CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export6.5 Medium
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion7.1 High
- wing ftp server ftp serverPath Traversal in Wing WFTP Server leading to Remote Code Execution9.4 Critical
- happyseafox sailSAIL: WebP decoder division by zero through malformed animated canvas metadata4.8 Medium
- getnora-io noraNORA missing cross-user token-management authorization7.1 High
- ihomefinder, inc. optima expressWordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability7.5 High
- pickplugins accordionWordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability7.2 High
- gs plugins logo slider, unknown gs logo slider +1 moreWordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability8.8 High
- david anderson redux frameworkWordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability6.5 Medium
- buddypressWordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability8.5 High
- iova.mihai slicewpWordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability7.1 High
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic contact form by supsysticWordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability7.5 High
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability9.3 Critical
- wp discussion board discussion boardWordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crowd favorite dxp toolkitWordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability9.3 Critical
- ayecode ltd getpaidWordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability7.1 High
- crowd favorite dxp toolkitWordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- walinejs walineWaline login accepts a non-string email as a match-all MongoDB query6.5 Medium
- topluyo appTopluyo Desktop for Linux has an OS Command Injection issue9.6 Critical
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.3.7 Low
- progress telerik document processing librariesUncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing7.5 High
- progress telerik document processing librariesUncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering7.5 High
- progress telerik document processing librariesUncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing7.5 High
- progress software telerik document processing librariesImproper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing7.5 High
- progress telerik document processing librariesXML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing7.5 High
- progress telerik document processing librariesPath Traversal in Telerik Document Processing Libraries AI Agent Tools7.1 High
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.4.2 Medium
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.6.4 Medium
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.6.5 Medium
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.8.6 High
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.9.1 Critical
calaminecrates.ioPanic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input7.5 Highpulldown-cmarkcrates.ioQuadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`7.5 Highjuniper_hypercrates.ioUnbounded memory use on large request bodies7.5 Highlibz-syscrates.iolibz-sys build script leaks environment variables in the build directoryNo scorejunipercrates.ioExcessive CPU and memory use on crafted GraphQL documents7.5 Highjunipercrates.ioStack overflow on deeply nested GraphQL documents7.5 High- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.128.6 High
- dell idrac service module for esxi, idrac service module for linux, idrac service module for windows +2 moreDell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell...4.2 Medium
- eclipse foundation che, the eclipse foundation eclipse che +1 moreUnauthenticated Command Injection via kubeconfig Username in che-machine-exec9.8 Critical
- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.165.3 Medium
- axel download accelerator axelAxel Download Accelerator Path Traversal via URL Filename Decoding7.0 High
- wphocus my auctions allegroWordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability5.4 Medium
- eisge kalifastKaliFast Project Management Platform ei_git_repo_url OS Command Injection8.7 High
- avast antivirus, gen digital avast antivirus, avg internet security +1 more +3 moreNorton, Avast, and AVG local privilege escalation via link following in Data Shredder7.3 High
- supsysticcom smart popup by supsysticSmart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block4.9 Medium
- unknown essential addons for elementorEssential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification5.3 Medium
- unknown royal elementor addonsRoyal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes5.3 Medium
- Show moreLoading…