CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- progress software ws ftp serverHost Administrator Path Containment Bypass in Progress WS_FTP Server9.1 Critical
- progress software ws ftp serverPrivilege Escalation via Missing Authorization in WS_FTP Manager9.1 Critical
- progress software ws ftp serverWeb Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server4.3 Medium
- progress software ws ftp serverPassword Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server6.6 Medium
- progress software ws ftp serverSSH Multi-Factor Authentication Bypass in Progress WS_FTP Server6.8 Medium
- progress software ws ftp serverImproper Authentication in Progress WS_FTP Server10.0 Critical
- rt-labs p-netResource exhaustion from RPC sessions kept for requests to unknown interface8.7 High
- rt-labs p-netAlarm data length not validated against received frame length2.3 Low
- rt-labs p-netOut-of-bounds read of DCP block header in DCP Set and Identify request parsing5.3 Medium
- rt-labs p-netNULL pointer dereference on implicit read of user specific record index8.7 High
- rt-labs p-netResource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness8.7 High
- progress software ws ftp serverInformation Disclosure in Ad Hoc Transfer in Progress WS_FTP Server7.7 High
- rt-labs p-netInteger underflow leads to out-of-bounds read in pf_cpm_c_data_ind()7.1 High
- rt-labs p-netMissing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()7.1 High
- rt-labs p-netNULL pointer dereference on implicit read of AR specific record index8.7 High
- rt-labs p-netOut-of-bounds write when parsing AR Vendor Block requests9.3 Critical
- rt-labs p-netInfinite loop when reading PDPortDataCheck record of subslot 08.7 High
- rt-labs p-netOut-of-bounds write in CheckPeers block parser due to unvalidated peer station name length7.2 High
- opentext advanced authentication serverLogon bypass (trust of attacker-controlled completed-methods list)9.2 Critical
- opentext advanced authentication serverEndpoint credential minting (insecure default allow-list)2.9 Low
- nicdark hotel bookingWordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability6.5 Medium
- themeum wp crowdfundingWordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability7.5 High
- boss media buddyboss platform, buddyboss platform +1 moreWordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability8.8 High
- 10web social photo feed, unknown 10web social photo feed +1 moreWordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability8.8 High
- social snap snapWordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability8.8 High
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreWordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability7.2 High
- pixelyoursite product catalog feed by pixelyoursiteWordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability7.2 High
- fast themes sastra essential addons for elementorWordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability7.2 High
- frisbii payWordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability8.8 High
- dbarrere wp media foldersWordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability8.8 High
- daman jeet finale liteWordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability7.2 High
- blazethemes news kit elementor addonsWordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability8.8 High
- mypos payments checkoutWordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability7.2 High
- buddydev buddypress xprofile custom field typesWordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability8.8 High
- sosidee dynamic qr code – generatorWordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability8.8 High
- dotstore extra fees plugin for woocommerceWordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability8.8 High
- gesundheit bewegt gmbh zippyWordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability7.2 High
- arni cinco wpcargo track & traceWordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability7.2 High
- bob chained quizWordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- zoho flow flowWordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability9.8 Critical
- themerex gunslingerWordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex good homesWordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability9.8 Critical
- themerex gamicWordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability9.8 Critical
- themerex gamezoneWordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex emojinationWordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability9.8 Critical
- themerex edge decorWordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability9.8 Critical
- themerex coinpressWordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability9.8 Critical
- themerex bonbonWordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability9.8 Critical
- themerex avventureWordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability9.8 Critical
- themerex filmaxWordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability9.8 Critical
- Show moreLoading…