Exploited and new serious CVEs: October 2026

Incorrect authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypas

• Pre-auth
• Broken access control (IDOR)

google · chromeOct 20, 2026

Observable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via

• Pre-auth

google · chromeOct 20, 2026

Uninitialized resource in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process t

• Pre-auth
• Memory safety

google · chromeOct 20, 2026

Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Use after free in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Use after free in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sand

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Missing authorization in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer pr

• pre-auth RCE
• Broken access control (IDOR)

google · chromeOct 20, 2026

UI misrepresentation in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering

• Pre-auth

google · chromeOct 20, 2026

Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a craf

• Pre-auth
• Broken access control (IDOR)

google · chromeOct 20, 2026

UI misrepresentation in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via

• Pre-auth

google · chromeOct 20, 2026

Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to

• Pre-auth
• Memory safety

google · chromeOct 20, 2026

Missing authorization in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proce

• Pre-auth
• Broken access control (IDOR)

google · chromeOct 20, 2026

Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a cr

• Pre-auth

google · chromeOct 20, 2026

Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to obtain cross-origin

• Pre-auth
• Broken access control (IDOR)

google · chromeOct 20, 2026

Observable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain

• Pre-auth

google · chromeOct 20, 2026

Uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to

• Pre-auth
• Memory safety

google · chromeOct 20, 2026

Buffer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside t

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web o

• Pre-auth
• Race condition

google · chromeOct 20, 2026

Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Use after free in Scroll in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox vi

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the san

• pre-auth RCE
• Memory safety

google · chromeOct 20, 2026

Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web

• Pre-auth

google · chromeOct 20, 2026

Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer proces

• pre-auth RCE
• Broken access control (IDOR)

google · chromeOct 20, 2026

Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program

• Pre-auth

google · chromeOct 20, 2026

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

• RCE
• Command injection

pypa · virtualenvOct 20, 2026

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

• Broken access control (IDOR)

openchoreo · openchoreoOct 20, 2026

Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint

• Pre-auth
• SSRF

bulwarkmail · webmailOct 20, 2026

Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization

• Pre-auth
• Denial of service

moov-io · signedxmlOct 20, 2026

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

• RCE
• Command injection

pypa · virtualenvOct 20, 2026

virtualenv activation scripts run code from a path that contains a placeholder name

• RCE
• Command injection

pypa · virtualenvOct 20, 2026

Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates

• Pre-auth
• Weak crypto

Oct 20, 2026

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).

• Info leak

oracle · solarisOct 20, 2026

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).

• Pre-auth
• Auth bypass

oracle · solarisOct 20, 2026

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).

• Local privilege escalation
• Info leak

oracle · solarisOct 20, 2026

IBM Planning Analytics Buffer Overflow

• RCE
• Memory safety

ibm · planning analyticsOct 20, 2026

DataStage on Cloud Pak for Data Improper Authorization

• Pre-auth
• Broken access control (IDOR)

ibm · datastage on cloud pak for dataOct 20, 2026

IBM Guardium Data Protection is affected by a security vulnerability

• Pre-auth
• Hard-coded credentials

ibm · guardium data protectionOct 20, 2026

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).

• Broken access control (IDOR)

oracle corporation · oracle contract lifecycle management for public sectorOct 20, 2026

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).

• Broken access control (IDOR)

oracle corporation · oracle contract lifecycle management for public sectorOct 20, 2026

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).

• Pre-auth
• Broken access control (IDOR)

oracle corporation · oracle shipping executionOct 20, 2026

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).

• Pre-auth
• Info leak

oracle corporation · oracle shipping executionOct 20, 2026

Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).

• Info leak

oracle corporation · sourcingOct 20, 2026

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for

• Pre-auth
• Broken access control (IDOR)

oracle corporation · oracle weblogic server proxy plug-inOct 20, 2026

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).

• Broken access control (IDOR)

oracle corporation · oracle product hubOct 20, 2026

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).

• Pre-auth
• Auth bypass

oracle · data integratorOct 20, 2026

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).

• Pre-auth
• Auth bypass

oracle · data integratorOct 20, 2026

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).

