2 High
- moxa oncell g3150a-lte seriesSMS upgrade argument reaches system() unescaped in OnCell G3150A-LTE Series7.5 High
- broadcom symantec ghost solution suiteSecurity Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials6.8 Medium
- moxa oncell g3150a-lte seriesStatic HTTPS private key and CA private key in firmware in OnCell G3150A-LTE Series7.7 High
- moxa remote connect suite (mrc client)Unauthenticated server-supplied OpenVPN configuration in Moxa Remote Connect Suite (MRC Client)7.6 High
- fortinet fortios, siemens ruggedcom ape1808 +1 moreA improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow...6.7 Medium
- qtOut-of-bounds read vulnerability in NTLM authentication handling impacts Qt5.3 Medium
- unknown paydunya woocommerce payment gatewayPayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery5.3 Medium
- unknown tiendacrypto para woocommerceTiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass3.7 Low
- ljharb qsqs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection6.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint8.8 High
- unknown payment integration wompiPayment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN Callback5.3 Medium
- unknown payex payment gateway for woocommercePayex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret Key5.3 Medium
- esaqa gmbh psonoURL prefix handling permits API key read-scope bypass in Psono Server4.3 Medium
- esaqa gmbh psonoUser-controlled Duo host permits authenticated SSRF in Psono Server5.4 Medium
- esaqa gmbh psonoWebAuthn assertion replay permits second-factor bypass in Psono Server6.5 Medium
- esaqa gmbh psonoFile-transfer type confusion permits unauthorized repository writes in Psono Server5.4 Medium
git-annexDebiangit-annex-10.20261026-1.1 on GA mediaNo score- esaqa gmbh psonoDevice-code claim permits restricted token escalation in Psono Server6.5 Medium
- deconf analytics insights – google analytics dashboard for wordpressAnalytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title7.2 High
vimMageiaUpdated vim package fixes security vulnerabilitiesNo scoresuseconnect-ngSUSESecurity update for suseconnect-ngNo score- asus motherboards firmwareUntrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level...6.8 Medium
- saruf-ratul hr-payroll-management-systemSaruf-Ratul HR-Payroll-Management-System chat.php cross site scripting5.1 Medium
- md-mafujul-hasan online-payroll-management-systemMD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting5.1 Medium
- ubiquiti inc airmax mA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site...7.1 High
- ubiquiti inc airmax mA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site...8.8 High
- code-projects simple content management systemcode-projects Simple Content Management System Admin welcome.php authorization6.9 Medium
- ubiquiti inc airmax m, ltu ptmp, ltu ptp +1 more +3 moreA malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow...8.8 High
- fclairamb ftpserverlib, syncplify, inc. syncplify server! +1 moreFclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P6.3 Medium
- mistralai mistral-vibeMistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode8.7 High
- diasurgical devilutionxDevilutionX 1.4.0 through 1.5.5 Heap Buffer Overflow via libmpq__archive_dup6.9 Medium
- diasurgical devilutionxDevilutionX 1.4.0 through 1.5.5 Out-of-Bounds Read via libmpq Hash Table Lookup6.8 Medium
- ggml-org llama.cppllama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader6.9 Medium
- ggml-org llama.cppllama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader6.9 Medium
- ggml-org llama.cppllama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer8.5 High
- ggml-org llama.cppllama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info6.8 Medium
- ggml-org llama.cppllama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs8.8 High
- ggml-org llama.cppllama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets6.9 Medium
- ubiquiti inc airmax mA malicious actor with access to the adjacent network and under certain conditions could exploit...8.8 High
- tencent rapidjsonTencent RapidJSON Regex stream.h Take out-of-bounds6.9 Medium
- damo academy videollama2DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check5.3 Medium
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System order.php client-side enforcement of server-side security6.9 Medium
- No product listedAidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and...9.8 Critical
- No product listedAn issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain...6.2 Medium
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System delete_admin.php missing authentication6.9 Medium
- sourcecodester online food ordering systemSourceCodester Online Food Ordering System add_food.php unrestricted upload5.1 Medium
- apache software foundation airflow ssh providerApache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host8.8 High
- Show moreLoading…