CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- No product listedInsecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows...7.5 High
- No product listedInsecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to...7.5 High
- No product listedInsecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized...6.5 Medium
- No product listedInsecure permissions in the CardProvider content provider component of helloworld1 AnyMemo...9.1 Critical
- No product listedAn issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader...7.5 High
- No product listedInsecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2...8.8 High
- No product listedInsecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized...8.1 High
- No product listedInsecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows...9.1 Critical
- No product listedInsecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another...7.5 High
- No product listedInsecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write...9.1 Critical
- No product listedInsecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized...9.1 Critical
- nschloe meshionschloe meshio VTK Reader _vtk_42.py memory allocation6.9 Medium
- dfm feedfinder2dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery6.9 Medium
- configuroweb inventariobasicoconfiguroweb inventariobasico Add Product addlist.php cross site scripting5.1 Medium
- apple swift-cryptoRed Hat Security Advisory: Red Hat Hardened Images RPMs Security Update5.9 Medium
- d-link dir-505D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor9.3 Critical
- maotoumao musicfreedesktopmaotoumao MusicFreeDesktop Request Forwarder information disclosure5.3 Medium
- maykinmedia open-objectObjects API: Cross-object-type authorization bypass on the object history-detail endpoint6.5 Medium
- mailwatchMailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail8.1 High
- invoiceplaneInvoicePlane: Guest user IDOR in quote approval and rejection5.3 Medium
- domoticzDomoticz: Missing authorization and path traversal in the udevices Lua parser handler5.4 Medium
- maotoumao musicfreedesktopmaotoumao MusicFreeDesktop Request Forwarder server-side request forgery5.3 Medium
- a2ui-project a2uia2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes5.1 Medium
- wwbn avideo-encoderAVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles4.7 Medium
- wwbn avideo-encoderAVideo-Encoder: pre-authentication streamer-login SQL injection7.5 High
- opencatsOpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)7.2 High
- wwbn avideo-encoderAVideo-Encoder: missing authentication on control and status endpoints7.3 High
- mongodb database toolsThe DB Tools trust certificates issued by recoverable eMudhra intermediate CAs7.6 High
- wwbn avideo-encoderAVideo-Encoder: unauthenticated full-response server-side request forgery8.6 High
- wwbn avideo-encoderAVideo-Encoder: reflected cross-site scripting in the login interface6.1 Medium
- a2ui-project a2uia2ui Image Player/Video Player/Audio Player Image.js input validation5.3 Medium
- opencatsOpenCATS: Authenticated SQL injection in activity DataGrid date filters7.6 High
- wwbn avideo-encoderAVideo-Encoder: unauthenticated command execution through streamer login trust10.0 Critical
- wwbn avideo-encoderAVideo-Encoder: unauthenticated installer PHP code injection10.0 Critical
- mrblomblo blombooruBlombooru: administrator image-proxy server-side request forgery6.2 Medium
- mattermostPath traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post8.0 High
- ankimcp anki-mcp-server-addonAnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools8.8 High
- bricks builderBricks Broken Access Control via query_result Endpoint7.5 High
- bricks themeBricks Theme Unauthenticated Dynamic Data Tag Injection via query_result7.5 High
- pi websolution piweb disable payment method / partial payment for woocommercePiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees6.9 Medium
- gopasspw gopassgopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir6.7 Medium
- volmarg personal-management-systemVolmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path8.6 High
- dolibarr erp/crmDolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php6.9 Medium
- danoli3 freeimageFreeImage through 3.18.0 and danoli3 fork before 3.19.25 Heap Buffer Overflow via GIF_PLAYBACK Compositing8.5 High
- danoli3 freeimageFreeImage through 3.18.0 and danoli3 fork before 3.19.22 Heap Buffer Overflow via IFF/LBM PBM RLE Decoder8.5 High
- python-markdown2python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations8.7 High
- giuspen cherrytreeCherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path5.6 Medium
- giuspen cherrytreeCherryTree through 1.7.2 OS Command Injection via Custom Web Link Action7.1 High
- gudong2003 xianyu-auto-reply-fixxianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message6.3 Medium
- signalk signalk-serverSignal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs9.3 Critical
- Show moreLoading…