Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge

• RCE без входа
• XSS

iflytek · astron-rpa9 окт. 2026 г.

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

• Без аутентификации

iflytek · astron-rpa9 окт. 2026 г.

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

• RCE
• Инъекция команд

argoproj · argo-cd9 окт. 2026 г.

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Pac

• Без аутентификации
• Отказ в обслуживании

9 окт. 2026 г.

MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

mariadb · mariadb9 окт. 2026 г.

MariaDB: insufficient validation of binary frm data when opening a table

mariadb · mariadb9 окт. 2026 г.

MariaDB: privilege escalation via incorrect view frm parsing

mariadb · mariadb9 окт. 2026 г.

x64dbg-MCP Server exposes debugger operations to unauthenticated network clients

• RCE без входа
• Обход аутентификации

duty1g · x64dbg-mcp-server9 окт. 2026 г.

OWASP Coraza WAF: JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)

• Без аутентификации
• Отказ в обслуживании

corazawaf · coraza9 окт. 2026 г.

RIOT: nanoCoAP Block2 client slice handling underflows on inconsistent server-controlled block size

• Без аутентификации
• Ошибки памяти

riot-os · riot9 окт. 2026 г.

RIOT: Out-of-Bounds Read in RIOT OS 6LoWPAN SFF Fragment Handling

• Без аутентификации
• Ошибки памяти

riot-os · riot9 окт. 2026 г.

RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable assertion

• Без аутентификации
• Отказ в обслуживании

riot-os · riot9 окт. 2026 г.

ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service

• Без аутентификации
• Отказ в обслуживании

luskaner · agelanserver9 окт. 2026 г.

yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels

• Без аутентификации
• Отказ в обслуживании

jhaals · yopass9 окт. 2026 г.

Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

• Нарушение контроля доступа (IDOR)

aws · aws-amplify/graphql-index-transformer9 окт. 2026 г.

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Ge

• Без аутентификации
• Отказ в обслуживании

9 окт. 2026 г.

OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser.

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

9 окт. 2026 г.

OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser.

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

9 окт. 2026 г.

OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser.

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

9 окт. 2026 г.

Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.

• Без аутентификации
• Утечка информации

9 окт. 2026 г.

Contao: Cross-site scripting in the comments bundle

• Без аутентификации
• XSS

contao · contao9 окт. 2026 г.

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.

• RCE без входа

9 окт. 2026 г.

Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)

jexactyl · jexactyl9 окт. 2026 г.

Tina: Code injection via unescaped Git branch name in generated client source

• RCE

tinacms · tinacms9 окт. 2026 г.

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

• XSS

tinacms · tinacms9 окт. 2026 г.

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

• Без аутентификации

tinacms · tinacms9 окт. 2026 г.

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

• RCE

iflytek · astron-agent9 окт. 2026 г.

Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

• RCE
• SSTI

wizarrrr · wizarr9 окт. 2026 г.

enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

• Без аутентификации

privasys · enclave-os-mini9 окт. 2026 г.

Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

• Без аутентификации

privasys · rustls9 окт. 2026 г.

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

go-vikunja · vikunja9 окт. 2026 г.

Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

• Обход аутентификации

go-vikunja · vikunja9 окт. 2026 г.

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

• Без аутентификации

go-vikunja · vikunja9 окт. 2026 г.

Aegisub executes arbitrary code through automatically loaded Automation scripts

• RCE
• Локальное повышение привилегий

typesettingtools · aegisub9 окт. 2026 г.

Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

• Без аутентификации

privasys · go9 окт. 2026 г.

enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

• Без аутентификации

privasys · enclave-os-virtual9 окт. 2026 г.

ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session

• Без аутентификации

privasys · ra-tls-clients9 окт. 2026 г.

CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident

netapp · trident9 окт. 2026 г.

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

• Без аутентификации
• SQL-инъекция

jetbrains · exposed10 окт. 2026 г.

ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

• RCE
• Инъекция команд

cellhubs · exiftool for photo and video10 окт. 2026 г.

Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

• Без аутентификации
• Обход аутентификации

inilerm · advanced ip blocker10 окт. 2026 г.

Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to

• Без аутентификации
• Обход аутентификации

nasirahmed · advanced form integration — connect forms to 300+ apps10 окт. 2026 г.

Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

• Без аутентификации

creativethemeshq · blocksy companion10 окт. 2026 г.

Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Uploa

• RCE без входа
• Загрузка файлов

htplugins · extensions for cf7 (contact form 7 database, conditional fields and redirection)10 окт. 2026 г.

3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

• RCE без входа
• Обход аутентификации
• Загрузка файлов

expivi · 3d product configurator for woocommerce10 окт. 2026 г.

Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting

• RCE

hostspa · fastcache by host.it10 окт. 2026 г.

rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Si

• Без аутентификации
• Нарушение контроля доступа (IDOR)

rtcamp · rtmedia for wordpress, buddypress and bbpress10 окт. 2026 г.

Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

• RCE без входа

themefusion · avada (fusion) builder10 окт. 2026 г.

LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

• Десериализация

lifterlms · lifterlms – wp lms for elearning, online courses, & quizzes10 окт. 2026 г.

Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

trainingbusinesspros · groundhogg — crm, newsletters, and marketing automation10 окт. 2026 г.

Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

• RCE
• Загрузка файлов

unknown · rank math seo10 окт. 2026 г.

Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress10 окт. 2026 г.

GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter

• RCE без входа

paoltaia · geodirectory – wp business directory plugin and classified listings directory10 окт. 2026 г.

Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

• Без аутентификации
• XSS

smub · easy digital downloads – ecommerce payments and subscriptions made easy10 окт. 2026 г.

FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

foosales · foosales – point of sale (pos) for woocommerce10 окт. 2026 г.

FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

• RCE
• Загрузка файлов
• Состояние гонки

foliovision · fv player 810 окт. 2026 г.

LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules

• Без аутентификации
• XSS

unknown · ltl freight quotes10 окт. 2026 г.

LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter

• Без аутентификации
• SQL-инъекция

unknown · ltl freight quotes10 окт. 2026 г.

Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

• Без аутентификации

trainingbusinesspros · groundhogg — crm, newsletters, and marketing automation10 окт. 2026 г.

Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook

• Без аутентификации
• XSS

eteubert · podlove podcast publisher10 окт. 2026 г.

SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP

• Без аутентификации
• Обход аутентификации

unknown · sms alert10 окт. 2026 г.

SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

• Без аутентификации

unknown · sms alert10 окт. 2026 г.

Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

• Без аутентификации
• XSS

rameez_iqbal · real estate manager – property listing and agent management10 окт. 2026 г.

Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

• Без аутентификации
• XSS

2winfactor · presto player10 окт. 2026 г.

Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

• Без аутентификации
• XSS

villatheme · photo reviews for woocommerce10 окт. 2026 г.

LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

• Без аутентификации
• XSS

wp_media · lazyload plugin – lazy load images, videos, and iframes10 окт. 2026 г.

PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

• RCE без входа
• Обход пути

themeisle · ppom – product addons & custom fields for woocommerce10 окт. 2026 г.

10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

• Без аутентификации
• XSS

10web · 10web booster – website speed optimization, cache & page speed optimizer10 окт. 2026 г.

Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter

• Десериализация

ladela · online scheduling and appointment booking system – bookly10 окт. 2026 г.

WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions

• Нарушение контроля доступа (IDOR)

joomunited · wp file download10 окт. 2026 г.

VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

• Без аутентификации
• XSS

e4jvikwp · vikbooking hotel booking engine & pms10 окт. 2026 г.

Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

• Без аутентификации
• XSS

expresstech · quiz and survey master (qsm) – quiz maker & survey maker10 окт. 2026 г.

WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

• Без аутентификации
• XSS

aguidrevitch · wp meteor website speed optimization addon10 окт. 2026 г.

Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

• Без аутентификации
• XSS

wpxpo · post grid gutenberg blocks – postx10 окт. 2026 г.

FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

• Без аутентификации
• XSS

teamfunnelkit · funnelkit – funnel builder for woocommerce checkout10 окт. 2026 г.

WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

• Без аутентификации
• XSS

gwin · wpadverts – classifieds plugin10 окт. 2026 г.

Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

• Без аутентификации
• XSS

molongui · molongui authorship – author boxes, guest authors & co-authors for wordpress10 окт. 2026 г.

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Ve

• Без аутентификации
• Обход аутентификации

wpo365 · wpo365 | seamless wordpress + microsoft integration (wpo365 | login)10 окт. 2026 г.

WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

• Без аутентификации
• Обход аутентификации

whyun · wpcom member10 окт. 2026 г.

WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

• Десериализация

yith · yith woocommerce affiliates10 окт. 2026 г.

WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · booklovers10 окт. 2026 г.

WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · gutentype10 окт. 2026 г.

WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized

• Без аутентификации
• Нарушение контроля доступа (IDOR)

webtoffee · webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labels10 окт. 2026 г.

WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

axiomthemes · veto10 окт. 2026 г.

WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · travesia10 окт. 2026 г.

WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · tantra10 окт. 2026 г.

WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · smash10 окт. 2026 г.

WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · smart casa10 окт. 2026 г.

WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · rosalinda10 окт. 2026 г.

WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · partiso10 окт. 2026 г.

WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · let's play10 окт. 2026 г.

WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · ipharm10 окт. 2026 г.

WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · hygia10 окт. 2026 г.

WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · hogwords10 окт. 2026 г.

WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · greeny10 окт. 2026 г.

WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · edema10 окт. 2026 г.

WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · dwell10 окт. 2026 г.

WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · convex10 окт. 2026 г.

WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

themerex group · camelia10 окт. 2026 г.

WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

axiomthemes · balance10 окт. 2026 г.