Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denia

• Ошибки памяти

openvpn · openvpn13 окт. 2026 г.

Inductive Automation Ignition Software Incorrect Authorization

• RCE
• Нарушение контроля доступа (IDOR)

inductive automation · ignition14 окт. 2026 г.

Improper Authentication and Credential Exposure in Multiple TP-Link Kasa Devices

• Без аутентификации
• Обход аутентификации

tp-link systems inc. · hs103 v514 окт. 2026 г.

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.

• Локальное повышение привилегий

hyland · desktop host14 окт. 2026 г.

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbo

• RCE
• Обход пути

onlyoffice · document server14 окт. 2026 г.

Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'pub

• Без аутентификации
• Нарушение контроля доступа (IDOR)
• CSRF

masaakitanaka · booking package14 окт. 2026 г.

Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-C

• Без аутентификации

bitpressadmin · bit integrations – form integration, webhook, spreadsheets, crm, lms & email automation14 окт. 2026 г.

Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache

davefx · membership & user roles for woocommerce (automatic role changer)14 окт. 2026 г.

BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value

• RCE без входа

dontdream · bp profile search14 окт. 2026 г.

Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning

• RCE без входа
• Инъекция команд

samsung open source · qa-board14 окт. 2026 г.

Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Delet

• Нарушение контроля доступа (IDOR)

wpwax · directorist: ai-powered business directory, listings & classified ads14 окт. 2026 г.

Insecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Server

hitachi · hitachi disk array driver for aix14 окт. 2026 г.

Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

• RCE без входа

holithemes · click to chat – holithemes14 окт. 2026 г.

Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdes

• RCE без входа
• Загрузка файлов

printcart · printcart store – web to print product designer for woocommerce14 окт. 2026 г.

Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter

• Без аутентификации
• SQL-инъекция

tyche softwares · abandoned cart pro for woocommerce14 окт. 2026 г.

AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

• Без аутентификации
• XSS

ateshabaev · anycomment14 окт. 2026 г.

Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter

• RCE без входа
• Загрузка файлов

snazzyplugins · snazzy social media feed14 окт. 2026 г.

TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection

• RCE без входа

teamplus technology · teamplus messenger14 окт. 2026 г.

TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection

• RCE без входа

teamplus technology · teamplus messenger14 окт. 2026 г.

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in th

• RCE без входа
• Инъекция команд

collabora · online14 окт. 2026 г.

Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL

• RCE

epic games · unreal engine14 окт. 2026 г.

Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' P

• Без аутентификации
• Обход аутентификации
• Нарушение контроля доступа (IDOR)

tyche softwares · abandoned cart pro for woocommerce14 окт. 2026 г.

Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value

• Без аутентификации
• SQL-инъекция

tyche softwares · abandoned cart pro for woocommerce14 окт. 2026 г.

NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)

• Без аутентификации
• XSS

ice00 · newstatpress14 окт. 2026 г.

AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php

• RCE без входа
• Обход аутентификации
• Загрузка файлов

streetforce1 · age-gate14 окт. 2026 г.

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions bec

• Без аутентификации
• Ошибки памяти

nixos · nix14 окт. 2026 г.

Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting

• Без аутентификации
• XSS

danrossiter · document gallery14 окт. 2026 г.

JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection

• Без аутентификации
• SQL-инъекция

ntbyk · jtl-connector for woocommerce14 окт. 2026 г.

Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values

• Без аутентификации
• XSS

doctorwp · contact form db for enfold14 окт. 2026 г.

JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method

• RCE без входа
• Загрузка файлов

ntbyk · jtl-connector for woocommerce14 окт. 2026 г.

Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter

• Без аутентификации
• XSS

blackworks1 · cryptocurrency donation box – bitcoin & crypto donations14 окт. 2026 г.

Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)

• Без аутентификации
• Обход аутентификации
• XSS

avisverifies · verified reviews (avis vérifiés)14 окт. 2026 г.

Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter

• Без аутентификации
• SQL-инъекция

10web · form maker by 10web – mobile-friendly drag & drop contact form builder14 окт. 2026 г.

Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter

• Без аутентификации
• XSS

edgarrojas · smart forms – when you need more than just a contact form14 окт. 2026 г.

Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter

• Без аутентификации
• SQL-инъекция

pasyuk · gmedia photo gallery14 окт. 2026 г.

FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

• Без аутентификации
• XSS

foliovision · fv flowplayer video player14 окт. 2026 г.

NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String

• Без аутентификации
• XSS

ice00 · newstatpress14 окт. 2026 г.

NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution

• RCE
• Инъекция команд

netbird · netbird14 окт. 2026 г.

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with r

• RCE
• Локальное повышение привилегий
• Инъекция команд

e-guardian · siteguard14 окт. 2026 г.

Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store

• Локальное повышение привилегий

nixos · nix14 окт. 2026 г.

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in

• RCE без входа
• Инъекция команд

ubiquiti inc · unifi protect ai key14 окт. 2026 г.

Multiple smartphones provided by Rakuten Mobile, Inc.

rakuten mobile, inc. · rakuten mini14 окт. 2026 г.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain

• Без аутентификации
• Нарушение контроля доступа (IDOR)

ubiquiti inc · unifi protect ai key14 окт. 2026 г.

Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.

akamai · guardicore platform agent14 окт. 2026 г.

Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook

• Без аутентификации
• SQL-инъекция

unknown · walletdoc payment gateway for woocommerce14 окт. 2026 г.

WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header

• Без аутентификации
• XSS

unknown · wp booking system14 окт. 2026 г.

Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter

• Без аутентификации
• Обход пути

unknown · ultimate multisite14 окт. 2026 г.

File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion

• Без аутентификации
• Обход пути

unknown · file upload to order14 окт. 2026 г.

Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive

• RCE

unknown · affiliate-toolkit14 окт. 2026 г.

Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission

• Без аутентификации
• XSS

unknown · forms14 окт. 2026 г.

Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter

• Без аутентификации
• SQL-инъекция

unknown · fast courier14 окт. 2026 г.

SQL Command Injection Vulnerability in JTL-WMS

• RCE
• SQL-инъекция
• Инъекция команд

jtl sw gmbh · jtl-wms14 окт. 2026 г.

Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_cus

• Без аутентификации
• Обход аутентификации

latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress14 окт. 2026 г.

Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Para

• Без аутентификации
• Нарушение контроля доступа (IDOR)

latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress14 окт. 2026 г.

ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

• RCE без входа

wpdesk · shopmagic – email automation for wordpress14 окт. 2026 г.

SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register

• Без аутентификации

wpazleen · simpleform – form maker to chat apps with quiz, poll and multi lead notifications14 окт. 2026 г.

Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter

• Десериализация

wpazleen · post export import with media14 окт. 2026 г.

Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter

• RCE без входа

kitae-park · mang board14 окт. 2026 г.

Koha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task

• RCE
• Инъекция команд

koha community · koha14 окт. 2026 г.

Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

• SQL-инъекция

koha community · koha14 окт. 2026 г.

Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter

• Без аутентификации
• XSS

davidevalerio · record of consent extension for complianz14 окт. 2026 г.

Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter

• Без аутентификации
• XSS

kitae-park · mang board14 окт. 2026 г.

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

• SQL-инъекция

codepeople · cp multi view event calendar14 окт. 2026 г.

LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes

• RCE

lifterlms · lifterlms – wp lms for elearning, online courses, & quizzes14 окт. 2026 г.

HTTP/2 upload Use-After-Free

• Без аутентификации
• Ошибки памяти

curl · curl14 окт. 2026 г.

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

videowhisper.com · paid videochat turnkey site14 окт. 2026 г.

Unauthorised disclosure of information on Copart’s online billing service

• Без аутентификации
• Утечка информации

copart · copart’s online billing service14 окт. 2026 г.

HPE NonStop iTP WebServer - Memory corruption vulnerability

• Без аутентификации

hewlett packard enterprise · hpe nonstop itp webserver14 окт. 2026 г.

