CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder 22.10.2026 9.2
CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 22.10.2026 10
CVE-2026-112832 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability 22.10.2026 9.8
CVE-2021-48014 FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer 22.10.2026 9.3
CVE-2021-48016 DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php 22.10.2026 9.3
CVE-2026-115324 mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store 22.10.2026 9.2
CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability 22.10.2026 9.8
CVE-2026-112327 WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability 22.10.2026 9.3
CVE-2026-114219 NewType Infortech｜NT OneAPP - Hard-coded Credentials 22.10.2026 9.1
CVE-2026-114220 NewType Infortech｜NT OneAPP - Improper Certificate Validation 22.10.2026 9.3
CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints 22.10.2026 9
CVE-2026-114575 TOTOLINK A950RG product.so UploadCustomModule command injection 22.10.2026 10
CVE-2026-110264 Integer Overflow or Wraparound in GitLab 22.10.2026 10
CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials 21.10.2026 9.2
CVE-2026-114383 TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow 21.10.2026 10
CVE-2026-114382 TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow 21.10.2026 10
CVE-2026-91403 21.10.2026 9.1
CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions 21.10.2026 9.8
CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route 21.10.2026 9.1
CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket() 21.10.2026 9.4
CVE-2026-111811 Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication 21.10.2026 9.4
CVE-2026-114268 Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow 21.10.2026 9.4
CVE-2026-111816 Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out 21.10.2026 9.2
CVE-2025-31699 Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling 21.10.2026 9.1
CVE-2026-105944 Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life 21.10.2026 10
CVE-2026-111813 Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration 21.10.2026 10
CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role 21.10.2026 9.2
CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects 21.10.2026 9.2
CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability 21.10.2026 9.8
CVE-2026-89035 MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass 21.10.2026 9.1
CVE-2026-20043 Multiple Cisco Products Snort 3 Software Hardening Release: October 2026 22.10.2026 9
CVE-2026-76466 Cisco Expressway Series Remote Code Execution Vulnerability 21.10.2026 9.8
CVE-2026-76473 Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. 22.10.2026 9.8
CVE-2026-76474 Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities 22.10.2026 9.8
CVE-2026-76475 Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities 22.10.2026 9.3
CVE-2026-113788 Lagoon core ssh service vulnerable to remote code execution 21.10.2026 9.4
CVE-2026-111832 WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability 21.10.2026 10
CVE-2026-111834 WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability 21.10.2026 9.9
CVE-2026-111852 WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability 21.10.2026 9.3
CVE-2026-109619 RCE via stale global state 22.10.2026 9.2
CVE-2026-109618 RCE via OOM corruption 21.10.2026 9.2
CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load 21.10.2026 9.2
CVE-2026-87095 21.10.2026 9.1
CVE-2026-71195 21.10.2026 9.9
CVE-2026-113744 Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow 21.10.2026 10
CVE-2026-113736 D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password 21.10.2026 9.3
CVE-2026-114053 vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision 21.10.2026 9.2
CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets 22.10.2026 9.2
CVE-2026-114108 HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE 21.10.2026 9.3
CVE-2026-114119 Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential 21.10.2026 9.3
CVE-2026-81212 DataStage on Cloud Pak for Data Improper Authorization 20.10.2026 10
CVE-2026-92559 IBM App Connect Enterprise is vulnerable to a credential exposure 20.10.2026 9.8
CVE-2026-101420 20.10.2026 9.6
CVE-2026-101446 20.10.2026 9.9
CVE-2026-101484 21.10.2026 9.8
CVE-2026-101499 21.10.2026 9.8
CVE-2026-101501 20.10.2026 9.9
CVE-2026-101503 20.10.2026 9.9
CVE-2026-101521 21.10.2026 9.8
CVE-2026-101528 20.10.2026 9.9
CVE-2026-101529 20.10.2026 9.9
CVE-2026-101537 21.10.2026 9.8
CVE-2026-101590 21.10.2026 9.1
CVE-2026-101634 21.10.2026 9.1
CVE-2026-101763 21.10.2026 9.8
CVE-2026-101765 21.10.2026 9.1
CVE-2026-101767 21.10.2026 9.8
CVE-2026-101808 21.10.2026 9.1
CVE-2026-101809 20.10.2026 10
CVE-2026-60432 21.10.2026 9.8
