Exploited and new serious CVEs: October 2026

WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

stiofan · getpaidOct 28, 2026

WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability

• Pre-auth
• XSS

iova.mihai · slicewpOct 28, 2026

Topluyo Desktop for Linux has an OS Command Injection issue

• pre-auth RCE
• Command injection

topluyo · appOct 28, 2026

WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability

• Deserialization

gs plugins · gs logo sliderOct 28, 2026

WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability

• Deserialization

pickplugins · accordionOct 28, 2026

WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability

• Pre-auth
• Broken access control (IDOR)

ihomefinder, inc. · optima expressOct 28, 2026

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing

• Pre-auth
• Denial of service

progress software · telerik document processing librariesOct 28, 2026

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering

• Pre-auth
• Denial of service

progress software · telerik document processing librariesOct 28, 2026

Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing

• Pre-auth
• Denial of service

progress software · telerik document processing librariesOct 28, 2026

Path Traversal in Telerik Document Processing Libraries AI Agent Tools

• Path traversal

progress software · telerik document processing librariesOct 28, 2026

XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing

• Pre-auth
• XXE

progress software · telerik document processing librariesOct 28, 2026

Improper Signature and Certificate Validation in Telerik Document Processing Libraries RadPdfProcessing

• Pre-auth
• Weak crypto

progress software · telerik document processing librariesOct 28, 2026

HCL BigFix AEX is affected by multiple security vulnerabilities.

• Pre-auth
• File upload
• XSS

hcl software · bigfix aexOct 28, 2026

HCL BigFix AEX is affected by multiple security vulnerabilities.

• RCE
• Command injection

hcl software · bigfix aexOct 28, 2026

Path Traversal in Wing WFTP Server leading to Remote Code Execution

• RCE
• Path traversal

wing soft technology · wing ftp serverOct 28, 2026

WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability

• Deserialization

wedevs · dokanOct 28, 2026

WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

• SQL injection

advanced ads gmbh · advanced ads – trackingOct 28, 2026

WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

• Pre-auth
• Deserialization

ultimate member · ultimate memberOct 28, 2026

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

• Pre-auth
• Denial of service

mtrudel · banditOct 28, 2026

WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability

• Deserialization

crossi72 · phoenix media renameOct 28, 2026

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

• Deserialization

stepasyuk · filter everything&nbsp;— wordpress &amp; woocommerce filtersOct 28, 2026

Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

• Broken access control (IDOR)

xibosignage · xibo-cmsOct 28, 2026

NORA missing cross-user token-management authorization

• Broken access control (IDOR)

getnora-io · noraOct 28, 2026

Joker linter executed project-local .jokerd/linter.* files during linting

• Local privilege escalation

candid82 · jokerOct 28, 2026

Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import

• RCE
• Local privilege escalation

jordanburke · functypeOct 28, 2026

ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

• Pre-auth

esphome · device-builderOct 28, 2026

OpenHop: Path Traversal in Flow ID File Operations

• Pre-auth
• Path traversal

naorsabag · openhopOct 28, 2026

identrail: Cross-tenant GitHub installation binding without ownership verification

• Broken access control (IDOR)

identrail · identrailOct 28, 2026

X.Org Server GLX RenderLarge Heap Buffer Overflow

• Memory safety

x.orgg · xorg-x11-serverOct 28, 2026

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a deni

• Pre-auth
• Memory safety
• Denial of service

Oct 28, 2026

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denia

• Pre-auth
• Denial of service

Oct 28, 2026

X.Org Server XKB ResizeKeyType Numeric Truncation

• Memory safety

x.org · xorg-x11-serverOct 28, 2026

X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

• Memory safety

x.org · xorg-x11-serverOct 28, 2026

X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

• Memory safety

x.org · xorg-x11-serverOct 28, 2026

GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation

• RCE
• Local privilege escalation

gfi usa, llc · gfi kerioconnectOct 28, 2026

USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS

• RCE
• Memory safety

n-romanovich · usb-testOct 28, 2026

FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution

• RCE
• Command injection

fogproject · fogprojectOct 28, 2026

XWiki Pro Macros: excerpt-include title and content injection executes code

• RCE

xwikisas · xwiki-pro-macrosOct 28, 2026

SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array

• Pre-auth
• Memory safety

simulationcraft · simcOct 28, 2026

Shopper: read-only team permissions allow administrator creation and permission escalation

• Broken access control (IDOR)

shopperlabs · shopperOct 28, 2026

YosemiteCrew: Missing organization authorization on service and PMS library/template routes

