CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- project-monai monaiMONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)9.3 Critical
- dcmjs-org dcmjsdcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS9.1 Critical
- wailsapp wailsWails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins7.6 High
- dolibarrDolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter8.8 High
- dell powerprotect data domain virtual editionPowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024...7.2 High
- bmc control-m/enterprise manager, control-m/server +1 moreRemote unauthenticated information disclosure and denial of service due to unauthenticated service access6.9 Medium
- dell powerprotect data domain virtual editionPowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024...7.2 High
- netiket information technologies edowebIDOR in Netiket Information Technologies' EdoWEB4.3 Medium
- octopus deploy serverIn affected versions of Octopus Server, a user with permission to upload a malicious nuget...5.1 Medium
- spesmilo electrumElectrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass9.3 Critical
- spesmilo electrumElectrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution8.6 High
- spesmilo electrumElectrum before 4.8.3 Missing Signature Verification of Mempool Transactions9.3 Critical
- masc-ucsc hagenthagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools8.5 High
- vorota-ai nmap-mcpnmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities4.8 Medium
- alishahid74 kali-gptKali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters8.5 High
- bitscorp-mcp mcp-ffmpegmcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir7.3 High
- horw esp-mcpesp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters8.5 High
- icret easyimages2.0EasyImages2.0 through 2.8.6 Unauthenticated Path Traversal via down.php, thumb.php and info.php6.9 Medium
- artalkjs artalkArtalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch6.9 Medium
- buqiyuan nest-adminnest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret9.3 Critical
- zmister2016 mrdocMrDoc through 1.1.1 Broken Access Control via manage_doc_share5.3 Medium
- anyant rssantrssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint6.9 Medium
- codefriar sf-mcpsf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values8.5 High
- atxp gemini-cli-extensionATXP Gemini CLI Extension through 1.0.0 OS Command Injection via MCP Tools8.5 High
- hyperb1iss droidmindDroidMind through 0.4.0 Command Injection via Shell Allowlist Bypass8.5 High
- ai-sdlc-framework ai-sdlcai-sdlc MCP Server through 0.31.2 Command Injection via check_issue and check_pr_status8.5 High
- libsdl-org sdl imageSDL_image through 3.4.8 and 2.8.12 Stack Out-of-Bounds Read in ILBM Loader6.9 Medium
- microsoft zchunkzchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()5.3 Medium
- greyclab cimgGreycLab CImg through 4.0.6 Heap Out-of-Bounds Read via Integer Overflow in _load_bmp()6.9 Medium
- admidioAdmidio before 5.0.17 Event Guest Restriction Bypass via events_function.php5.3 Medium
- umbraco umbraco-cmsUmbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning7.7 High
- keepnet labs cybersecurity inc. agentic ai / agentic allyAuthentication Bypass with X-Agentic-Ally-Token in Keepnet Labs Agentic AI / Agentic Ally7.5 High
- devolutions powershell universalImproper neutralization of input during web page generation ('Cross-site Scripting') in the...8.7 High
- idvlabs software and consulting services inc. ontimeOTP Brute-Force Account Takeover in Idvlabs Software's Ontime5.3 Medium
- docker desktopDocker Desktop logs can expose stored third-party credentials5.7 Medium
- qtOut-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt1.9 Low
- nvidia physxNVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of...7.8 High
- nvidia nemo agent toolkitNVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing...10.0 Critical
- nvidia nemo agent toolkitNVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection...8.4 High
- nvidia tensorrt-llmNVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request...7.1 High
- nvidia tensorrt-llmNVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request...7.1 High
- nvidia tensorrt-llmNVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer...8.4 High
podmanSUSESecurity update for podmanNo scorepodmanSUSESecurity update for podmanNo scorepodmanSUSESecurity update for podmanNo score- rolantis information technologies agentisUser Enumeration in Rolantis Information Technologies' Agentis7.5 High
rustixcrates.ioxattr functions mark unwritten bytes as initialized when given a zero-length bufferNo score- hitachi energy tro600 series firmwareTRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit...8.7 High
- nodemailerNodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing8.3 High
- nodemailerNodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments8.3 High
- Show moreLoading…