CVE-2026-83396 21.10.2026 9.8
CVE-2026-83397 21.10.2026 9.8
CVE-2026-83399 21.10.2026 9.8
CVE-2026-87251 21.10.2026 9.8
CVE-2026-87302 21.10.2026 9.1
CVE-2026-87337 20.10.2026 10
CVE-2026-87347 20.10.2026 9.6
CVE-2026-91214 21.10.2026 9.8
CVE-2026-91216 20.10.2026 10
CVE-2026-91218 20.10.2026 9.6
CVE-2026-91220 21.10.2026 9.8
CVE-2026-91221 20.10.2026 10
CVE-2026-91222 20.10.2026 9.9
CVE-2026-91224 20.10.2026 9.9
CVE-2026-91225 20.10.2026 9.1
CVE-2026-91230 20.10.2026 9.3
CVE-2026-91231 20.10.2026 10
CVE-2026-91232 20.10.2026 9.9
CVE-2026-91233 21.10.2026 9.8
CVE-2026-91234 21.10.2026 9.8
CVE-2026-91235 21.10.2026 9.8
CVE-2026-91236 21.10.2026 9.8
CVE-2026-91241 20.10.2026 9.1
CVE-2026-91243 20.10.2026 9.6
CVE-2026-91250 20.10.2026 9.9
CVE-2026-91251 20.10.2026 9.9
CVE-2026-91265 21.10.2026 9.1
CVE-2026-91299 20.10.2026 10
CVE-2026-91305 21.10.2026 9.1
CVE-2026-91323 21.10.2026 9.8
CVE-2026-91341 20.10.2026 9.1
CVE-2026-91354 20.10.2026 9.9
CVE-2026-91408 21.10.2026 9.8
CVE-2026-91490 21.10.2026 9.1
CVE-2026-91491 21.10.2026 9.8
CVE-2026-91495 21.10.2026 9.8
CVE-2026-91622 20.10.2026 9.3
CVE-2026-91624 21.10.2026 9.1
CVE-2026-91637 20.10.2026 9.9
CVE-2026-91638 20.10.2026 9.9
CVE-2026-91644 20.10.2026 9.3
CVE-2026-91655 20.10.2026 9.1
CVE-2026-91656 20.10.2026 9.1
CVE-2026-91658 20.10.2026 9.9
CVE-2026-91663 20.10.2026 9.9
CVE-2026-91665 21.10.2026 9.8
CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch 20.10.2026 9.1
CVE-2016-20101 Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php 20.10.2026 9.2
CVE-2026-10131 20.10.2026 9.1
CVE-2026-10132 20.10.2026 9.1
CVE-2026-10133 20.10.2026 9.1
CVE-2026-10135 20.10.2026 9.1
CVE-2026-10136 20.10.2026 9.1
CVE-2026-10137 20.10.2026 9.1
CVE-2026-10138 20.10.2026 9.1
CVE-2026-10139 20.10.2026 9.1
CVE-2026-10141 20.10.2026 9.1
CVE-2026-28763 20.10.2026 9.1
CVE-2026-33568 20.10.2026 9.1
CVE-2026-35499 20.10.2026 9.1
CVE-2026-40615 20.10.2026 9.1
CVE-2026-40627 20.10.2026 9.1
CVE-2026-41222 20.10.2026 9.1
CVE-2026-41223 20.10.2026 9.1
CVE-2026-42019 20.10.2026 9.1
CVE-2026-42020 20.10.2026 9.1
CVE-2026-42021 20.10.2026 9.1
CVE-2026-42022 20.10.2026 9.1
CVE-2026-42023 20.10.2026 9.1
CVE-2026-42024 20.10.2026 9.1
CVE-2026-42025 20.10.2026 9.1
CVE-2026-42026 20.10.2026 9.1
CVE-2026-9659 20.10.2026 9.1
CVE-2026-9660 20.10.2026 9.1
CVE-2026-9814 20.10.2026 9.1
CVE-2026-9817 20.10.2026 9.1
CVE-2026-9827 20.10.2026 9.1
CVE-2026-9869 20.10.2026 9.1
CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew 20.10.2026 9
CVE-2026-113708 Argo CD: A Kustomize remote ref can run commands in the repo-server 20.10.2026 9.9
CVE-2026-113709 Argo CD: A Kustomize Helm config home can run commands in the repo-server 21.10.2026 9.9
CVE-2026-113672 Argo CD: A Jsonnet import can read files from the repo-server 20.10.2026 9.9
CVE-2026-113802 Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler 21.10.2026 9.3
CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId 20.10.2026 9.1
CVE-2026-113506 aaPanel File Manager common.py ExecShell os command injection 20.10.2026 9.4
CVE-2026-113703 SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing 20.10.2026 9.1
CVE-2026-113613 FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin 21.10.2026 9.2
CVE-2026-113678 Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron 20.10.2026 9.4
CVE-2026-113682 Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password 20.10.2026 9.1
CVE-2026-86471 Apache CouchDB: Admin credentials leading to code execution as operating system user 21.10.2026 9.3
CVE-2026-93475 Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 20.10.2026 9.3
CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection 20.10.2026 9.4
CVE-2026-113390 DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection 20.10.2026 9.4
CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT 20.10.2026 9.8
CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection 20.10.2026 9.4
CVE-2026-105312 Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation 20.10.2026 9.9
CVE-2026-43844 20.10.2026 9.3
CVE-2026-43845 20.10.2026 9.2
CVE-2026-43836 20.10.2026 9.3
CVE-2026-43838 20.10.2026 9.2
CVE-2026-113380 20.10.2026 9.3
CVE-2026-109442 piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell 20.10.2026 9.3
CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint 20.10.2026 9.3
CVE-2026-77932 DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent 20.10.2026 9.3
CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment 20.10.2026 9.3
CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access 20.10.2026 9.3
CVE-2026-112371 H3C Magic NX15 RPC esps write code injection 20.10.2026 9.4
CVE-2026-112370 H3C Magic NX15 usrlist sub_416874 os command injection 19.10.2026 9.4
CVE-2026-112900 Pillow: Argument Injection in Ghostscript call, potentially leading into RCE 20.10.2026 9.2
