CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- randombit botanBotan: Python binding bcrypt APIs truncate passwords containing embedded NULs4.8 Medium
- randombit botanBotan: Online OCSP redirects enable blind requests to internal HTTP services6.1 Medium
- randombit botanBotan: AutoSeeded_RNG can become reinitialized from predictable data after clearing state7.3 High
- isaacs minimatchminimatch: potential denial of service via globparts amplification6.9 Medium
- sigstore sigstore-js@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location7.4 High
- monkeytypegame monkeytypeMonkeytype: fork PR can execute code with elevated GITHUB_TOKEN9.3 Critical
- rapid7 insight agentRapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path7.8 High
twistedPyPITwisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset7.5 High- shopify appShopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps7.6 High
- centreonAuthenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.07.2 High
- flexera flexnet publisherFlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability8.6 High
- kubeflow pipelinesKubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory7.5 High
- aws aws-privateca-issuerIncorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes8.4 High
@eeacms/volto-chatbotnpm@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy8.2 High- rgrove crassCrass: Non-ASCII characters cause superlinear CPU consumption6.3 Medium
- rgrove crassCrass: A large number of adjacent CSS comments can trigger a SystemStackError6.3 Medium
- rgrove crassCrass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage6.3 Medium
- kubeflow pipelinesKubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads6.5 Medium
cedar-policycrates.io,@cedar-policy/cedar-wasmnpm +1 moreCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence2.1 Low- sylphxai pdf-reader-mcpPDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY7.5 High
- daptinDaptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware8.7 High
- silverstripe silverstripe-mfaSilverstripe MFA: Can bypass MFA during password reset flow4.2 Medium
- kubeflow pipelinesKubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant7.5 High
- centreonBroken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure6.5 Medium
- openwallet-foundation @sd-jwt/core, @sd-jwt/decode +1 moreSD JWT JS: Tampered disclosures silently dropped instead of rejected7.1 High
- kubeflow pipelinesKubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source7.5 High
- keepassxcKeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses4.1 Medium
- centreonBroken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users5.4 Medium
- elated-themes frappeFrappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload9.4 Critical
- elated-themes frappeFrappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields8.7 High
- zitadelZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval8.6 High
- zitadelZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie9.1 Critical
- zitadelZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection8.6 High
- parse-community parse-serverParse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys2.3 Low
- parse-community parse-serverParse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields2.3 Low
- imagemagickImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option4.8 Medium
- imagemagickImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder6.3 Medium
- unclecode crawl4aiCrawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check6.9 Medium
- unclecode crawl4aiCrawl4AI 0.9.0 before 0.9.5 JavaScript Injection via css_selector and wait_for5.3 Medium
- unclecode crawl4aiCrawl4AI 0.9.0 before 0.9.5 Untrusted Model Loading via CosineStrategy model_name7.7 High
- unclecode crawl4aiCrawl4AI before 0.9.5 Denial of Service via Unbounded CrawlerRunConfig Delay Fields8.7 High
- unclecode crawl4aiCrawl4AI before 0.9.5 Improper Certificate Validation via Hard-coded Chromium Flags8.3 High
- progress software ws ftp serverServer-Side Script Injection in Manager Web UI in Progress WS_FTP Server6.6 Medium
- progress software ws ftp serverPath Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server5.3 Medium
- progress software ws ftp serverUnauthenticated Ad Hoc Transfer Resource Exhaustion in Progress WS_FTP Server5.3 Medium
- progress software ws ftp serverPre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server7.5 High
- progress software ws ftp serverOS Command Injection in Progress WS_FTP Server9.9 Critical
- progress software ws ftp serverImproper Access Control of Web Admin Console in Progress WS_FTP Server8.1 High
- progress software ws ftp serverVirtual Folder Path Confinement Bypass in Progress WS_FTP Server9.1 Critical
- progress software ws ftp serverCommand Injection via FTP Notification Variables in Progress WS_FTP Server9.0 Critical
- Show moreLoading…