Exploited and new serious CVEs: October 2026

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

• SQL injection

tagdiv · tagdiv opt-in builderOct 9, 2026

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

• Pre-auth
• SQL injection

tagdiv · tagdiv opt-in builderOct 9, 2026

WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

• Pre-auth
• SQL injection

wpdreams · ajax search proOct 9, 2026

WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

yalla ya! · simple paymentOct 9, 2026

WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

• Pre-auth
• Auth bypass

liquid web / stellarwp · givewpOct 9, 2026

WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

• Pre-auth
• Auth bypass

wpmu dev · forminatorOct 9, 2026

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

• Pre-auth
• Broken access control (IDOR)

tms · ameliaOct 9, 2026

WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

damian góra · fibosearchOct 9, 2026

WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

basix · nex-formsOct 9, 2026

WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

• Pre-auth
• CSRF

fifu.app · featured image from urlOct 9, 2026

WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

welcart · welcart e-commerceOct 9, 2026

WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability

• Pre-auth
• SQL injection

multinet interactive ab · eduadmin bookingOct 9, 2026

Apache CXF: XML Signature wrapping in JAX-RS XML Security

• Pre-auth
• Race condition

apache · cxfOct 9, 2026

Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

• Pre-auth
• Denial of service

apache · cxfOct 9, 2026

Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

• Pre-auth
• Weak crypto

apache · cxfOct 9, 2026

Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

• Pre-auth
• Denial of service

apache · cxfOct 9, 2026

Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter

• Pre-auth

apache · cxfOct 9, 2026

Apache CXF: JPA authorization-code consume is non-atomic

• Pre-auth
• Race condition

apache · cxfOct 9, 2026

Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)

• Pre-auth

apache · cxfOct 9, 2026

Apache CXF: FIQL Query Parser Denial of Service

• Pre-auth
• Denial of service

apache · cxfOct 9, 2026

Apache CXF: Authentication bypass via weak cache keys for validated STS tokens

• Pre-auth
• Auth bypass

apache · cxfOct 9, 2026

Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests

• Pre-auth
• Race condition
• Denial of service

apache · cxfOct 9, 2026

Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key

• Pre-auth

Oct 9, 2026

Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation

• Local privilege escalation

Oct 9, 2026

MIKEY message MAC is never verified on receive, so forged messages are accepted

• Pre-auth

Oct 9, 2026

Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more

• Pre-auth
• Denial of service

Oct 9, 2026

Apache Camel Karavan: project file name path traversal when committing a project to Git

• Path traversal

apache software foundation · apache camel karavanOct 9, 2026

Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml

apache software foundation · apache camel karavanOct 9, 2026

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

• Deserialization

expresstech · quiz and survey masterOct 9, 2026

WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

datasolution · acymailing smtp newsletterOct 9, 2026

WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

delight star inc. · wp associate post r2Oct 9, 2026

WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

• Deserialization

mklacroix · product configurator for woocommerceOct 9, 2026

WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

• Broken access control (IDOR)

themehunk · th shop maniaOct 9, 2026

Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x

• Pre-auth
• Weak crypto

sipay electronic money and payment services inc. · opencart virtual pos moduleOct 9, 2026

Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop

• Pre-auth
• Weak crypto

sipay electronic money and payment services inc. · prestashop virtual pos moduleOct 9, 2026

Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication

switchbot · lock series lockOct 9, 2026

WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

bracketweb · treckOct 9, 2026

WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

bracketweb · ogencyOct 9, 2026

WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

bracketweb · voldorOct 9, 2026

WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

designthemes · whistle - sports clubOct 9, 2026

WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability

• Pre-auth

fuelthemes · werkstattOct 9, 2026

Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data

• pre-auth RCE
• Deserialization

grid protection alliance · openpdcOct 9, 2026

Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code

grid protection alliance · openpdcOct 9, 2026

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

• Pre-auth
• Auth bypass

grid protection alliance · openpdcOct 9, 2026

Docker Desktop for Windows installer failed to verify external packages

• Weak crypto

docker · docker desktopOct 9, 2026

WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

• Pre-auth
• CSRF

mightyminnow · dashboard notesOct 9, 2026

Stored XSS in TMT Machine's Talassoft Industrial Management Software

• XSS

tmt machinery industry and trade co. ltd. · talassoft industrial management softwareOct 9, 2026

WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

themerex · education centerOct 9, 2026

WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

• Deserialization

buddhathemes · neo | barber shop wordpress themeOct 9, 2026

WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

• Deserialization

buddhathemes · colorfolioOct 9, 2026

WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

spabrice · pondOct 9, 2026

WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability

• Pre-auth

fuelthemes · the vouxOct 9, 2026

KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction

• RCE
• Path traversal
• XSS

kalcaddle · kodexplorerOct 9, 2026

Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials

• Pre-auth
• Hard-coded credentials

grid protection alliance · openpdc (docker image)Oct 9, 2026

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

• Pre-auth
• Auth bypass
• Denial of service

nginxui · nginx uiOct 9, 2026

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

• RCE

nginxui · nginx uiOct 9, 2026

HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter

• SQL injection

danielbrendel · hortusfox-webOct 9, 2026

HortusFox through 6.3 Unrestricted File Upload via Plant Attachments

• File upload
• XSS

danielbrendel · hortusfox-webOct 9, 2026

Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request

• Pre-auth

open5gs · open5gsOct 9, 2026

Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service

• Pre-auth

xerial · snappy-javaOct 9, 2026

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

• Pre-auth
• SQL injection

hotspotbilling · phpnuxbillOct 9, 2026

PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()

• Pre-auth
• Auth bypass

hotspotbilling · phpnuxbillOct 9, 2026

PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code

• Pre-auth

hotspotbilling · phpnuxbillOct 9, 2026

WordPress Post Author Authenticated SQLi

• SQL injection

Oct 9, 2026

Savannah lwIP SMTP client Classic Buffer Overflow

• Pre-auth
• Memory safety

savannah · lwip smtp clientOct 9, 2026

Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format

• Pre-auth
• Hard-coded credentials

red lion controls · 700 seriesOct 9, 2026

Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check

red lion controls · 700 seriesOct 9, 2026

Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials

• Hard-coded credentials

red lion controls · 700 seriesOct 9, 2026

Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function

• Auth bypass

red lion controls · 700 seriesOct 9, 2026

Red Lion Controls N-Tron 700 Series Reachable Assertion

red lion controls · 700 seriesOct 9, 2026

Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials

• Info leak

red lion controls · 700 seriesOct 9, 2026

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to

• Pre-auth
• Info leak

Oct 9, 2026

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to

• pre-auth RCE
• Command injection

Oct 9, 2026

Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile

• Local privilege escalation
• Memory safety

google · gvisorOct 9, 2026

Denial of Service via Eager Array Allocation During Deserialization in Guava

• Pre-auth
• Deserialization

google · guavaOct 9, 2026

SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount

• RCE

smartertools · smartermailOct 9, 2026

SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token

smartertools · smartermailOct 9, 2026

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

nginxui · nginx uiOct 9, 2026

Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)

• Pre-auth
• Auth bypass

nginxui · nginx uiOct 9, 2026

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs

• Pre-auth
• CSRF

nginxui · nginx uiOct 9, 2026

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

nginxui · nginx uiOct 9, 2026

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

• Auth bypass
• Info leak

nginxui · nginx uiOct 9, 2026

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

• pre-auth RCE

nginxui · nginx uiOct 9, 2026

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP ste

• Broken access control (IDOR)

nginxui · nginx uiOct 9, 2026

MariaDB: Insecure $HOME in MariaDB rpm packages

mariadb · mariadbOct 9, 2026

MOVO through 0.2.3 Authorization Bypass via Document Endpoints

• Broken access control (IDOR)

himovo · movoOct 9, 2026

ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import

• RCE
• File upload

ilias-elearning e.v. · iliasOct 9, 2026

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path.

• Pre-auth
• Denial of service

Oct 9, 2026

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttribut

• Pre-auth
• Memory safety
• Denial of service

Oct 9, 2026

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Co

• Pre-auth
• Memory safety
• Denial of service

Oct 9, 2026

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing.

• Pre-auth
• Denial of service

Oct 9, 2026

OTP Code Exposure in Hayat Hospital's Hayat Mobile

• Pre-auth
• Auth bypass

hayat health facilities inc. (hayat hospital) · hayat mobileOct 9, 2026

pyLoad: Api.set_user_permission never invalidates the target's session

Oct 9, 2026

pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

• Auth bypass

Oct 9, 2026

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass ra

• Pre-auth
• Race condition

Oct 9, 2026

MariaDB: one byte OOB write in DOS tables of the CONNECT engine

• RCE
• Memory safety

mariadb · mariadbOct 9, 2026

Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking

• Pre-auth
• Auth bypass

smp46 · pingvin-share-xOct 9, 2026

plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert

• Path traversal

mynaparrot · plugnmeet-serverOct 9, 2026

AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge

• pre-auth RCE
• XSS

iflytek · astron-rpaOct 9, 2026

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

• Pre-auth

iflytek · astron-rpaOct 9, 2026