Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

• RCE без входа
• Ошибки памяти

ibm · guardium data protection8 окт. 2026 г.

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• RCE без входа
• SQL-инъекция

ibm · guardium data protection8 окт. 2026 г.

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

• RCE без входа
• Ошибки памяти

ibm · guardium data protection8 окт. 2026 г.

IBM Guardium Data Protection is affected by vulnerability

• RCE без входа
• Обход аутентификации

ibm · guardium data protection8 окт. 2026 г.

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

• RCE
• Ошибки памяти

ibm · guardium data protection8 окт. 2026 г.

Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection

• Без аутентификации
• Зашитые учётные данные

ibm · guardium data protection8 окт. 2026 г.

Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection

• Утечка информации

ibm · guardium data protection8 окт. 2026 г.

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Без аутентификации

red hat · migration toolkit for applications 88 окт. 2026 г.

Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB

• Без аутентификации
• Обход аутентификации

tp-link systems inc. · tapo c325wb v28 окт. 2026 г.

Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB

• Без аутентификации
• Ошибки памяти

tp-link systems inc. · tapo c325wb v28 окт. 2026 г.

Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB

• Без аутентификации
• Слабая криптография

tp-link systems inc. · tapo c325wb v28 окт. 2026 г.

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

• Без аутентификации
• Нарушение контроля доступа (IDOR)

strawberry-graphql · strawberry8 окт. 2026 г.

SumatraPDF: Markup/command-link injection into UI notification text

• RCE

sumatrapdfreader · sumatrapdf8 окт. 2026 г.

SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors

• RCE

sumatrapdfreader · sumatrapdf8 окт. 2026 г.

SumatraPDF — Windows command-line argument injection in AI selection-translate

sumatrapdfreader · sumatrapdf8 окт. 2026 г.

Root.Mkdir(All) can follow junctions out of the root on Windows in os

• Без аутентификации

go standard library · os8 окт. 2026 г.

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

• Без аутентификации

go standard library · net/http8 окт. 2026 г.

Azure SRE Agent Elevation of Privilege Vulnerability

• SSRF

microsoft · azure sre agent8 окт. 2026 г.

Azure App Service Remote Code Execution Vulnerability

• RCE без входа
• Обход аутентификации

microsoft · azure app service for linux8 окт. 2026 г.

HTTP/2 server memory exhaustion due to Trailer headers in net/http

• Без аутентификации
• Отказ в обслуживании

go standard library · net/http8 окт. 2026 г.

HTTP/2 transport accepts malformed framing-related headers in net/http

• Без аутентификации

go standard library · net/http8 окт. 2026 г.

Double flow control refund on HTTP/2 server streams in net/http

• Без аутентификации

go standard library · net/http8 окт. 2026 г.

Lack of limit on size of parsed Range headers in net/http

• Без аутентификации
• Отказ в обслуживании

go standard library · net/http8 окт. 2026 г.

Excessive CPU consumption from repeated initial window changes in net/http

• Без аутентификации
• Отказ в обслуживании

go standard library · net/http8 окт. 2026 г.

Azure API Center Information Disclosure Vulnerability

• Без аутентификации
• Утечка информации

microsoft · azure api center8 окт. 2026 г.

Microsoft Dataverse Remote Code Execution Vulnerability

• RCE без входа
• Десериализация

microsoft · dataverse8 окт. 2026 г.

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

• Без аутентификации

go standard library · net/http8 окт. 2026 г.

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

• Без аутентификации
• Отказ в обслуживании

go standard library · net/textproto8 окт. 2026 г.

Checksum bypass for golang.org/fips140 in cmd/go

go toolchain · cmd/go8 окт. 2026 г.

Checksum database bypass for golang.org/toolchain in cmd/go

go toolchain · cmd/go8 окт. 2026 г.

Microsoft Bookings Elevation of Privilege Vulnerability

• Без аутентификации
• Нарушение контроля доступа (IDOR)

microsoft · microsoft bookings8 окт. 2026 г.

Microsoft Partner Center Elevation of Privilege Vulnerability

• Без аутентификации
• Слабая криптография

microsoft · partner center8 окт. 2026 г.

Reject malformed ECH outer extension references in crypto/tls

• Без аутентификации
• Отказ в обслуживании

go standard library · crypto/tls8 окт. 2026 г.

HTTP/2 server crash due to HPACK encoder race in net/http

• Без аутентификации
• Состояние гонки
• Отказ в обслуживании

go standard library · net/http8 окт. 2026 г.

Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB

• RCE без входа
• Ошибки памяти

falkordb · falkordb9 окт. 2026 г.

Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB

• Без аутентификации
• Ошибки памяти

falkordb · falkordb9 окт. 2026 г.

Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB

• RCE без входа
• Ошибки памяти

falkordb · falkordb9 окт. 2026 г.

Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message

• RCE без входа
• Ошибки памяти

falkordb · falkordb9 окт. 2026 г.

Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length

• Без аутентификации
• Ошибки памяти

falkordb · falkordb9 окт. 2026 г.

Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling

• Без аутентификации
• Обход аутентификации

falkordb · falkordb9 окт. 2026 г.

Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument

falkordb · falkordb9 окт. 2026 г.

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archi

backdropcms · backdrop9 окт. 2026 г.

AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import

• RCE
• Загрузка файлов

unknown · awp classifieds9 окт. 2026 г.

Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter

• Без аутентификации
• XSS

oceanwp · ocean pro demos9 окт. 2026 г.

FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation

unknown · foosales9 окт. 2026 г.

WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability

• RCE без входа
• Отказ в обслуживании

wp media · wp rocket9 окт. 2026 г.

Privilege Escalation in Telerik Report Server Service-Agent Hub

progress software · telerik report server9 окт. 2026 г.

Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers

• XSS

progress software · telerik report server9 окт. 2026 г.

Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap

• Ошибки памяти

zephyrproject · zephyr9 окт. 2026 г.

Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state

• Без аутентификации
• Ошибки памяти

zephyrproject · zephyr9 окт. 2026 г.

ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation

• Нарушение контроля доступа (IDOR)

zephyrproject · zephyr9 окт. 2026 г.

Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code

• RCE

zephyrproject · zephyr9 окт. 2026 г.

bpf: Use array_map_meta_equal for percpu array inner map replacement

linux · linux9 окт. 2026 г.

bpf: Skip unsettled links in link iterator

linux · linux9 окт. 2026 г.

veth: manage XDP program pointers during channel resize

linux · linux9 окт. 2026 г.

bpf: Reject dev-bound-only programs on other devices

linux · linux9 окт. 2026 г.

bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

linux · linux9 окт. 2026 г.

Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

• Без аутентификации
• Отказ в обслуживании

elixir-protobuf · protobuf9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability.

• Нарушение контроля доступа (IDOR)

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication

• Без аутентификации

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure De

• Локальное повышение привилегий

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Contro

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability.

• Без аутентификации
• Слабая криптография

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerabili

dell · policy manager for secure connect gateway9 окт. 2026 г.

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

• Без аутентификации
• Обход пути

red hat · red hat build of podman desktop9 окт. 2026 г.

Packet CTR reports a full success length after the counter is exhausted

• Без аутентификации

legion of the bouncy castle inc. · bc-lts-java9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key

• Нарушение контроля доступа (IDOR)

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability.

• SSRF

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vuln

• Без аутентификации
• Обход аутентификации

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key

• Нарушение контроля доступа (IDOR)

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Res

• Локальное повышение привилегий

dell · policy manager for secure connect gateway9 окт. 2026 г.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability.

• Нарушение контроля доступа (IDOR)

dell · policy manager for secure connect gateway9 окт. 2026 г.

WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability

• Без аутентификации
• SQL-инъекция

shinetheme · traveler9 окт. 2026 г.

WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

bkninja · gloria admin panel9 окт. 2026 г.

WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

klbtheme · total donations9 окт. 2026 г.

WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

themegoods · grand restaurant9 окт. 2026 г.

WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

upsolution · upsolution core9 окт. 2026 г.

WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

extend themes · kubio ai page builder9 окт. 2026 г.

WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

heateor support · sassy social share9 окт. 2026 г.

WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

muffingroup · betheme9 окт. 2026 г.

WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

• Без аутентификации
• Загрузка файлов

px-lab · zombify9 окт. 2026 г.

WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

• Десериализация

wp hosting as · pay with vipps for woocommerce9 окт. 2026 г.

WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

stiofan · blockstrap page builder - bootstrap blocks9 окт. 2026 г.

WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

stiofan · userswp9 окт. 2026 г.

WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

crocoblock · jetblog9 окт. 2026 г.

WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

• SQL-инъекция

metagauss · profilegrid9 окт. 2026 г.

WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

• Без аутентификации
• Обход пути

add-ons.org · pdf for contact form 79 окт. 2026 г.

WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

• Без аутентификации
• Обход пути

zealousweb · generate pdf using contact form 79 окт. 2026 г.

WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

dimitri grassi · salon booking system9 окт. 2026 г.

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

e4jvikwp · vikbooking hotel booking engine & pms9 окт. 2026 г.

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

mamunur rashid · shopbuilder – elementor woocommerce builder addons9 окт. 2026 г.

WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

codepeople · search in place9 окт. 2026 г.

WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

• SQL-инъекция

taskbuilder · taskbuilder9 окт. 2026 г.

WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

• SQL-инъекция

vibethemes · wplms9 окт. 2026 г.

WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

pluginus.net · husky9 окт. 2026 г.

WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

david lingren · media library assistant9 окт. 2026 г.

WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability

• SQL-инъекция

upsolution · upsolution core9 окт. 2026 г.

WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

• Без аутентификации
• SQL-инъекция

vibethemes · wplms9 окт. 2026 г.

WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability

• Без аутентификации
• SQL-инъекция

jegtheme · jnews - pay writer9 окт. 2026 г.

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

• SQL-инъекция

tagdiv · tagdiv opt-in builder9 окт. 2026 г.