Exploited and new serious CVEs: October 2026

WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

codepeople · contact form emailOct 22, 2026

WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering

• Local privilege escalation

watchguard · watchguard agentOct 22, 2026

Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

• Pre-auth
• Denial of service

handnot2 · esamlOct 22, 2026

Unbounded SAML message decompression in esaml allows memory exhaustion

• Pre-auth

handnot2 · esamlOct 22, 2026

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

• Pre-auth

webpack.js · webpack-dev-serverOct 22, 2026

Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter

• Pre-auth
• Path traversal

javo themes · javo spotOct 22, 2026

Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

• Path traversal

broadstreet · ad widgetOct 22, 2026

Intermesh Group-Office < 3.5.5 Path Traversal via compress.php

• Pre-auth
• Path traversal

intermesh · group-officeOct 22, 2026

MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter

• Pre-auth
• Path traversal

metinfo · metinfoOct 22, 2026

SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter

• Pre-auth
• SQL injection

seacms · seacmsOct 22, 2026

WooThemes Diarise 1.5.9 Local File Disclosure via download.php

• Pre-auth
• Path traversal

woothemes · diariseOct 22, 2026

Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload

• Pre-auth
• Path traversal

weaver network co., ltd. · e-cologyOct 22, 2026

FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer

• pre-auth RCE
• Path traversal

fanruan · finereportOct 22, 2026

JeeWMS Path Traversal via showOrDownByurl.do

• Pre-auth
• Path traversal

erzhongxmu · jeewmsOct 22, 2026

DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php

• pre-auth RCE

dedecms · dedecmsOct 22, 2026

OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi

• Pre-auth
• Path traversal

orbiteam · bscw serverOct 22, 2026

NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint

• Pre-auth
• SQL injection

wpdeveloper · notificationxOct 22, 2026

YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

• Pre-auth
• Path traversal

liukuo362573 · yishaadminOct 22, 2026

PHPOK < 5.4.081 SQL Injection via api.php sort Parameter

• Pre-auth
• SQL injection

phpok · phpokOct 22, 2026

Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint

• Pre-auth
• Path traversal

kareadita · kavitaOct 22, 2026

Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer

• Path traversal

penta security systems · wapplesOct 22, 2026

i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php

• Pre-auth
• SQL injection

i-netsolution · readymade unilevel ecommerce mlmOct 22, 2026

YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId

• Pre-auth
• Path traversal

youdatasum · cpas audit management systemOct 22, 2026

Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list

• Pre-auth
• SQL injection

weaver network co., ltd. · e-cologyOct 22, 2026

Goose: goose: shell history and environment leak via terminal integration

• Pre-auth
• Info leak

red hat · red hat enterprise linux 10Oct 22, 2026

WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

acf extended · acf extendedOct 22, 2026

WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

• Pre-auth

elated-themes · academist coreOct 22, 2026

WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability

• SQL injection

amentotech · workreap coreOct 22, 2026

WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

• Pre-auth

cozythemes · rootbloxOct 22, 2026

Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare

zhenorzz · goployOct 22, 2026

mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store

• Pre-auth
• SQL injection

mem0ai · mem0Oct 22, 2026

Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup

• Broken access control (IDOR)

gravitl · netmakerOct 22, 2026

JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

• SQL injection

riclolsen · json-scadaOct 22, 2026

Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

• RCE
• SQL injection

uselotus · lotusOct 22, 2026

Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

• SQL injection

uselotus · lotusOct 22, 2026

Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

• SQL injection

uselotus · lotusOct 22, 2026

Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

• Pre-auth
• Auth bypass

uselotus · lotusOct 22, 2026

Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

• Broken access control (IDOR)

uselotus · lotusOct 22, 2026

SSRF and local file disclosure via unvalidated URLs

• Pre-auth
• SSRF

Oct 22, 2026

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52

• pre-auth RCE
• File upload

yootheme.com · yootheme pro extension for joomlaOct 22, 2026

An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_au

• Pre-auth
• Denial of service

Oct 22, 2026

Out-of-Bounds Write in Google Brotli Decoder

• pre-auth RCE

google · brotliOct 22, 2026

Apache Abdera: XML external entity expansion in Atom document parsing

• Pre-auth
• XXE

apache software foundation · apache abderaOct 22, 2026

Dis-connect vulnerability in Connect Stack

• Pre-auth
• Auth bypass

silicon labs · connect sdkOct 22, 2026

Out-of-bounds write in Zigbee Simple_Desc_req handling

• RCE
• Memory safety

silabs · emberznetOct 22, 2026

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

• pre-auth RCE
• Path traversal

rsyslog · rsyslogOct 22, 2026

Out-of-bounds write in Zigbee Publish Price Matrix handling

• RCE
• Memory safety

silabs · emberznetOct 22, 2026

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

• Pre-auth
• Denial of service

body-parser · body-parserOct 22, 2026

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

• Pre-auth
• Denial of service

multer · multerOct 22, 2026

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

stevereiner · flexible-graphragOct 22, 2026

Insecure Deserialization of .cleanshot Files in CleanShot X

• RCE
• Deserialization

mtw · cleanshot xOct 22, 2026

OCO-Server: Stored XSS through agent hostnames in command buttons

• Pre-auth
• XSS

schorschii · oco-serverOct 22, 2026

Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.

