CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- elixir-lang elixirUnbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir6.9 Medium
- elixir-lang elixirUnbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir6.3 Medium
- cloud foundry capi (cloud controller api), cf-deployment +1 moreBroken access control restriction in Cloud Controller API8.8 High
- cloud foundry capi (cloud foundry controller), cf deployment +1 moreSpace Developer can extract space-scoped broker credentials2.7 Low
- cloud foundry cf-deployment, cloud foundry foundation capi (cloud foundry controller) +1 moreCloud Controller exposes secrets in audit log6.5 Medium
- cloud foundry cf-deployment, controller (capi) +1 moreCredential exposure to space supporter6.5 Medium
- apache fineractApache Fineract: SQL injection vulnerability in Search API9.8 Critical
- cloud foundry uaa, cf-deployment +1 moreDoS Vulnerability in UAA Related to JWKS URI Handling6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGcc: out-of-bounds read in std::from_chars3.7 Low
- apache fineractApache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints8.8 High
- cap, teltonika networks atrm, dap +11 more +13 moreAPI permission bypass via logic bug9.4 Critical
haproxySUSESecurity update for haproxyNo score- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreGcc: stack overflow in std::bitset on libstdc++6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGcc: integer wrap in `std5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGcc: confirmed out-of-bounds read/write in libstdc++ parallel `std6.2 Medium
- tigroumeow ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & geminiAI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration7.5 High
- gravity forms formsGravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field9.8 Critical
- gravity forms formsGravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field7.2 High
- sswells formidable forms – contact form, survey, quiz, payment, calculator form & custom form builderFormidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter8.8 High
- wp scripts food store – online food delivery & pickupFood Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie7.2 High
- gravity forms formsGravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values7.2 High
- red hat enterprise linux 9, enterprise linux 10, enterprise linux 6 +4 more +6 moreKernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)5.9 Medium
- red hat streams for apache kafka 2, streams for apache kafka 3 +1 moreKroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules6.5 Medium
- firelightwp firelight lightboxFirelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute6.8 Medium
- themekraft buddyformsBuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification5.3 Medium
- themekraft buddyformsBuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure5.3 Medium
- dots fraud prevention for woocommerce and eddFraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting5.4 Medium
- unknown joinchatJoinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute6.8 Medium
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter4.1 Medium
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters8.8 High
- unknown user frontendWP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter4.7 Medium
- unknown security plugin, firewall & malware scanner with auto removalSecurity by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer4.4 Medium
- unknown security plugin, firewall & malware scanner with auto removalSecurity by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code7.5 High
- shortpixel enable media replaceEnable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer7.5 High
- keywordrush content egg – affiliate product importer & price comparisonContent Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter4.3 Medium
- keywordrush content egg – affiliate product importer & price comparisonContent Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action4.3 Medium
- liedekef events made easyEvents Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute6.4 Medium
- coolplugins cool formkit lite – advanced form builder for elementorCool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter6.4 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute6.5 Medium
- cyberlord92 page and post restrictionPage and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication6.5 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata6.5 Medium
- webtoffee export and import users and customersExport and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field8.8 High
- drupal doccheck basicDocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-2376.3 Medium
- drupal groupex pro ( daxko ) integrationGroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-2787.2 High
- imagination technologies graphics ddkGPU DDK - OOB write in UntwiddlePOTSquare64bpp8.8 High
- imagination technologies graphics ddkGPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB9.8 Critical
- imagination technologies graphics ddkGPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet7.1 High
- imagination technologies graphics ddkGPU DDK - libusc.so NPD due to integer overflow at ConvertSwitchToArrayLookup during WebGPU shader compilation7.5 High
- imagination technologies graphics ddkGPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change5.5 Medium
- imagination technologies graphics ddkGPU DDK - Write UAF due to missing cleanup reference for abort command submitted via PVRSRVRGXKickTA3DKM7.1 High
- Show moreLoading…