CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- adobe connect android mobile app, connect desktop app +1 moreAdobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)9.6 Critical
- sebhildebrandt systeminformationsysteminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net3.3 Low
- hcl software domino servereMudhra Compromised Certificate vulnerability impacts HCL Domino Server9.1 Critical
- asterisk, asterisk certified-asterisk +1 moreAsterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)7.7 High
- authlibAuthlib RFC 7592 examples omit registration-access-token client binding8.8 High
- oretnom23 php-travel-agency-systemoretnom23 php-travel-agency-system employee_insert.php unrestricted upload6.9 Medium
- adobe substance 3d painterSubstance3D - Painter | Out-of-bounds Read (CWE-125)5.5 Medium
- adobe substance 3d painterSubstance3D - Painter | Stack-based Buffer Overflow (CWE-121)7.8 High
- adobe creative cloud desktop applicationCreative Cloud Desktop | Uncontrolled Search Path Element (CWE-427)7.3 High
- veeam backup and replicationA vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP...9.1 Critical
- veeam backup and replicationA vulnerability allowing an authenticated user with the Restore Operator role, who also controls...5.9 Medium
- veeam backup and replicationA vulnerability allowing an authenticated user with the Restore Operator role, who also controls...5.9 Medium
- samsung open source oneA vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor...8.5 High
- veeam backup for microsoft 365A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a...6.9 Medium
- veeam backup for microsoft 365A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to...8.3 High
- veeam backup for microsoft 365A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the...9.0 Critical
- veeam agent for linuxA vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only...7.3 High
- veeam backup for microsoft 365A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM...4.3 Medium
- nextcloud whiteboardA SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploi…4.6 Medium
- nextcloud tablesThe user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.4.6 Medium
- devolutions serverWhen a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be calle…4.3 Medium
- nextcloud tablesThe Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of shar…3.3 Low
- nextcloud files confidentialA user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.4.3 Medium
- devolutions serverApp passwords were allowed to bypass password confirmation on sensitive endpoints.5.3 Medium
- nextcloud collectivesA public shared collective always allowed recipients of the link to create pages.3.5 Low
- devolutions serverAbusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three d…7.5 High
- nextcloud richdocumentsA missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.3.5 Low
- knative pkgknative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion6.5 Medium
- gfi usa, llc kerioconnectGFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment6.2 Medium
- autodesk fusionDynamic Library Loading Process Control in Autodesk Fusion Desktop7.8 High
- autodesk fusionElectronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop7.1 High
- autodesk fusionFusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop7.1 High
- autodesk fusionDesign Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop7.1 High
- autodesk fusion post processor utilityStack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility8.8 High
- desmondmorris node-tesseractdesmondmorris node-tesseract Command Builder tesseract.js process os command injection6.9 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- watchguard mobile vpn with ssl clientMobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket5.7 Medium
- watchguard fireware osFireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation8.7 High
- watchguard fireware osFireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service7.2 High
- watchguard fireware osFireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets8.7 High
- watchguard fireware osFireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root7.2 High
- watchguard fireware osFireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service8.6 High
- watchguard fireware osFireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution6.1 Medium
- watchguard fireware osFireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution9.2 Critical
- watchguard fireware osFireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution9.2 Critical
- watchguard fireware osFireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution9.1 Critical
- watchguard fireware osFireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write9.2 Critical
- watchguard fireware osFireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection9.2 Critical
- watchguard fireware osFireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root7.1 High
- watchguard fireware osFireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution9.2 Critical
- Show moreLoading…