CVE-2026-112403 Pillow: Heap buffer overflow in ImagingJpegDecode 19.10.2026 9.2
CVE-2026-112398 Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution 19.10.2026 9.2
CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO 19.10.2026 9.2
CVE-2026-112776 Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations 20.10.2026 9.3
CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass 20.10.2026 9.3
CVE-2026-112780 Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@ 19.10.2026 9.3
CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend 20.10.2026 9.2
CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack 20.10.2026 9.1
CVE-2026-107188 Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 20.10.2026 9.6
CVE-2026-111862 Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code 20.10.2026 9.8
CVE-2026-111057 Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass 19.10.2026 10
CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels 19.10.2026 9.8
CVE-2026-109432 Camunda Expression Injection via orQueries RCE 19.10.2026 9.3
CVE-2026-112292 CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules 19.10.2026 9.3
CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials 19.10.2026 9.3
CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) 20.10.2026 10
CVE-2026-110887 WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability 19.10.2026 9.9
CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability 19.10.2026 9.9
CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM) 19.10.2026 9.3
CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM) 19.10.2026 9.3
CVE-2026-108983 GV-ASManager Web Server Command Injection Vulnerability 19.10.2026 9.8
CVE-2026-111998 Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway 19.10.2026 9.3
CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor 22.10.2026 9.2
CVE-2026-109894 WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability 19.10.2026 9.3
CVE-2026-110372 WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability 19.10.2026 9.8
CVE-2026-110886 WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability 19.10.2026 9.8
CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection 19.10.2026 9.3
CVE-2026-104736 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter 18.10.2026 9.8
CVE-2026-110653 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter 18.10.2026 9.1
CVE-2026-111823 19.10.2026 9.8
CVE-2026-96620 Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution 21.10.2026 9.2
CVE-2026-102608 ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) 19.10.2026 9
CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers 16.10.2026 9.3
CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret 16.10.2026 9.2
CVE-2026-111641 FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints 16.10.2026 9.3
CVE-2026-111643 Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback 16.10.2026 9.3
CVE-2026-111663 Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation 16.10.2026 9.2
CVE-2026-111673 IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints 16.10.2026 9.3
CVE-2026-111675 Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover 19.10.2026 9.1
CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint 16.10.2026 9.3
CVE-2026-111690 Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass 19.10.2026 9.3
CVE-2026-111691 WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header 16.10.2026 9.1
CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret 16.10.2026 9.3
CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials 16.10.2026 9.3
CVE-2026-111704 LangChat through commit 2a6285a Missing Authentication on REST API Controllers 21.10.2026 9.3
CVE-2026-111708 WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup 16.10.2026 9.3
CVE-2026-111711 Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok() 16.10.2026 9.3
CVE-2026-102551 Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling 19.10.2026 9.2
CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel 20.10.2026 9.3
CVE-2026-109588 Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel 20.10.2026 9.3
CVE-2026-102692 RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access 16.10.2026 9.1
CVE-2026-102693 RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID 16.10.2026 9.6
CVE-2026-49868 RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read 21.10.2026 9.8
CVE-2026-85746 MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections 16.10.2026 9.9
CVE-2026-85748 MariaDB: Use-after-free with a large number of SYS_REFCURSOR's 16.10.2026 9.9
CVE-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. 21.10.2026 9.9
CVE-2026-57169 Dockhand: Unauthenticated container exec via WebSocket upgrade 16.10.2026 9.6
CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context 21.10.2026 9
CVE-2026-105279 J4Care dcm4che Missing Authentication for Critical Function 16.10.2026 9.3
CVE-2026-107617 Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials 16.10.2026 9.3
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller 18.10.2026 9.6
CVE-2026-111391 SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter 16.10.2026 9.2
CVE-2026-111472 SQL injection in TSG Profleet 16.10.2026 9.3

Latest Updates

CVE Title Updated Score
CVE-2026-115496 Workflow names may be leaked to unauthenticated users in KNIME Business Hub 22.10.2026
CVE-2026-114487 22.10.2026
CVE-2026-114485 22.10.2026
CVE-2026-114486 22.10.2026
CVE-2026-115494 CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub 22.10.2026
CVE-2026-51954 22.10.2026
CVE-2026-114603 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api 22.10.2026 5.3
CVE-2026-115453 Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries 22.10.2026
CVE-2026-115454 Large tables in data apps can bring down execution services in KNIME Hub 22.10.2026
CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions 22.10.2026
CVE-2026-115450 Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier 22.10.2026
CVE-2026-115482 22.10.2026 7.5
CVE-2026-114515 OCO-Server: Self-Service Portal uninstall-job authorization bypass 22.10.2026 6.5
CVE-2026-61791 OCO-Server: Stored XSS through agent hostnames in command buttons 22.10.2026 7.4
CVE-2026-16477 Insecure Deserialization of .cleanshot Files in CleanShot X 22.10.2026
CVE-2026-114510 Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content 22.10.2026 7.1
CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body 22.10.2026 7.5
CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown 22.10.2026 7.5
CVE-2026-78801 22.10.2026
CVE-2026-78846 22.10.2026
CVE-2026-107079 22.10.2026
CVE-2026-89409 Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes​ 22.10.2026
CVE-2026-89410 Out-of-bounds read in Z-Wave NCP SPI Handler 22.10.2026
CVE-2026-115249 subhajitkhan online-clinic-management-system Appointment Booking patappointtime.php input validation 22.10.2026
CVE-2026-66279 Dis-connect vulnerability in Connect Stack 22.10.2026
CVE-2026-66281 Authenticated Denial-of-Service in Zigbee Discover Attributes Handling 22.10.2026
CVE-2026-66282 Authenticated Denial-of-Service in Zigbee Publish Billing Period 22.10.2026
CVE-2026-85079 Out-of-bounds write in Zigbee Simple_Desc_req handling 22.10.2026
CVE-2026-85080 Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling 22.10.2026
CVE-2026-94502 Out-of-bounds write in Zigbee Publish Price Matrix handling 22.10.2026
CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder 22.10.2026
CVE-2026-113582 Apache Abdera: XML external entity expansion in Atom document parsing 22.10.2026
CVE-2026-115248 subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow 22.10.2026
CVE-2026-92709 Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE 22.10.2026 8.1
CVE-2026-115247 subhajitkhan online-clinic-management-system patientregistration.php missing encryption 22.10.2026
CVE-2026-115400 crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens 22.10.2026
CVE-2026-115411 crawlseo before 0.2.4 Server-Side Request Forgery via Crawler 22.10.2026
CVE-2026-115246 subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting 22.10.2026
CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 22.10.2026
CVE-2026-112822 WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability 22.10.2026 8.5
CVE-2026-112832 WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability 22.10.2026 9.8
CVE-2026-112842 WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability 22.10.2026 6.5
CVE-2017-20287 Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter 22.10.2026
CVE-2017-20288 QCubed 3.1.1 Reflected XSS via installer step_2.php 22.10.2026
CVE-2017-20289 Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter 22.10.2026
CVE-2017-20290 Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed 22.10.2026
CVE-2018-25438 Intermesh Group-Office < 3.5.5 Path Traversal via compress.php 22.10.2026
CVE-2018-25439 MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter 22.10.2026
CVE-2019-25778 SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter 22.10.2026
CVE-2019-25779 WooThemes Diarise 1.5.9 Local File Disclosure via download.php 22.10.2026
CVE-2020-37284 Sickbeard build-507 Reflected XSS via testNaming pattern Parameter 22.10.2026
CVE-2021-48013 Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload 22.10.2026
CVE-2021-48014 FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer 22.10.2026
CVE-2021-48015 JeeWMS Path Traversal via showOrDownByurl.do 22.10.2026
CVE-2021-48016 DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php 22.10.2026
