CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber6.0 Medium
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal7.1 High
- louislam uptime-kumaUptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler6.3 Medium
- jellyfinJellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions7.1 High
- jellyfinJellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}5.1 Medium
- jellyfinJellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images7.1 High
- getlago lagoLago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook2.3 Low
- forgejoForgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}5.3 Medium
- forgejoForgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo6.8 Medium
- forgejoForgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery6.9 Medium
- phpmyadminphpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set5.3 Medium
- phpmyadminphpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled6.3 Medium
- phpmyadminphpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting2.3 Low
- phpmyadminphpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql7.7 High
- opnsense coreOPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP5.3 Medium
- opnsense coreOPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity6.1 Medium
- juspay hyperswitchHyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector8.2 High
- juspay hyperswitchHyperswitch through 1.128.0 Missing Authorization in Payout Confirmation8.2 High
- getlago lagoLago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation8.7 High
- cakephpCakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation9.2 Critical
- cakephpCakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()9.2 Critical
- cakephpCakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching6.3 Medium
- cakephpCakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type6.3 Medium
- bitwarden serverBitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create5.3 Medium
- opnsense coreOPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting8.6 High
- n8n-io n8nn8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes8.7 High
- element-hq element-desktop, element-web +1 moreElement Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters7.1 High
- sqliteSQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()8.5 High
- sqliteSQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()6.8 Medium
- sqliteSQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING2.0 Low
- sqliteSQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain6.8 Medium
- sqliteSQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch6.8 Medium
- sqliteSQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()8.5 High
- sqliteSQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()8.5 High
- sqliteSQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()6.8 Medium
- sqliteSQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()6.8 Medium
- proftpdProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass6.0 Medium
- proftpdProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass5.3 Medium
- proftpdProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap6.3 Medium
suseconnect-ngSUSESecurity update for suseconnect-ngNo score- clickhouse, clickhouse cloud +1 moreUnauthenticated RCE vulnerability against ClickHouse Server9.5 Critical
- delta electronics ufc500Missing authentication check on POST/PUT requests8.7 High
- delta electronics ufc500Use of default password based on serial number8.7 High
- delta electronics ufc500Default WebUI passwords stored in plaintext8.4 High
- delta electronics ufc500Missing brute-force protection for web interface5.3 Medium
- dahua intelligent connection centerDahua Intelligent Connection Center command injection9.8 Critical
- google cloud identity platform and firebase authenticationCross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID8.7 High
org.springframework:spring-coreRoot,io.root.org.springframework:spring-coreRoot,io.root.org.springframework:spring-webRoot +1 more +3 moreAIKIDO-2026-11158 in org.springframework:spring-core - Patched by RootNo score- forocoches comments editorDisplay of information in the Forocoches comments editor8.2 High
- elixir-lang elixirInsecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build5.4 Medium
- Show moreLoading…