CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- masaakitanaka booking packageBooking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient5.3 Medium
- unknown menu cart for woocommerceWooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute7.5 High
- thrive themes automator, unknown thrive automator +1 moreThrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter6.8 Medium
- unknown checkout files upload for woocommerceCheckout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- unknown casso flowCasso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation5.3 Medium
- unknown payconiqPayconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure5.3 Medium
- unknown unipay payment gateway for woocommerceUniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN Secret5.3 Medium
- king-theme product designer for woocommerce wordpress | lumiseProduct Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload7.5 High
- wpfactory customer email verification for woocommerceCustomer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter4.8 Medium
- google agent development kit (adk) for pythonCross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python5.3 Medium
- eaglecloud aquilaInsufficiently protected credentials in EagleCloud Aquila on-premises version8.7 High
- eaglecloud aquilaCode injection in EagleCloud Aquila on-premises version9.4 Critical
- linuxwifi: p54: validate firmware record lengthsNo score
- a2ui-project a2uia2ui-project a2ui Parser expression_parser.ts formatString resource consumption5.1 Medium
- rankmath rank math seo – ai seo tools to dominate seo rankingsRank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution8.8 High
- bplugins animated text block – add typing and looping text effectsAnimated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute7.5 High
- codepeople appointment booking calendarAppointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter6.4 Medium
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter7.5 High
- a2ui-project a2uia2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption6.9 Medium
- gnu mtoolsGNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.6.1 Medium
- a2ui-project a2uia2ui-project a2ui Binder generic-binder.ts resource consumption5.3 Medium
- a2ui-project a2uia2ui-project a2ui data-model.ts DataModel.set resource consumption5.3 Medium
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter7.2 High
- plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videosAll-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC6.4 Medium
- tigroumeow ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & geminiAI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter4.2 Medium
- mohammed kaludi amp for wp – accelerated mobile pagesAMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute7.2 High
- nalam-1 ai marketing expert — ai email marketing, ai content generator, seo analyzer, ai workflow automation, social media & ai chatbotAI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter7.2 High
- notfound pie register premium, pie register premium +1 morePie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler9.8 Critical
- plugins360 all-in-one video gallery – video player & galleries for youtube, vimeo & self-hosted videosAll-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute6.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field6.4 Medium
- growi, inc. growiGROWI contains a missing authorization check vulnerability in its collaborative editing feature....6.9 Medium
- growi, inc. growiGROWI contains an authorization bypass vulnerability in its tag update API and the page update...2.3 Low
- growi, inc. growiGROWI contains an authorization bypass vulnerability in its page viewing and commenting...2.3 Low
- tabularisdb tabularisTabularis before 0.28.0 SQL Injection via MCP describe_table table_name8.5 High
- mewebstudio posmews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks8.7 High
- tencent weknoraWeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses6.0 Medium
- ggml-org llama.cppllama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()9.2 Critical
- libresslLibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response8.2 High
- libresslLibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()6.3 Medium
- libresslLibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path6.3 Medium
- libresslLibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line6.3 Medium
- libexpatlibexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes8.2 High
- libexpatlibexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser8.2 High
- merbanan rtl 433rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder7.1 High
- assimpAssimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow6.9 Medium
- thexerteproject xerteonlinetoolkitsXerte Online Toolkits through 3.15.5 RCE via Language Pack Import8.6 High
- blair2004 nexoposNexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions5.3 Medium
- nopsolutions nopcommercenopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers5.3 Medium
- crushftpCrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/8.6 High
- c97net cart engine, kemana directory, qengine cms +2 moreC97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields8.7 High
- Show moreLoading…