CVE-2021-48017 OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi 22.10.2026
CVE-2022-51021 NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint 22.10.2026
CVE-2022-51022 YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint 22.10.2026
CVE-2022-51023 PHPOK < 5.4.081 SQL Injection via api.php sort Parameter 22.10.2026
CVE-2022-51024 Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint 22.10.2026
CVE-2022-51025 Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer 22.10.2026
CVE-2023-54413 WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang 22.10.2026
CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php 22.10.2026
CVE-2024-58394 Retool 3.88.0 XSS via /api/imageProxy SVG Proxying 22.10.2026
CVE-2024-58396 YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId 22.10.2026
CVE-2025-71434 Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list 22.10.2026
CVE-2026-114665 Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare 22.10.2026
CVE-2026-115319 fzf 0.36.0 through 0.74.5 Denial of Service via maskActionContents 22.10.2026
CVE-2026-115321 Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment 22.10.2026
CVE-2026-115322 Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers 22.10.2026
CVE-2026-115323 EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API 22.10.2026
CVE-2026-115324 mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store 22.10.2026
CVE-2026-115325 Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup 22.10.2026
CVE-2026-115326 QloApps through 1.7.0 IDOR via OrderDetailController Refund Request 22.10.2026
CVE-2026-115327 libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser 22.10.2026
CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API 22.10.2026
CVE-2026-115329 Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet 22.10.2026
CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics 22.10.2026
CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters 22.10.2026
CVE-2026-115332 Lotus through 0.10.2 SQL Injection via Subscription Filter Keys 22.10.2026
CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix 22.10.2026
CVE-2026-115334 Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint 22.10.2026
CVE-2026-13411 Null condition in Playbooks import crashes the plugin 22.10.2026 4.3
CVE-2026-111079 Goose: goose: shell history and environment leak via terminal integration 22.10.2026
CVE-2026-112313 WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability 22.10.2026 7.1
CVE-2026-112820 WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability 22.10.2026 8.1
CVE-2026-115207 Patch: filename validation bypass in reversal fallback allows file creation outside the working directory 22.10.2026
CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades 22.10.2026 8.2
CVE-2026-114348 webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint 22.10.2026 5.3
CVE-2026-106017 22.10.2026
CVE-2026-114702 WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability 22.10.2026 6.5
CVE-2026-114703 WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability 22.10.2026 6.5
CVE-2026-21811 Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) 22.10.2026 3.8
CVE-2026-21812 Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149) 22.10.2026 2.2
CVE-2026-110974 Uncontrolled Recursion on Nested JSON Allows Denial of Service in android-json 22.10.2026
CVE-2026-111842 WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability 22.10.2026 5.3
CVE-2026-112218 WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability 22.10.2026 5.3
CVE-2026-114195 WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability 22.10.2026 5.3
CVE-2026-114696 WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability 22.10.2026 5.3
CVE-2026-114699 WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability 22.10.2026 5.3
CVE-2026-114700 WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability 22.10.2026 6.5
CVE-2026-114701 WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability 22.10.2026 6.5
CVE-2026-115253 WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering 22.10.2026
CVE-2026-96293 Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File 22.10.2026
CVE-2026-111830 WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability 22.10.2026 7.1
CVE-2026-111851 WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability 22.10.2026 7.6
CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability 22.10.2026 9.8
CVE-2026-112242 WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability 22.10.2026 8.8
CVE-2026-112311 WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability 22.10.2026 6.5
CVE-2026-112312 WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability 22.10.2026 7.5