Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

Mooncake Store through 0.3.13.post1 Unauthenticated Object Deletion via Remove RPCs

• Без аутентификации
• Обход аутентификации

kvcache-ai · mooncake6 окт. 2026 г.

Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC

• Без аутентификации
• Нарушение контроля доступа (IDOR)

kvcache-ai · mooncake6 окт. 2026 г.

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp

• Без аутентификации
• Ошибки памяти

6 окт. 2026 г.

OS Command Injection in Felisify Informatics' SambaBox

• RCE
• Инъекция команд

felisify information technologies industry and trade inc. · sambabox6 окт. 2026 г.

OS command injection in Progress Software Autonomous REST Connector GenAI Agents

• RCE без входа
• Инъекция команд

progress software · autonomous rest connector genai agents6 окт. 2026 г.

HortusFox < 6.2 Remote Code Execution via Theme Import

• RCE
• Загрузка файлов

danielbrendel · hortusfox-web6 окт. 2026 г.

Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection

• RCE без входа

microsoft · ufo6 окт. 2026 г.

Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`

• RCE
• Инъекция команд

microsoft · ufo6 окт. 2026 г.

MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL

• Без аутентификации
• Слабая криптография

microsoft · msquic6 окт. 2026 г.

Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

• RCE без входа

microsoft · kiota6 окт. 2026 г.

SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)

• RCE
• Инъекция команд

microsoft · simplechat6 окт. 2026 г.

SimpleChat: Stored XSS via group document filename in inline onclick handler

• XSS

microsoft · simplechat6 окт. 2026 г.

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

• RCE

openapi-generators · openapi-python-client6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs.

• Без аутентификации
• Зашитые учётные данные

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization

• Без аутентификации
• Зашитые учётные данные

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in th

• Без аутентификации
• Обход аутентификации

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability.

• Без аутентификации
• Обход аутентификации

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the Conta

dell · container storage modules6 окт. 2026 г.

Payload: Improper access control for MCP API keys

• Нарушение контроля доступа (IDOR)

payloadcms · payload6 окт. 2026 г.

Payload: Prototype pollution in Payload Import Export plugin

• RCE без входа
• Prototype pollution

payloadcms · payload6 окт. 2026 г.

Payload: SQL Injection in SQLite and Postgres

• Без аутентификации
• SQL-инъекция

payloadcms · payload6 окт. 2026 г.

getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting

• XSS

getformwork · formwork6 окт. 2026 г.

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

external-secrets · external-secrets6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability.

• Утечка информации

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi

• Без аутентификации
• Обход аутентификации

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerM

• Без аутентификации
• Нарушение контроля доступа (IDOR)

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server

• Без аутентификации
• Слабая криптография

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engin

• RCE
• SSTI

dell · container storage modules6 окт. 2026 г.

Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability.

• Слабая криптография

dell · container storage modules6 окт. 2026 г.

Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/lo

• Без аутентификации

6 окт. 2026 г.

Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer

• RCE
• Ошибки памяти

6 окт. 2026 г.

SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE

• RCE без входа
• Нарушение контроля доступа (IDOR)

spip · spip crayons plugin6 окт. 2026 г.

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

• Без аутентификации

modelcontextprotocol · typescript-sdk6 окт. 2026 г.

Payload: Polymorphic join queries could disclose hidden fields

• Утечка информации

payloadcms · payload6 окт. 2026 г.

Payload: API key disclosure through ordinary document reads

payloadcms · payload6 окт. 2026 г.

Payload: Order confirmation validation issue in Payload Ecommerce

• Без аутентификации

payloadcms · payload6 окт. 2026 г.

Payload: Field access control bypass on auth collections

• Без аутентификации
• Нарушение контроля доступа (IDOR)

payloadcms · payload6 окт. 2026 г.

Payload: Token refresh and password reset responses may expose restricted user fields

• Утечка информации

payloadcms · payload6 окт. 2026 г.

Payload: ReDoS in Multipart Content-Type Validation

• Без аутентификации
• Отказ в обслуживании

payloadcms · payload6 окт. 2026 г.

Payload: Field-level password update restrictions were not enforced

• Нарушение контроля доступа (IDOR)

payloadcms · payload6 окт. 2026 г.

Payload: SQL injection in SQLite/Postgres

• SQL-инъекция

payloadcms · payload6 окт. 2026 г.