• Pre-auth
• Memory safety

Oct 22, 2026

PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery

• Pre-auth
• Weak crypto

Oct 22, 2026

Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

marcoscamara01 · ecommerce templateOct 22, 2026

Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

• Broken access control (IDOR)

marcoscamara01 · ecommerce templateOct 22, 2026

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not li

• Pre-auth
• Denial of service

litespeedtech · lsquicOct 22, 2026

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL wit

• pre-auth RCE
• Open redirect

Oct 22, 2026

Next.js: Denial of Service in App Router using Server Actions

• Pre-auth
• Denial of service

vercel · next.jsOct 22, 2026

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

• Pre-auth

Oct 22, 2026

JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

jetbackup · jetbackupOct 22, 2026

dnspython dns.name.from_wire_parser() excessive CPU use

• Pre-auth
• Denial of service

rthalley · dnspythonOct 22, 2026

better-auth: OAuth state can be used as a Magic Link to sign in as another user

• Pre-auth
• Auth bypass

better-auth · better-authOct 22, 2026

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

• Pre-auth
• Denial of service

graphql-python · graphql-coreOct 22, 2026

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

• Pre-auth
• Denial of service

graphql-python · graphql-coreOct 22, 2026

Pre-boot RCE in EDK II PXE driver

• pre-auth RCE
• Memory safety

tianocore · edk2Oct 22, 2026

PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

• Pre-auth
• SSRF
• XXE

phpoffice · phpspreadsheetOct 22, 2026

PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

• Pre-auth
• SSRF
• XXE

phpoffice · phpspreadsheetOct 22, 2026

PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

• Pre-auth
• Denial of service

phpoffice · phpspreadsheetOct 22, 2026

PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

• SSRF
• Broken access control (IDOR)

phpoffice · phpspreadsheetOct 22, 2026

SmileCDR HAPI FHIR improper data decompression

• Pre-auth

smilecdr · hapi fhirOct 22, 2026

SmileCDR HAPI FHIR trusted tenant partition override

• Broken access control (IDOR)

smilecdr · hapi fhirOct 22, 2026

OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-

• Pre-auth
• Weak crypto

schorschii · oco-serverOct 22, 2026

Missing authorization in the unit resources download route in Juju controllers

• Broken access control (IDOR)

canonical · jujuOct 22, 2026

Agent Zero Web UI XSS

• Pre-auth
• XSS

agent zero · agent zeroOct 22, 2026

Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login

• Pre-auth
• Auth bypass

bytebase · bytebaseOct 22, 2026

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL

• pre-auth RCE
• XSS

Oct 22, 2026

Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts

• Broken access control (IDOR)

roskus · prospero flow crmOct 22, 2026

LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

berriai · litellmOct 22, 2026

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

• Pre-auth
• Deserialization
• Denial of service

msgpack · msgpack-pythonOct 22, 2026

Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization

• Pre-auth
• Deserialization
• Denial of service

mongodb · c# driverOct 22, 2026

NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

• SQL injection

mongodb · c# driverOct 22, 2026

Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

• Auth bypass

mongodb · c# driverOct 22, 2026

Update operator injection via single-element list rewriting in the update builder

• SQL injection

mongodb · c# driverOct 22, 2026

Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

mongodb · c# driverOct 22, 2026

Mistune before 3.3.0 Quadratic Denial of Service via parse_link_text

• Pre-auth

lepture · mistuneOct 22, 2026

Mistune before 3.3.0 Quadratic-Time DoS via parse_link_text

• Pre-auth
• Denial of service

lepture · mistuneOct 22, 2026

Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing

• Pre-auth
• Denial of service

lepture · mistuneOct 22, 2026

Mistune before 3.3.0 Quadratic-Time DoS via Unmatched Brackets in Inline Parser

• Pre-auth

lepture · mistuneOct 22, 2026

Mistune before 3.3.0 Path Traversal via include Directive

• Pre-auth
• Path traversal

lepture · mistuneOct 22, 2026

Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

• Pre-auth
• Path traversal

lepture · mistuneOct 22, 2026

Mistune before 3.3.0 Path Traversal and XSS via Include Directive

• Pre-auth
• Path traversal
• XSS

lepture · mistuneOct 22, 2026

OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal

• Broken access control (IDOR)

openbao · openbaoOct 22, 2026

LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpoints

• Info leak

lxc · incusOct 22, 2026

Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

lxc · incusOct 22, 2026

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

• Broken access control (IDOR)

lxc · incusOct 22, 2026

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Unsigned Header Bypass in Presigned S3 Upload URLs

• Weak crypto

lxc · incusOct 22, 2026

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

• Path traversal

lxc · incusOct 22, 2026

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy

• Broken access control (IDOR)

lxc · incusOct 22, 2026

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream

lxc · incusOct 22, 2026