CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- hivepress claim listingsWordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability4.3 Medium
- bplugins pdf posterWordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bmc it service management suiteStored Cross-Site Scripting in BMC ITSM Knowledge Articles5.1 Medium
- relywp simple cloudflare turnstileWordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability5.3 Medium
- kaliforms kali formsWordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ahmad wp job portalWordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability4.3 Medium
- bplugins video gallery blockWordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bmc it service management suiteStored Cross-Site Scripting in BMC ITSM Attachments4.8 Medium
- bmc it service management suiteStored Cross-Site Scripting in BMC ITSM Work Notes5.1 Medium
- cozythemes cozy blocksWordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kaliforms kali formsWordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability6.5 Medium
- bmc it service management suiteServer-Side Request Forgery in BMC ITSM SmartIT5.3 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ad inserter inserter, igor funa ad inserter +1 moreWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability6.5 Medium
- mamunur rashid the post gridWordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- rextheme product feed managerWordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability5.3 Medium
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content6.8 Medium
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation5.3 Medium
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms5.3 Medium
- open-emr openemrOpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]8.7 High
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations6.8 Medium
sn-releasescrates.io`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)8.8 Highjuniper_warpcrates.ioUnbounded memory use on large request bodies7.5 High- bytecodealliance wasmtimeWasmtime 48.0.0 before 48.0.8 TOCTOU UDP Send Policy Bypass via wasip3 Sockets5.3 Medium
- bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.8 Cross-Engine Type Confusion via StructType Supertype1.8 Low
- bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.8 Denial of Service via TypedFunc Type-Check Panic1.0 Low
- bytecodealliance wasmtimeWasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer5.9 Medium
- bytecodealliance wasmtimeWasmtime before 36.0.20 HTTP Request Smuggling via wasi-http p2 Content-Length6.3 Medium
- oapi-codegenoapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values8.7 High
- oapi-codegenoapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension7.7 High
- yamaha corporation nwr100Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure...7.1 High
- yamaha corporation nwr100Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection...9.3 Critical
- yamaha corporation lan monitor for windowsThe installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely...8.4 High
- yamaha corporation yms-vpn8, yms-vpn8-cp +1 moreYMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted...8.4 High
- yith paypal express checkout for woocommerce, yithemes yith paypal express checkout for woocommerce +1 moreWordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability5.3 Medium
- websoudan mw wp formMW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter5.3 Medium
- newsman newsmanappNewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters7.2 High
- blazethemes newsmaticNewsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter7.5 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header7.2 High
- metabox meta box – a framework for dynamic websitesMeta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys4.9 Medium
- sindresorhus open, anomalyco opencode, mcpjam inspector +2 moreopen 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows7.7 High
- sabbatic appCross-Site Request Forgery (CSRF) vulnerability in SABBATIC application4.8 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- sabbatic appStored Cross-Site Scripting (XSS) vulnerability in SABBATIC application4.8 Medium
- pluginus.net tableonWordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- wp swings upsell order bump offer for woocommerceWordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- stylemixthemes motorsWordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability9.3 Critical
- Show moreLoading…