Payload: RCE in Payload Form Builder

• RCE без входа

payloadcms · payload6 окт. 2026 г.

Payload: Remote Code Execution through first-register

• RCE без входа

payloadcms · payload6 окт. 2026 г.

Payload: Unauthorized update to collection documents

• Без аутентификации
• Нарушение контроля доступа (IDOR)

payloadcms · payload6 окт. 2026 г.

Payload: Tenant authorization bypass in Multi-Tenant Plugin

• Нарушение контроля доступа (IDOR)

payloadcms · payload6 окт. 2026 г.

Payload external upload trust validation issue

• Утечка информации

payloadcms · payload6 окт. 2026 г.

Payload: Bypassed sanitization of user uploaded SVGs

• XSS

payloadcms · payload6 окт. 2026 г.

Payload authentication token field handling issue

• Без аутентификации
• Обход аутентификации

payloadcms · payload6 окт. 2026 г.

Payload: Incomplete validation during the upload file lifecycle

• Обход пути

payloadcms · payload6 окт. 2026 г.

Payload: Client uploads could overwrite S3 objects

• Нарушение контроля доступа (IDOR)

payloadcms · payload6 окт. 2026 г.

Payload: Uploaded XML files could execute same-origin JavaScript

• Загрузка файлов

payloadcms · payload6 окт. 2026 г.

Payload: Field-level write access bypass in Payload on MongoDB

• Нарушение контроля доступа (IDOR)

payloadcms · payload6 окт. 2026 г.

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

• Без аутентификации
• XSS

quasarframework · quasar6 окт. 2026 г.

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

• RCE без входа

jetbrains · teamcity6 окт. 2026 г.

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

• Без аутентификации
• Обход пути

jetbrains · teamcity6 окт. 2026 г.

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java.

• Без аутентификации
• Обход пути

6 окт. 2026 г.

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated

• SQL-инъекция

6 окт. 2026 г.

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Ele

• RCE
• Инъекция команд

dell · openmanage integration6 окт. 2026 г.

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

• Обход пути

quasarframework · quasar6 окт. 2026 г.

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

• Без аутентификации
• Отказ в обслуживании

quasarframework · quasar6 окт. 2026 г.

Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

quasarframework · quasar6 окт. 2026 г.

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

• Без аутентификации
• XSS

quasarframework · quasar6 окт. 2026 г.

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

• Без аутентификации
• XSS

quasarframework · quasar6 окт. 2026 г.

ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

sixlabors · imagesharp6 окт. 2026 г.

ImageSharp: ICC LUT16 output channel count can write beyond Vector4

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

sixlabors · imagesharp6 окт. 2026 г.

ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

sixlabors · imagesharp6 окт. 2026 г.

ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

sixlabors · imagesharp6 окт. 2026 г.

ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

sixlabors · imagesharp6 окт. 2026 г.

WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

• Без аутентификации

automattic · wordpress6 окт. 2026 г.

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a c

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500

• Без аутентификации

tp-link systems inc. · tapo c500 v2.06 окт. 2026 г.

Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500

• Ошибки памяти

tp-link systems inc. · tapo c500 v2.06 окт. 2026 г.

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vau

• Нарушение контроля доступа (IDOR)

devolutions · server6 окт. 2026 г.

ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

sixlabors · imagesharp6 окт. 2026 г.

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

• Без аутентификации
• Отказ в обслуживании

vmware · rabbitmq java client6 окт. 2026 г.

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to pot

• RCE

google · chrome6 окт. 2026 г.

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictio

• Без аутентификации

google · chrome6 окт. 2026 г.

Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to by

• RCE без входа

google · chrome6 окт. 2026 г.

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer p

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access re

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox vi

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proce

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the ren

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

• RCE без входа
• Состояние гонки

google · chrome6 окт. 2026 г.

Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to

• Без аутентификации

google · chrome6 окт. 2026 г.

Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a c

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the r

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

• RCE без входа
• Состояние гонки

google · chrome6 окт. 2026 г.

Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially ex

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtai

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafte

• Без аутентификации
• Утечка информации

google · chrome6 окт. 2026 г.

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to

• Без аутентификации

google · chrome6 окт. 2026 г.

Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain

• Без аутентификации
• Нарушение контроля доступа (IDOR)

google · chrome6 окт. 2026 г.

Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a

• RCE без входа
• Ошибки памяти

google · chrome6 окт. 2026 г.

Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to

• RCE без входа

google · chrome6 окт. 2026 г.