CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- 37954679 cak-filemanagement-system37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload6.9 Medium
- the gnu c library glibcgettext: Directory traversal via the LANGUAGE environment variable7.0 High
- freertos freertos-kernelMissing type validation in xQueueSelectFromSet in FreeRTOS-Kernel8.2 High
- jetbrains clion, datagrip, goland +8 more +10 moreIn JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the...9.0 Critical
- jetbrains clion, datagrip, dataspell +8 more +10 moreIn JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4,...8.0 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability4.4 Medium
- its-a-feature mythicMythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview7.4 High
- thechangelog changelog.comchangelog.com before commit 7b35e829 Missing Authorization via Preview Routes6.9 Medium
- axigen mail serverAxigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests8.7 High
- axigen mail serverAxigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name5.3 Medium
- dlundquist sniproxysniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()8.7 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload7.5 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter6.4 Medium
- themifyme themify builderThemify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field6.4 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments5.4 Medium
- akbilisim ak frameworkAk Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update8.8 High
- themefusion avada | website builder for wordpress & woocommerceAvada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field8.1 High
- wpdevteam easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solutioneasy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter7.2 High
- independent analytics proIndependent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter7.2 High
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision7.4 High
- ahmadmj majestic support – the leading-edge help desk & customer support pluginMajestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter6.5 Medium
- wordpressdotorg openstation – admin dashboard notes, custom dashboard, ai assistant & pwaOpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via…4.3 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id6.4 Medium
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter6.5 Medium
- wedevs erp: complete hr, accounting & crm suite built for woocommerceERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body7.2 High
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- rabilal js help desk – ai-powered support & ticketing systemJS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter4.9 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter7.5 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter6.5 Medium
- saadiqbal email templates customizer and designer for wordpress and woocommerceEmail Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter7.5 High
- jordy meow meow galleryMeow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)6.4 Medium
- likebtn like button rating ♥ likebtnLike Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header4.7 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection7.5 High
- jordy meow meow galleryMeow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint6.5 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreFV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute5.4 Medium
- tigroumeow database cleaner: cleanup, optimization & repairDatabase Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion8.7 High
- codepeople cp multi view events calendarCP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter6.4 Medium
- 37954679 cak-filemanagement-system37954679 cak-filemanagement-system save_student.php mysqli_query sql injection6.9 Medium
- morpheus65535 bazarrBazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery10.0 Critical
- freedom of the press securedropSecureDrop: API session token reuse against the Journalist Interface web UI5.0 Medium
- mytinywmsmyTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management8.1 High
- frappe lmsFrappe LMS allows unpublished certificate access5.3 Medium
- frappe lmsFrappe LMS: Quiz result manipulation and cross-user submission forgery5.3 Medium
org.eclipse.jetty:apache-jspTuxCare,org.eclipse.jetty:apache-jstlTuxCare,org.eclipse.jetty.demos:demo-async-rest-jarTuxCare +124 more +126 moreTuxCare security update for 123 packages (1 CVE)No score- frappe lmsFrappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amount5.3 Medium
- infonl dimpact-zaakafhandelcomponentZAC: Missing per-zaaktype authorization on by-ID decision and process reads6.5 Medium
- frappe lmsFrappe LMS has Stored XSS in Course Meta5.1 Medium
- canonical lxdImproper certificate validation in the HTTPS listener in LXD10.0 Critical
- wekanWekan: ReDoS via Unescaped User Input in RegExp6.5 Medium
dockerSUSESecurity update for dockerNo score- Show moreLoading…