• Broken access control (IDOR)

yosemitecrew · yosemite-crewOct 28, 2026

X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow

• Memory safety

x.org · xorg-x11-serverOct 28, 2026

X.Org Server Glamor CopyArea Heap Buffer Overflow

• Memory safety

x.org · xorg-x11-serverOct 28, 2026

Alerting contact point authorization bypass via schema downgrade

• Broken access control (IDOR)

grafana · grafana enterpriseOct 28, 2026

Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root

juniper networks · session smart routerOct 28, 2026

Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalation

• RCE

juniper networks · session smart routerOct 28, 2026

Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules

• RCE
• Command injection

juniper networks · session smart routerOct 28, 2026

Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

• pre-auth RCE
• Command injection

juniper networks · session smart conductorOct 28, 2026

Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

• Path traversal

juniper networks · session smart routerOct 28, 2026

Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options

• pre-auth RCE
• Memory safety

juniper networks · session smart routerOct 28, 2026

Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

• Pre-auth
• Auth bypass

juniper networks · session smart routerOct 28, 2026

Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection

• Pre-auth
• Memory safety
• Denial of service

juniper networks · session smart routerOct 28, 2026

Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

• Pre-auth
• Memory safety

juniper networks · session smart routerOct 28, 2026

SSO settings authorization bypass

• Broken access control (IDOR)

grafana · grafana enterpriseOct 28, 2026

Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

• RCE
• Command injection

juniper networks · session smart routerOct 28, 2026

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

• Pre-auth

apache software foundation · apache kafkaOct 28, 2026

Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

• Pre-auth
• Denial of service

apache software foundation · apache kafkaOct 28, 2026

Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

• Pre-auth

apache software foundation · apache kafkaOct 28, 2026

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

• Pre-auth
• Memory safety

apache software foundation · apache kafkaOct 28, 2026

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

• Pre-auth
• Deserialization
• Denial of service

apache software foundation · apache kafkaOct 28, 2026

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

• Auth bypass

apache software foundation · apache kafkaOct 28, 2026

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

• Info leak

apache software foundation · apache kafkaOct 28, 2026

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attr

• Deserialization

jenkins · jenkinsOct 28, 2026

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the

• RCE
• Broken access control (IDOR)

jenkins · jenkinsOct 28, 2026

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing

• RCE
• Path traversal

jenkins · jenkinsOct 28, 2026

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its paren

jenkins · jenkinsOct 28, 2026

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setu

• Pre-auth
• Race condition

jenkins · jenkinsOct 28, 2026

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API toke

jenkins · jenkinsOct 28, 2026

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data

• RCE

jenkins · jenkinsOct 28, 2026

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as

• Deserialization

jenkins · jenkinsOct 28, 2026

Laravel MongoDB `whereDoesntHave` misses deny records for numeric string IDs

mongodb · laravel mongodbOct 28, 2026

Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability

• RCE
• Local privilege escalation

alpine · ilx-f511Oct 28, 2026

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

• pre-auth RCE
• Memory safety

alpine · ilx-f511Oct 28, 2026

Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability

• pre-auth RCE
• Memory safety

alpine · ilx-f511Oct 28, 2026

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability

• pre-auth RCE

alpine · ilx-f511Oct 28, 2026

Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

• pre-auth RCE
• Memory safety

alpine · ilx-f511Oct 28, 2026

Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability

• RCE
• Deserialization

ultralytics · ultralyticsOct 28, 2026

Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability

• RCE

ultralytics · ultralyticsOct 28, 2026

Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability

• RCE
• Command injection

ultralytics · ultralyticsOct 28, 2026

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

• RCE

ultralytics · ultralyticsOct 28, 2026

Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

• RCE
• Deserialization

ultralytics · ultralyticsOct 28, 2026

Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

• RCE

ultralytics · ultralyticsOct 28, 2026

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability

• pre-auth RCE
• Path traversal

ultralytics · ultralyticsOct 28, 2026

Unvalidated pin index in GPIO syscall handlers allows out-of-bounds kernel writes from user mode

• Memory safety

zephyrproject · zephyrOct 28, 2026

Azure Monitor access token disclosure via SSRF

• SSRF

grafana · grafana enterpriseOct 28, 2026

X.Org Server XInput2 PassiveUngrabDevice Out-of-Bounds Write

• Memory safety

x.org · xorg-x11-serverOct 28, 2026

HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk

Oct 28, 2026

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary

• Pre-auth
• Denial of service

Oct 28, 2026

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block

• Pre-auth
• Denial of service

Oct 28, 2026

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them

• Pre-auth

Oct 28, 2026

MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message

• Pre-auth
• Denial of service

Oct 28, 2026

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters

• Pre-auth
• Denial of service

Oct 28, 2026

MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in decode_mimewords

• Pre-auth
• Denial of service

Oct 28, 2026

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment w

• Local privilege escalation

Oct 28, 2026

MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion

• Pre-auth
• Denial of service

Oct 28, 2026

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

• Pre-auth
• Denial of service

Oct 28, 2026

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

• Pre-auth

Oct 28, 2026

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

• Broken access control (IDOR)

eugeny · russhOct 28, 2026

RE2JS: Quadratic-time denial of service in re2js lookbehind matching

• Pre-auth
• Denial of service

le0pard · re2jsOct 28, 2026

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

• XSS

highcharts · highchartsOct 28, 2026