Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

• Без аутентификации

immich-app · immich1 окт. 2026 г.

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass s

asus · router1 окт. 2026 г.

Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via

• RCE

asus · router1 окт. 2026 г.

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a

asus · motherboard(prime z390-a )1 окт. 2026 г.

Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recu

• Без аутентификации
• Нарушение контроля доступа (IDOR)

croixhaug · simply schedule appointments1 окт. 2026 г.

AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

• Без аутентификации
• XSS

tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpress1 окт. 2026 г.

Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

• Без аутентификации
• Нарушение контроля доступа (IDOR)

genians, inc · genian nac 5.0.75 lts release1 окт. 2026 г.

Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass

• Обход аутентификации
• Нарушение контроля доступа (IDOR)

genians, inc · genian ssl pns (frodo-core)1 окт. 2026 г.

Genians, Inc Genian SSL PNS Improper Privilege Management

genians, inc · genian ssl pns (frodo-core)1 окт. 2026 г.

Genians, Inc Genian SSL PNS OS Command Injection

• RCE без входа
• Инъекция команд

genians, inc · genian ssl pns (xenics_auther)1 окт. 2026 г.

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without

• RCE
• Нарушение контроля доступа (IDOR)

octopus deploy · octopus server1 окт. 2026 г.

Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

• Без аутентификации
• Обход пути

hitachi industrial equipment systems · hitachi coding software suite1 окт. 2026 г.

Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

• Без аутентификации
• Обход аутентификации

hitachi industrial equipment systems · hitachi coding software suite1 окт. 2026 г.

Authentication information or sensitive data may be intercepted in transit

• Без аутентификации
• Слабая криптография

hitachi industrial equipment systems · hitachi coding software suite1 окт. 2026 г.

A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens

• Без аутентификации
• Зашитые учётные данные

hitachi industrial equipment systems · hitachi coding software suite1 окт. 2026 г.

Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

• Нарушение контроля доступа (IDOR)

hitachi industrial equipment systems · hitachi coding software suite1 окт. 2026 г.

Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process

• Без аутентификации
• Зашитые учётные данные

hitachi industrial equipment systems · hitachi coding software suite1 окт. 2026 г.

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

• RCE без входа

latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress1 окт. 2026 г.

Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF

• Без аутентификации
• CSRF

unknown · featured image from url (fifu)1 окт. 2026 г.

BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

• Без аутентификации
• Обход пути

unknown · backupsheep wordpress backup plugin1 окт. 2026 г.

Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url

• Без аутентификации
• Обход пути

unknown · cache enabler1 окт. 2026 г.

Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint

comelit group s.p.a. · 1456b multi-user gateway1 окт. 2026 г.

Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface

• Без аутентификации
• Обход аутентификации

comelit group s.p.a. · 1456b multi-user gateway1 окт. 2026 г.

Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback

• Без аутентификации
• XSS

unknown · paytm payment gateway1 окт. 2026 г.

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

• Без аутентификации
• SQL-инъекция

unknown · paytm payment gateway1 окт. 2026 г.

Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key

• Без аутентификации
• XSS

extendify · extendify1 окт. 2026 г.

Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

• Без аутентификации
• SQL-инъекция

unknown · pro like button1 окт. 2026 г.

Five Star Restaurant Reviews < 2.3.14 - Reflected XSS

• Без аутентификации
• XSS

unknown · five star restaurant reviews1 окт. 2026 г.

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log

• Без аутентификации
• Утечка информации

unknown · payments for hubtel1 окт. 2026 г.

Path traversal in dynamically created BACnet File Objects

• Без аутентификации
• Обход пути

wago · 0751-9x011 окт. 2026 г.

MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass

• Обход аутентификации

misp · misp1 окт. 2026 г.

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

• Без аутентификации

webrehab · super forms – drag & drop form builder1 окт. 2026 г.

ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

bytecorestack · bytecorestack – mcp connector for ai tools1 окт. 2026 г.

Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter

• Без аутентификации
• Обход аутентификации

superdav42 · ultimate multisite – wordpress multisite saas & waas platform1 окт. 2026 г.

LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter

• Без аутентификации
• Нарушение контроля доступа (IDOR)

thimpress · learnpress – wordpress lms plugin for create and sell online courses1 окт. 2026 г.

Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances

1 окт. 2026 г.

MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period

• Без аутентификации
• Обход аутентификации

misp · misp1 окт. 2026 г.

MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

• Нарушение контроля доступа (IDOR)

misp · misp1 окт. 2026 г.

Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

• Без аутентификации
• XSS

optimizingmatters · autoptimize1 окт. 2026 г.

Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter

• Обход пути

webrehab · super forms – drag & drop form builder1 окт. 2026 г.

Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

• Без аутентификации
• XSS

wpmudev · forminator forms – contact form, payment form & custom form builder1 окт. 2026 г.

PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

• Без аутентификации
• XSS

wpovernight · pdf invoices & packing slips for woocommerce1 окт. 2026 г.

WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX End

wpclever · wpc shop as a customer for woocommerce1 окт. 2026 г.

Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Rendere

• Без аутентификации
• XSS

codepeople · appointment hour booking – booking calendar1 окт. 2026 г.

Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields

• Без аутентификации
• XSS

10web · form maker by 10web – mobile-friendly drag & drop contact form builder1 окт. 2026 г.

Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field

• Без аутентификации
• XSS

scottpaterson · business essentials for contact form 71 окт. 2026 г.