HPE NonStop Middleware - Secret key handling vulnerability

• Десериализация

hewlett packard enterprise · hpe nonstop middleware14 окт. 2026 г.

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

• Десериализация
• Ошибки памяти

red hat · red hat enterprise linux 1014 окт. 2026 г.

Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

• Без аутентификации

red hat · red hat hardened images14 окт. 2026 г.

Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

red hat · red hat hardened images14 окт. 2026 г.

Stack overwrite from specially formatted base64 RDATA field

• Ошибки памяти

nlnet labs · nsd14 окт. 2026 г.

Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR

• Ошибки памяти

nlnet labs · nsd14 окт. 2026 г.

Stack overwrite from a specially crafted and formatted HIP RR

• Ошибки памяти

nlnet labs · nsd14 окт. 2026 г.

Stack overwrite from specially formatted TXT-DATA RDATA field

• Ошибки памяти

nlnet labs · nsd14 окт. 2026 г.

WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

• RCE без входа

villatheme · email template customizer for woocommerce14 окт. 2026 г.

Stored XSS Vulnerability in JTL-Shop

• Без аутентификации
• XSS

jtl-software gmbh · jtl-shop14 окт. 2026 г.

Unauthenticated Plugin Safe Mode Toggle Vulnerability in JTL-Shop

• Без аутентификации
• Обход аутентификации

jtl-software gmbh · jtl-shop14 окт. 2026 г.

Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

• Локальное повышение привилегий

red hat · red hat openshift container platform 414 окт. 2026 г.

WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability

• SQL-инъекция

webnus · modern events calendar lite14 окт. 2026 г.

WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

• Без аутентификации
• Нарушение контроля доступа (IDOR)
• Отказ в обслуживании

crocoblock · jetformbuilder14 окт. 2026 г.

Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access

• Без аутентификации

tsplus · tsplus remote access14 окт. 2026 г.

Improper Multi-Factor Authentication Validation Allows Authentication Bypass

• Обход аутентификации

tsplus · tsplus remote access14 окт. 2026 г.

Remote DoS through unchecked `IdList` allocation in negentropy

• Без аутентификации
• Отказ в обслуживании

14 окт. 2026 г.

HPE NonStop DNS 9.2.3 Non Secure Version

• Без аутентификации

hewlett packard enterprise · hpe nonstop dns 9.2.3 non secure version14 окт. 2026 г.

HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability

• RCE без входа
• Ошибки памяти
• Отказ в обслуживании

hewlett packard enterprise · hpe nonstop snmp trap multiplexer14 окт. 2026 г.

Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation

• Нарушение контроля доступа (IDOR)

google cloud · application integration14 окт. 2026 г.

WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

brainstorm force · surecart14 окт. 2026 г.

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

• Десериализация

brainstorm force · surecart14 окт. 2026 г.

WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

• Без аутентификации

videowhisper.com · broadcast live video14 окт. 2026 г.

WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability

• Без аутентификации

m a vinoth kumar · frontend dashboard14 окт. 2026 г.

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

• Без аутентификации
• Нарушение контроля доступа (IDOR)

videowhisper.com · paid videochat turnkey site14 окт. 2026 г.

WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

crocoblock · jetproducttables14 окт. 2026 г.

WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

itthinx · affiliates14 окт. 2026 г.

Missing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP

• RCE без входа
• Обход аутентификации
• Инъекция команд

tr7 cyber ​​defense inc. · tr7 asp14 окт. 2026 г.

OS Command in TR7 Cyber ​​Defense's TR7 ASP

• RCE без входа
• Инъекция команд

tr7 cyber ​​defense inc. · tr7 asp14 окт. 2026 г.

Radar < 1.12.2 Missing Authorization via /api/local-terminal

• RCE
• Нарушение контроля доступа (IDOR)

skyhook-io · radar14 окт. 2026 г.

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

• Десериализация

wp syntex · polylang14 окт. 2026 г.

WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

crocoblock · jetengine14 окт. 2026 г.