CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
request-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No scorerequest-tracker5Debian[Unknown description]No score- delinea privilege managerDelinea Privilege Manager agent unauthenticated remote code execution vulnerability8.7 High
- veeam management pack for microsoft system centerA vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform...8.8 High
- veeam management pack for microsoft system centerA vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as...8.7 High
- veeam management pack for microsoft system centerA vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on...9.3 Critical
- graphql-python graphql-coreGraphQL-core: Denial of service via memory leak in aborted validations7.5 High
libspreadsheet-xlsx-perlDebian,perl-Spreadsheet-XLSXopenSUSE +1 moreSpreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt9.8 Critical- gofiber fiberFiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads5.9 Medium
- authlib joserfcjoserfc: Compact JWS size guard allocates attacker-controlled segments before rejection6.9 Medium
- labredescefetrj wegiaWeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field8.9 High
- socfortress copilotSOCFortress CoPilot: Stored case-report template injection permits backend code execution9.0 Critical
- labredescefetrj wegiaWeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover6.3 Medium
- labredescefetrj wegiaWeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes8.1 High
- lightdashLightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key8.3 High
- docat-org docatDocat has Arbitrary File Upload exists in Upload API9.1 Critical
- tenable, inc. plugin feedIncorrect Authorization6.0 Medium
- authlib joserfcjoserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption7.5 High
- @nx gradle, maven, nrwl nx +2 moreNx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle7.3 High
- hashicorp boundary, boundary enterprise +1 moreBoundary vulnerable to server-side request forgery in Vault credential store8.7 High
- lightdashLightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key8.3 High
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths3.7 Low
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Rogue server can crash the client during caching_sha2_password authentication5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Rogue server can make the client read past the packet through server-declared lengths5.9 Medium
- mariadb-corporation mariadb-connector-jMariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets5.9 Medium
- Show moreLoading…