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re

• Нарушение контроля доступа (IDOR)

jetbrains · youtrack1 окт. 2026 г.

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

• Нарушение контроля доступа (IDOR)

jetbrains · youtrack1 окт. 2026 г.

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

• Без аутентификации
• XSS

jetbrains · youtrack1 окт. 2026 г.

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

• SSRF

jetbrains · youtrack1 окт. 2026 г.

CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager

• Без аутентификации
• XSS
• CSRF

pandora fms · pandora fms1 окт. 2026 г.

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

• RCE без входа
• Загрузка файлов
• CSRF

pandora fms · pandora fms1 окт. 2026 г.

Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

• Нарушение контроля доступа (IDOR)

pandora fms · pandora fms1 окт. 2026 г.

Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager

• RCE
• Загрузка файлов

pandora fms · pandora fms1 окт. 2026 г.

Stored Cross-Site Scripting via Directory Name in File Manager Create Directory

• XSS

pandora fms · pandora fms1 окт. 2026 г.

SQL Injection in Grafana Integration Endpoint (query.php)

• SQL-инъекция

pandora fms · pandora fms1 окт. 2026 г.

Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

• Без аутентификации
• XSS

wpmudev · forminator forms – contact form, payment form & custom form builder1 окт. 2026 г.

Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled

• Без аутентификации
• Обход аутентификации

red hat · assisted installer for red hat openshift container platform 21 окт. 2026 г.

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability

• Без аутентификации
• SSRF

la-studio · la-studio element kit for elementor1 окт. 2026 г.

ground-station before 0.8.0 Authentication Bypass via setup.restore

• RCE без входа
• Обход аутентификации

sgoudelis · ground-station1 окт. 2026 г.

n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

• Нарушение контроля доступа (IDOR)

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

• Без аутентификации
• SQL-инъекция

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory

• Без аутентификации
• SQL-инъекция

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

• Обход аутентификации
• Нарушение контроля доступа (IDOR)

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

• Нарушение контроля доступа (IDOR)

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table

• Без аутентификации
• SQL-инъекция

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation

• Обход пути

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase

• Без аутентификации
• Обход пути

n8n-io · n8n1 окт. 2026 г.

n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

• Утечка информации

n8n-io · n8n1 окт. 2026 г.

n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node

• Без аутентификации
• Обход пути

n8n-io · n8n1 окт. 2026 г.

n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

• Нарушение контроля доступа (IDOR)

n8n-io · n8n1 окт. 2026 г.

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

• Без аутентификации

tornadoweb · tornado1 окт. 2026 г.

Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

• Без аутентификации
• Обход пути

tornadoweb · tornado1 окт. 2026 г.

Fleet before 4.87.0 Authentication Bypass via Device Identifiers

• Без аутентификации
• Обход аутентификации

fleetdm · fleet1 окт. 2026 г.

Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

• Без аутентификации
• Обход аутентификации
• Нарушение контроля доступа (IDOR)

tryghost · ghost1 окт. 2026 г.

Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

• Обход аутентификации
• Нарушение контроля доступа (IDOR)

tryghost · ghost1 окт. 2026 г.

Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

• Без аутентификации
• Обход аутентификации
• Нарушение контроля доступа (IDOR)

tryghost · ghost1 окт. 2026 г.

Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

• Без аутентификации
• Обход аутентификации

tryghost · ghost1 окт. 2026 г.

Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

• Без аутентификации
• XSS

tryghost · ghost1 окт. 2026 г.

Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

• Обход пути

tryghost · ghost1 окт. 2026 г.

Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

tryghost · ghost1 окт. 2026 г.

Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

• Обход аутентификации

tryghost · ghost1 окт. 2026 г.

Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications

tryghost · ghost1 окт. 2026 г.

Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

• Нарушение контроля доступа (IDOR)

tryghost · ghost1 окт. 2026 г.

Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

• SQL-инъекция

tryghost · ghost1 окт. 2026 г.

Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize

• Обход пути

tryghost · ghost1 окт. 2026 г.

Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

• XSS

tryghost · ghost1 окт. 2026 г.

Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

• SSRF

budibase · budibase1 окт. 2026 г.

Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route

• Нарушение контроля доступа (IDOR)

obot-platform · obot1 окт. 2026 г.

Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

• Без аутентификации
• XXE

apache software foundation · apache camel quarkus1 окт. 2026 г.

Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value

• Без аутентификации
• Ошибки памяти

tnef project · tnef1 окт. 2026 г.

Apache APISIX: Batch response aggregation can exhaust worker memory

• Без аутентификации
• Отказ в обслуживании

apache software foundation · apache apisix1 окт. 2026 г.

WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability

• SQL-инъекция

villatheme · buildkit – product builder for woocommerce – custom pc builder1 окт. 2026 г.

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability

• XSS

wpmet · elementskit elementor addons lite1 окт. 2026 г.

WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability

• CSRF

memberful · memberful - membership plugin1 окт. 2026 г.

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

• SQL-инъекция

unlimited elements · unlimited elements for elementor (free widgets, addons, templates)1 окт. 2026 г.

WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

• SQL-инъекция

ultimate member · ultimate member1 окт. 2026 г.

WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability

• SQL-инъекция

captivateaudio · captivate sync1 окт. 2026 г.

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

tonycoz · imager1 окт. 2026 г.

HCL iControl is affected by multiple security vulnerabilities

• Обход аутентификации
• Нарушение контроля доступа (IDOR)

hcl software · icontrol1 окт. 2026 г.