CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- red hat directory server 11, directory server 12, directory server 13 +5 more +7 more389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service6.5 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions5.4 Medium
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8.1 +2 more +4 moreWildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding7.4 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8.1, jboss enterprise application platform expansion pack +1 more +3 moreWildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean6.5 Medium
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.1 +2 moreWildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization7.4 High
- jackdewey community eventsCommunity Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form8.8 High
- bplugins video player for youtubeYT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax3.8 Low
- jordy meow photo engine (media organizer & lightroom)Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR4.9 Medium
- unknown chat ai with dispatcherChat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload9.8 Critical
- paolo geodirectoryGeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure5.3 Medium
- unknown automated import products to cartAutomated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal9.9 Critical
- unknown logixfast authLogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset9.8 Critical
- unknown all-in-one security (aios), two factor authentication +1 moreTwo Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter7.5 High
- opajaap wp photo album plusWP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF4.3 Medium
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass6.8 Medium
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass6.8 Medium
- unknown hide price until loginHide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration5.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR4.3 Medium
- af themes wp post authorWP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure3.7 Low
- af themes wp post authorWP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields3.7 Low
- unknown vtablesvTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter8.6 High
- paycomet for woocommerce, unknown paycomet for woocommerce +1 morePAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass6.5 Medium
- unknown appointment booking pluginLatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings3.5 Low
- m a vinoth kumar frontend dashboard, metagauss profilegrid +1 moreFrontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection9.0 Critical
- unknown letterpressLetterPress < 2.4.0 - Admin+ Stored XSS3.5 Low
- unknown link libraryLink Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure5.3 Medium
- unknown link libraryLink Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass5.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion5.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block7.2 High
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF4.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF5.4 Medium
- unknown recipe card blocks liteRecipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure5.3 Medium
- saadiqbal password protected – protect your site content with a passwordPassword Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler6.4 Medium
- nvm-sh nvmnvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed7.1 High
- vberkel schema app structured dataSchema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter7.2 High
- ssl wireless sms notification, sslplugins ssl wireless sms notification +1 moreSSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover8.1 High
- wild-apricot wild apricot loginWild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite7.5 High
- dejanmarkovic social web suite – social media auto post, social media auto publishSocial Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter7.5 High
- brewlabs sendpress newslettersSendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter7.5 High
- mlfactory dsgvo all in one for wpDSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption7.2 High
- wp scripts food store – online food delivery & pickupFood Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie7.2 High
- guru team bot for telegram on woocommerceBot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token9.8 Critical
- frangoteamA authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version...5.6 Medium
- frangoteamA information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA ...5.3 Medium
- frangoteamA authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1...9.8 Critical
- octopus deploy serverIn affected versions of Octopus Server with the LDAP authentication provider enabled, any...5.3 Medium
- canva orttoThe Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings...4.8 Medium
- canva orttoThe Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it...5.3 Medium
- canva orttoThe Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests,...8.6 High
- apereo foundation openequellaStored XSS in pre-login notice via reachable legacy logon route4.8 Medium
- Show moreLoading…