CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- christianhelle refitterRefitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion7.1 High
- litesaml lightsamlLightSAML: Signature reference wrapping permits unsigned assertion claims8.1 High
- element-hq element-callElement Call exposes shared passwords in logs5.9 Medium
- tryghost activitypubActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts5.3 Medium
- aces lorisLORIS has incorrect access checks in issue_tracker4.3 Medium
- aces lorisLORIS has incorrect access checks in API for Imaging Browser6.3 Medium
- trailofbits ficklingFickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis8.8 High
- unknown pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields7.5 High
- trailofbits ficklingFickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables8.8 High
- shopperdotcom shopperShopper: customer detail IDOR exposes administrator and staff records6.5 Medium
- shopperdotcom shopperShopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation8.7 High
- shopperdotcom shopperShopper: missing variant-delete authorization permits destructive single and bulk actions8.1 High
- h2o picotlsPicotls has NULL pointer dereference during handshake, when running as a client6.5 Medium
- agamnentzar ag-psdag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)7.5 High
- roziscoding jackjack: upstream error responses expose backend and peer credentials8.4 High
- sinamics ztnetZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser8.1 High
- esp32async espasyncwebserverESPAsyncWebServer multipart parser has null-pointer write7.5 High
- sabnzbdSABnzbd: Orphan-job path traversal permits arbitrary file deletion7.0 High
- libriscvlibriscv: Out of bounds read vuln in the ELF parser (Denial of service)7.9 High
- arsmotorin dreamdisplaysDream Displays has command-line argument injection in yt-dlp invocation8.7 High
- zoeille picsou-financePicsou vulnerable to login timing attack5.3 Medium
- libredwgLibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling3.3 Low
- libredwgLibreDWG: unbounded allocation in pre-R13 DWG entity decoding5.5 Medium
- libredwgLibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing5.5 Medium
- ring-clojure ringRing's nested-params middleware has inefficient regular expression complexity7.5 High
- gojue molingMoLing: unauthenticated SSE and wildcard CORS expose tool sessions9.6 Critical
- stirling-tools stirling-pdfStirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read6.8 Medium
- minecanton209 novumosNovumOS: Nova Interpreter Privilege Escalation8.6 High
- mqttsnet thinglinksThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection9.1 Critical
- stirling-tools stirling-pdfStirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass5.3 Medium
- mqttsnet thinglinksThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks9.9 Critical
- phoenixframework phoenix htmlPhoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/15.3 Medium
- tesseract-ocr tesseractTesseract: File-controlled pointers still reach `delete` in ADAPT_CLASS_STRUCT destructor0.0 None
pypa/gh-action-pypi-publishGitHub Actionspypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI9.3 Critical- tesseract-ocr tesseractTesseract: GENERIC_2D_ARRAY DeSerializeSize signed integer comparison bypass allows negative dimensions5.5 Medium
- deadtrickster ssl verify funssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary9.1 Critical
- metalamaMetalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution7.3 High
- filecoin-project filecoin-pinFilecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources6.5 Medium
- tesseract-ocr tesseractTesseract: Crafted LSTM model (`WeightMatrix` mode byte) triggers `ASSERT_HOST` abort in `WeightMatrix::DeSerializeOld` under `FAST_FLOAT` — Denial of Service5.5 Medium
- filecoin-project filecoin-pinFilecoin Pin: Fork bypass in the privileged GitHub Actions workflow8.2 High
- tesseract-ocr tesseractTesseract: Double free and use after free in the PAGE XML renderer on right-to-left pages6.9 Medium
- infiniflow ragflowRAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization7.1 High
- basekick-labs arcArc: DuckDB I/O aliases bypass database RBAC after CVE-2026-477356.5 Medium
- openvm-org openvmOpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots8.7 High
- openvm-org openvmOpenVM's OpenVmHalo2Verifier self-call can bypass proof verification8.7 High
- pi-holePi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink7.8 High
- pi-holePi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass7.8 High
- openvm-org openvmOpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments6.9 Medium
- pi-holePi-hole: file:// adlist read check and curl can resolve different files2.2 Low
- axiom-crypto snark-verifierSNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements6.9 Medium
- Show moreLoading…