• Pre-auth
• Auth bypass

oracle · data integratorOct 20, 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

• Pre-auth
• Auth bypass

oracle · weblogic serverOct 20, 2026

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

• Broken access control (IDOR)

oracle · identity managerOct 20, 2026

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

• Broken access control (IDOR)

oracle · identity managerOct 20, 2026

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).

• Pre-auth
• Auth bypass

oracle corporation · mysql connectorsOct 20, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Broken access control (IDOR)

oracle corporation · oracle access managerOct 20, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle corporation · oracle access managerOct 20, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle · access managerOct 20, 2026

Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unw

• Pre-auth
• Denial of service

Oct 20, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle · access managerOct 20, 2026

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).

• Auth bypass

oracle · business intelligenceOct 20, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Broken access control (IDOR)

oracle · access managerOct 20, 2026

Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for

• Pre-auth
• Broken access control (IDOR)

oracle · weblogic server proxy plug-inOct 20, 2026

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

• Local privilege escalation
• Info leak

oracle corporation · oracle vm virtualboxOct 20, 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

• Pre-auth
• Auth bypass

oracle · weblogic serverOct 20, 2026

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

• Pre-auth
• Broken access control (IDOR)

oracle · outside in technologyOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).

• Pre-auth
• Broken access control (IDOR)

oracle corporation · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).

• Info leak

oracle corporation · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).

• Info leak

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).

• Local privilege escalation
• Info leak

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).

• Broken access control (IDOR)

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).

• Broken access control (IDOR)

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).

• Broken access control (IDOR)

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).

• Auth bypass

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).

• Pre-auth
• Auth bypass

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).

• Pre-auth
• Broken access control (IDOR)

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).

• Local privilege escalation
• Broken access control (IDOR)

oracle · jd edwards enterpriseone toolsOct 20, 2026

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

• Broken access control (IDOR)

oracle corporation · oracle vm virtualboxOct 20, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Info leak

oracle · access managerOct 20, 2026

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP

• Pre-auth
• Info leak

oracle corporation · oracle http serverOct 20, 2026

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).

• Info leak

oracle · http serverOct 20, 2026

Vulnerability in Oracle GoldenGate (component: Admin Server Executable).

• Broken access control (IDOR)

oracle corporation · oracle goldengateOct 20, 2026

Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).

• Local privilege escalation
• Info leak

oracle corporation · applications platform engineeringOct 20, 2026

Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).

• Info leak

oracle corporation · order captureOct 20, 2026

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

• Info leak

oracle corporation · oracle general ledgerOct 20, 2026

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).

• Info leak

oracle · service busOct 20, 2026

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).

• Info leak

oracle · payrollOct 20, 2026

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).

• Broken access control (IDOR)

oracle · service busOct 20, 2026

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).

• Pre-auth
• Denial of service

oracle · service busOct 20, 2026

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

• Pre-auth
• Broken access control (IDOR)

oracle · outside in technologyOct 20, 2026

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

• Pre-auth
• Denial of service

oracle · outside in technologyOct 20, 2026

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

• Pre-auth
• Broken access control (IDOR)

oracle · outside in technologyOct 20, 2026

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

• Pre-auth
• Denial of service

oracle · outside in technologyOct 20, 2026

Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).

• Local privilege escalation
• Broken access control (IDOR)

oracle corporation · applications dbaOct 20, 2026

Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).

• Local privilege escalation
• Broken access control (IDOR)

oracle corporation · applications dbaOct 20, 2026

Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).

• Auth bypass

oracle corporation · pastaOct 20, 2026

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).

• CSRF

oracle corporation · oracle applications frameworkOct 20, 2026

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).

• Pre-auth
• Info leak

oracle · solarisOct 20, 2026

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).

• Auth bypass

oracle · service busOct 20, 2026

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).

• Broken access control (IDOR)

oracle · service busOct 20, 2026

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).

• Pre-auth
• Broken access control (IDOR)

oracle · solarisOct 20, 2026

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).

• Broken access control (IDOR)

oracle · identity manager connectorOct 20, 2026

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).

• Pre-auth
• Broken access control (IDOR)

oracle · identity manager connectorOct 20, 2026