CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...7.2 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...6.5 Medium
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...6.4 Medium
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...4.9 Medium
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...7.2 High
- futurum software user authentication moduleSQL injection (SQLi) in the user authentication module of Futurum Software9.1 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...7.2 High
- dell powerprotect data domain virtual editionDell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8,...7.2 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...8.8 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...8.8 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...7.2 High
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...9.1 Critical
- fazile bacak defterasist financial advisor platformStored XSS Fazile BACAK's DefterAsist Financial Advisor Platform5.4 Medium
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...6.7 Medium
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...3.4 Low
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- samsung open source escargotOut-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation.5.4 Medium
- shortpixel enable media replaceEnable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow4.3 Medium
- echoplugins echo knowledge base – documentation, faqs, chat & smart searchEcho Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter6.1 Medium
- caseproof, llc memberpressMemberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter8.8 High
@chromatic-com/storybookRoot,@rootio/chromatic-com__storybookRoot +1 moreAIKIDO-2026-255235 in @chromatic-com/storybook - Patched by RootNo score- axis communications ab camera station pro, camera station 5 +1 moreDatabase backups are vulnerable to offline attacks. Backups created using a version prior to the...7.1 High
- cozythemes cozy blocks – website builder & business growth toolkit | popups, lead forms & inboxCozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute6.4 Medium
- chuck1982 wp inventory manager, wp inventory manager +1 moreWP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute6.5 Medium
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter4.9 Medium
- tainacanTainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment4.9 Medium
- rankingcoach beyondseo – ai seo to improve rankings, listings & online visibilityBeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation6.3 Medium
- bitpressadmin bit flows: ai agent automation & integrations for forms, crm, ecommerce, google sheets, and moreBit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters5.9 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute6.5 Medium
- bplugins document embedder – let visitors read files without downloadingDocument Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute6.4 Medium
- kleor contact managerContact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass9.8 Critical
- saadiqbal post snippets – custom wordpress code snippets customizerPost Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title6.4 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints5.3 Medium
- jtsternberg cmb2CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form5.4 Medium
- acowebs product addons for woocommerce – product options with custom fieldsProduct Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter4.4 Medium
- kitae-park mang boardMang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute6.4 Medium
- wpdevteam easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solutioneasy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute6.4 Medium
- hornero clean loginClean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook4.3 Medium
- magepeopleteam travelly – tour & travel booking manager for woocommerceTravelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter4.3 Medium
- bdthemes prime slider – hero slider, carousel, woocommerce & post slider elementor addonsPrime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape7.2 High
- webheadllc webheadcoder multi-step forms for contact form 7Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter6.1 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute6.4 Medium
- barrykooij related posts for wordpressRelated Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter4.3 Medium
- themefusion avada (fusion) builderAvada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes6.4 Medium
- Show moreLoading…