CVEs published in October 2026
17,265 vulnerabilities, 1,627 critical, 21 exploited.
- unknown bulk media registerBulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal7.2 High
- unknown essential addons for elementorEssential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_role4.2 Medium
- kendysond payment forms for paystackPayment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page4.9 Medium
- buildwps ppwp – password protect pagesPPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision7.2 High
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag6.5 Medium
- brainstormforce spectra legacy – gutenberg blocksSpectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters6.5 Medium
- wordpress, wordpress core +1 moreWordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution8.1 High
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization7.2 High
- smub photo gallery, sliders, proofing and themes – nextgen galleryPhoto Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML5.4 Medium
- tigroumeow meow lightboxMeow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization7.2 High
- kstover ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderNinja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name5.4 Medium
- softiron hypercloudSoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields7.4 High
- drupal file force downloadFile Force Download for Drupal 7 Access Bypass via Unconditional Download Headers8.7 High
- drupal field collection for drupal 7Field Collection for Drupal 7 access bypass via missing parent entity access check5.3 Medium
- pow-auth assentUnverified Sign in with Apple callback parameter can override verified ID token claims9.3 Critical
- @signalk resources-provider, signalk signalk-server +1 moreSignal K Server: Unauthenticated path traversal in resources-provider v2 API leads to JWT secret disclosure, admin impersonation and remote code execution9.8 Critical
- imgproxyimgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow9.3 Critical
- imgproxyimgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader8.7 High
- imgproxyimgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader8.7 High
github.com/anacrolix/torrentGoanacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS6.5 Mediumadminneo-org/adminneoPackagistAdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE6.9 Mediumadminneo-org/adminneoPackagistAdminNeo SQLite Database-List Drop Arbitrary File Deletion8.1 Highadminneo-org/adminneoPackagistAdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers8.2 Highadminneo-org/adminneoPackagistAdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)8.2 Highadminneo-org/adminneoPackagistAdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)7.2 Highadminneo-org/adminneoPackagistAdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery6.8 Medium- nationalsecurityagency emissaryNationalSecurityAgency/emissary: Incomplete fix for CVE-2026-35571: SSRF4.8 Medium
- sgbett secp256k1-nativesecp256k1-native: Compiler-reconstructed secret-dependent branch in native scalar multiplication5.9 Medium
- roostorg coopCoop sessions are not invalidated on password reset2.3 Low
- roostorg coopCoop has SAML cross-tenant authentication bypass7.4 High
- roostorg coopCoop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser5.3 Medium
- roostorg coopCoop has a data leak via unauthenticated GraphQL Query.allOrgs8.7 High
- roostorg coopCoop: Unauthenticated org provisioning via GraphQL Mutation.createOrg6.9 Medium
- i18nexti18next: Shared built-in corruption through inherited-key deepExtend recursion5.9 Medium
- inex ixp-managerIXP Manager has authenticated non-administrator privilege escalation8.8 High
- inex ixp-managerIXP Manager has Broken Object-Level Authorization8.3 High
- @mikro-orm sqlOpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution8.7 High
- fctr-id okta-ai-agentTAKO AI Agent for Okta: Authenticated Python execution through validator bypass8.8 High
- fctr-id okta-ai-agentTAKO AI Agent for Okta: Unauthenticated first-run administrator takeover9.8 Critical
- christianhelle refitterRefitter: C# source injection through OpenAPI header parameter names8.6 High
- christianhelle refitterRefitter: C# source injection through OpenAPI content-type map keys8.6 High
- christianhelle refitterRefitter: C# source injection through OpenAPI path keys8.6 High
- hasenbanck sevenz-rust2sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites6.1 Medium
- hackerone aedesAedes has Uncaught Exception and Uncontrolled Resource Consumption7.5 High
- hulumi policiesKubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules6.3 Medium
- hargata lubelogLubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration6.5 Medium
- cesnet netopeer2netopeer2-server logging has format string vulnerability via subtree filter7.1 High
- openwrt uhttpduhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching6.9 Medium
- openwrt uhttpduhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset3.7 Low
- openwrt uhttpduhttpd: HTTP request smuggling via ubus POST body parse-error desync6.9 Medium
- Show moreLoading…