Exploited and new serious CVEs: October 2026

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

• RCE
• Command injection

argoproj · argo-cdOct 9, 2026

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Pac

• Pre-auth
• Denial of service

Oct 9, 2026

MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

mariadb · mariadbOct 9, 2026

MariaDB: insufficient validation of binary frm data when opening a table

mariadb · mariadbOct 9, 2026

MariaDB: privilege escalation via incorrect view frm parsing

mariadb · mariadbOct 9, 2026

x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

• pre-auth RCE
• Auth bypass

duty1g · x64dbg-mcp-serverOct 9, 2026

OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

• Pre-auth
• Denial of service

corazawaf · corazaOct 9, 2026

RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

• Pre-auth
• Memory safety

riot-os · riotOct 9, 2026

RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling

• Pre-auth
• Memory safety

riot-os · riotOct 9, 2026

RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

• Pre-auth
• Denial of service

riot-os · riotOct 9, 2026

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

• Pre-auth
• Denial of service

luskaner · agelanserverOct 9, 2026

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

• Pre-auth
• Denial of service

jhaals · yopassOct 9, 2026

Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

• Broken access control (IDOR)

aws · aws-amplify/graphql-index-transformerOct 9, 2026

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Ge

• Pre-auth
• Denial of service

Oct 9, 2026

OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser.

• Pre-auth
• Memory safety
• Denial of service

Oct 9, 2026

OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser.

• Pre-auth
• Memory safety
• Denial of service

Oct 9, 2026

OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser.

• Pre-auth
• Memory safety
• Denial of service

Oct 9, 2026

Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.

• Pre-auth
• Info leak

Oct 9, 2026

Contao: Cross-site scripting in the comments bundle

• Pre-auth
• XSS

contao · contaoOct 9, 2026

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.

• pre-auth RCE

Oct 9, 2026

Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

jexactyl · jexactylOct 9, 2026

Tina: Code injection via unescaped Git branch name in generated client source

• RCE

tinacms · tinacmsOct 9, 2026

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

• XSS

tinacms · tinacmsOct 9, 2026

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

• Pre-auth

tinacms · tinacmsOct 9, 2026

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

• RCE

iflytek · astron-agentOct 9, 2026

Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

• RCE
• SSTI

wizarrrr · wizarrOct 9, 2026

enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

• Pre-auth

privasys · enclave-os-miniOct 9, 2026

Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

• Pre-auth

privasys · rustlsOct 9, 2026

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

go-vikunja · vikunjaOct 9, 2026

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

• Auth bypass

go-vikunja · vikunjaOct 9, 2026

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

• Pre-auth

go-vikunja · vikunjaOct 9, 2026

Aegisub executes arbitrary code through automatically loaded Automation scripts

• RCE
• Local privilege escalation

typesettingtools · aegisubOct 9, 2026

Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

• Pre-auth

privasys · goOct 9, 2026

enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

• Pre-auth

privasys · enclave-os-virtualOct 9, 2026

ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session

• Pre-auth

privasys · ra-tls-clientsOct 9, 2026

CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident

netapp · tridentOct 9, 2026

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

• Pre-auth
• SQL injection

jetbrains · exposedOct 10, 2026

ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

• RCE
• Command injection

cellhubs · exiftool for photo and videoOct 10, 2026

Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

• Pre-auth
• Auth bypass

inilerm · advanced ip blockerOct 10, 2026

Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to

• Pre-auth
• Auth bypass

nasirahmed · advanced form integration — connect forms to 300+ appsOct 10, 2026

Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

• Pre-auth

creativethemeshq · blocksy companionOct 10, 2026

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Uploa

• pre-auth RCE
• File upload

htplugins · extensions for cf7 (contact form 7 database, conditional fields and redirection)Oct 10, 2026

3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

• pre-auth RCE
• Auth bypass
• File upload

expivi · 3d product configurator for woocommerceOct 10, 2026

Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting

• RCE

hostspa · fastcache by host.itOct 10, 2026

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Si

• Pre-auth
• Broken access control (IDOR)

rtcamp · rtmedia for wordpress, buddypress and bbpressOct 10, 2026

Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

• pre-auth RCE

themefusion · avada (fusion) builderOct 10, 2026

LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

• Deserialization

lifterlms · lifterlms – wp lms for elearning, online courses, & quizzesOct 10, 2026

Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

trainingbusinesspros · groundhogg — crm, newsletters, and marketing automationOct 10, 2026

Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

• RCE
• File upload

unknown · rank math seoOct 10, 2026

Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpressOct 10, 2026

GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter

• pre-auth RCE

paoltaia · geodirectory – wp business directory plugin and classified listings directoryOct 10, 2026

Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

• Pre-auth
• XSS

smub · easy digital downloads – ecommerce payments and subscriptions made easyOct 10, 2026

FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

foosales · foosales – point of sale (pos) for woocommerceOct 10, 2026

FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

• RCE
• File upload
• Race condition

foliovision · fv player 8Oct 10, 2026

LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules

• Pre-auth
• XSS

unknown · ltl freight quotesOct 10, 2026

LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter

• Pre-auth
• SQL injection

unknown · ltl freight quotesOct 10, 2026

Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

• Pre-auth

trainingbusinesspros · groundhogg — crm, newsletters, and marketing automationOct 10, 2026

Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook

• Pre-auth
• XSS

eteubert · podlove podcast publisherOct 10, 2026

SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP

• Pre-auth
• Auth bypass

unknown · sms alertOct 10, 2026

SMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

• Pre-auth

unknown · sms alertOct 10, 2026

Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

• Pre-auth
• XSS

rameez_iqbal · real estate manager – property listing and agent managementOct 10, 2026

Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

• Pre-auth
• XSS

2winfactor · presto playerOct 10, 2026

Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

• Pre-auth
• XSS

villatheme · photo reviews for woocommerceOct 10, 2026

LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

• Pre-auth
• XSS

wp_media · lazyload plugin – lazy load images, videos, and iframesOct 10, 2026

PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

• pre-auth RCE
• Path traversal

themeisle · ppom – product addons & custom fields for woocommerceOct 10, 2026

10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

• Pre-auth
• XSS

10web · 10web booster – website speed optimization, cache & page speed optimizerOct 10, 2026

Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter

• Deserialization

ladela · online scheduling and appointment booking system – booklyOct 10, 2026

WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions

• Broken access control (IDOR)

joomunited · wp file downloadOct 10, 2026

VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

• Pre-auth
• XSS

e4jvikwp · vikbooking hotel booking engine & pmsOct 10, 2026

Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

• Pre-auth
• XSS

expresstech · quiz and survey master (qsm) – quiz maker & survey makerOct 10, 2026

WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

• Pre-auth
• XSS

aguidrevitch · wp meteor website speed optimization addonOct 10, 2026

Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

• Pre-auth
• XSS

wpxpo · post grid gutenberg blocks – postxOct 10, 2026

FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

• Pre-auth
• XSS

teamfunnelkit · funnelkit – funnel builder for woocommerce checkoutOct 10, 2026

WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

• Pre-auth
• XSS

gwin · wpadverts – classifieds pluginOct 10, 2026

Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

• Pre-auth
• XSS

molongui · molongui authorship – author boxes, guest authors & co-authors for wordpressOct 10, 2026

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Ve

• Pre-auth
• Auth bypass

wpo365 · wpo365 | seamless wordpress + microsoft integration (wpo365 | login)Oct 10, 2026

WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

• Pre-auth
• Auth bypass

whyun · wpcom memberOct 10, 2026

WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

• Deserialization

yith · yith woocommerce affiliatesOct 10, 2026

WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · bookloversOct 10, 2026

WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · gutentypeOct 10, 2026

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized

• Pre-auth
• Broken access control (IDOR)

webtoffee · webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labelsOct 10, 2026

WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

axiomthemes · vetoOct 10, 2026

WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · travesiaOct 10, 2026

WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · tantraOct 10, 2026

WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · smashOct 10, 2026

WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · smart casaOct 10, 2026

WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · rosalindaOct 10, 2026

WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · partisoOct 10, 2026

WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · let's playOct 10, 2026

WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · ipharmOct 10, 2026

WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · hygiaOct 10, 2026

WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · hogwordsOct 10, 2026

WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · greenyOct 10, 2026

WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · edemaOct 10, 2026

WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · dwellOct 10, 2026

WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · convexOct 10, 2026

WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

themerex group · cameliaOct 10, 2026

WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

axiomthemes · balanceOct 10, 2026

WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability

• Auth bypass

omegathemes · grocery shopping storeOct 10, 2026

WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability

• Pre-auth
• Broken access control (IDOR)

stylemixthemes · motorsOct 10, 2026