CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files5.9 Medium
- py-pdf pypdfpypdf: Possible large memory usage when parsing cross-reference streams7.1 High
- py-pdf pypdfpypdf: Possible long runtimes/large memory usage for encrypted PDF files7.1 High
- py-pdf pypdfpypdf: Possible large memory usage for exceptions in strict mode7.1 High
- py-pdf pypdfpypdf: Possible long runtimes when retrieving page labels7.1 High
- py-pdf pypdfpypdf: Possible infinite loop when cloning dictionaries7.1 High
- bricks themeBricks Theme Broken Access Control via load_popup_content7.5 High
- py-pdf pypdfpypdf: Possible large memory usage when parsing page tree7.1 High
- py-pdf pypdfpypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search7.1 High
- hapijs content@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service7.5 High
- @clerk nuxtNuxt dev server exposes generated appSecret through Vite file serving4.8 Medium
- @clerk nuxt, @nuxt nitro-server +1 moreNuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes6.5 Medium
- @clerk nuxtNuxt dev server exposes private runtime config through the Nitro dev bundle5.9 Medium
- @clerk nuxtNuxt dev server arbitrary file read through client error reports5.9 Medium
- red hat openshift container platform 4.14, openshift container platform 4.15, openshift container platform 4.16 +3 more +5 moreOpenshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification7.4 High
- pyasn1pyasn1: Quadratic-complexity denial of service in binary REAL decoding7.5 High
- pyasn1pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding7.5 High
- pyasn1pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding7.5 High
- pyasn1pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding7.5 High
- sebastianbergmann phpunitPHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling5.4 Medium
- digitalbazaar forgeForge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer7.5 High
- digitalbazaar forgeForge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.137.4 High
- digitalbazaar forgeForge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage5.9 Medium
- digitalbazaar forgeForge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message7.5 High
- servicenow ai platformSandbox Escape via Table Rotation in ServiceNow AI Platform9.4 Critical
- servicenow ai platformDomain Separation Bypass in ServiceNow AI Platform5.3 Medium
- digitalbazaar forgeForge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)2.9 Low
- digitalbazaar forgeForge: TLS client crash when the server sends no certificate5.9 Medium
- digitalbazaar forgeForge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie4.8 Medium
- servicenow ai platformCleartext Storage of OAuth Credentials in ServiceNow AI Platform7.1 High
- digitalbazaar forgeForge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption3.7 Low
- digitalbazaar forgeForge: ASN.1 OID first arc truncation in asn1.oidToDer3.7 Low
- digitalbazaar forgeForge: Certificate signature verified with the issuer's RSA signature scheme3.7 Low
- ubiquiti inc wifiman desktop for macosA malicious actor with local access and high privileges could exploit an Improper Access Control...6.7 Medium
- isaacs node-globGlob: AbortSignal cancellation bypass allows post-timeout filesystem traversal6.3 Medium
- ubiquiti inc wifiman desktopA malicious actor with local access and low privileges could exploit an External Control of File...7.8 High
- ubiquiti inc wifiman desktopA malicious actor with access to the network could exploit a Binding to an Unrestricted IP...7.5 High
- vtkAn invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation...7.5 High
- vtkA memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk ...7.5 High
- vtkAn invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2...7.5 High
- vtkA out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk ...8.2 High
- vtkA memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation...7.5 High
- vtkA heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets...7.5 High
- @hapi joijoi: quadratic-time split in `string().email({ multiple: true })` allows denial of service7.5 High
- hashicorp nomad, nomad enterprise +1 moreNomad allocation data migration may allow host directory permission modification via symlink following8.8 High
- hashicorp nomad, nomad enterprise +1 moreNomad dispatch payload writes can escape the allocation directory through symlinks8.4 High
- hashicorp nomad, nomad enterprise +1 moreNomad vulnerable to cross-namespace information disclosure in multiple endpoints4.3 Medium
- python software foundation cpythonsocket.getaddrinfo() accepts embedded null bytes in host and port5.3 Medium
- randombit botanBotan: Integer overflow when reporting block size in FFI can cause memory corruption9.2 Critical
- randombit botanBotan: CLI utility `ocsp_check` accepts unauthenticated responses5.9 Medium
- Show moreLoading…