Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

• Без аутентификации
• XSS

themefic · ultra addons for contact form 716 окт. 2026 г.

Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

• Без аутентификации
• XSS

croixhaug · simply schedule appointments16 окт. 2026 г.

Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

• RCE
• Десериализация

johnny5 · search regex16 окт. 2026 г.

SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

• Без аутентификации
• XSS

gpriday · siteorigin css16 окт. 2026 г.

Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX

• Без аутентификации
• XSS

wordpresschef · salon booking system – appointment booking for salons, barbershops & spas16 окт. 2026 г.

User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

• Без аутентификации

cozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editor16 окт. 2026 г.

NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

• Без аутентификации
• XSS

wpdevteam · notificationx – fomo, live sales notification, woocommerce sales popup, gdpr, social proof, announcement banner & floating notification bar16 окт. 2026 г.

SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

• Без аутентификации
• XSS

gpriday · siteorigin css16 окт. 2026 г.

PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter

ontraport · pilotpress16 окт. 2026 г.

Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content

• Без аутентификации
• XSS

johndarrel · hide my wp ghost – security & firewall16 окт. 2026 г.

Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

• Без аутентификации

jfarthing84 · theme my login16 окт. 2026 г.

Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter

• Без аутентификации
• XSS

optiuser · opti-behavior – self-hosted heatmaps, funnels, a/b testing & smart insights16 окт. 2026 г.

Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter

• Без аутентификации
• XSS

optiuser · opti-behavior – self-hosted heatmaps, funnels, a/b testing & smart insights16 окт. 2026 г.

Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

• Без аутентификации
• XSS

magazine3 · schema & structured data for wp & amp16 окт. 2026 г.

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

• Локальное повышение привилегий

red hat · red hat enterprise linux 1016 окт. 2026 г.

Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter

• Без аутентификации
• Десериализация

sunshinephotocart · sunshine photo cart – client photo gallery & photo proofing for photographers16 окт. 2026 г.

TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

• Без аутентификации
• XSS

cozmoslabs · translatepress – translate multilingual sites with ai translation16 окт. 2026 г.

HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value

• Без аутентификации
• XSS

hivepress · hivepress – business directory, listings & classified ads plugin16 окт. 2026 г.

Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF

• Без аутентификации
• CSRF

unknown · salon booking system16 окт. 2026 г.

OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

• Без аутентификации
• Обход аутентификации

unknown · otp login & register woocommerce16 окт. 2026 г.

CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter

• Без аутентификации
• XSS

codepeople · cp multi view events calendar16 окт. 2026 г.

WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

• RCE
• Инъекция команд

opajaap · wp photo album plus16 окт. 2026 г.

YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension

• RCE
• Загрузка файлов

yaycommerce · yaysmtp – wp mail smtp with email logs, tracking & reports16 окт. 2026 г.

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

• RCE без входа
• Инъекция команд

theme-one · the grid16 окт. 2026 г.

WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

• Без аутентификации
• SQL-инъекция

halfdata · green popups16 окт. 2026 г.

WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

houzez.co · houzez16 окт. 2026 г.

WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

rocketgenius, inc · gravity forms16 окт. 2026 г.

WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

• Без аутентификации
• XSS

smub · wpconsent – cookie banner & cookie consent for privacy compliance (gdpr / ccpa / eu compliance cookie notice)16 окт. 2026 г.

Mattermost SAML RelayState forgery allows unauthorized team membership

mattermost · mattermost server16 окт. 2026 г.

Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials

• Без аутентификации
• Обход аутентификации

manuelgalan · vulnity security16 окт. 2026 г.

User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header

• Без аутентификации
• XSS

wpeverest · user registration pro – custom registration form, login form, and user profile wordpress plugin16 окт. 2026 г.

Server-Side Request Forgery in Wegow PDF export

• SSRF

wegow technologies · wegow16 окт. 2026 г.

SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment

• Без аутентификации
• XSS

surecart · surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments16 окт. 2026 г.

DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint

• RCE
• Загрузка файлов

samuelgallegos · doublescale crm | all-in-one crm – sales, multi-channel marketing, newsletter, booking, helpdesk, automation, mcp & more16 окт. 2026 г.

SQL injection in TSG Profleet

• Без аутентификации
• SQL-инъекция

tsg · profleet16 окт. 2026 г.

User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure

• Без аутентификации

ikas technology inc. · ikas e-commerce infrastructure16 окт. 2026 г.

Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

• Без аутентификации
• SQL-инъекция

appsbd · vitepos – point of sale (pos) for woocommerce16 окт. 2026 г.

Open redirect and XSS via reset_url parameter

• RCE без входа
• XSS
• Открытый редирект

checkmk gmbh · checkmk16 окт. 2026 г.

GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body

• Без аутентификации
• XSS

softaculous · gosmtp pro16 окт. 2026 г.

Missing Authorization in rdiffweb

• Нарушение контроля доступа (IDOR)

ikus-soft · rdiffweb16 окт. 2026 г.

Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

• Ошибки памяти

red hat · red hat enterprise linux 616 окт. 2026 г.

WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter

• Без аутентификации
• XSS

switcorp · wp sessions time monitoring full automatic16 окт. 2026 г.

SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter

• RCE без входа

sgl-project · sglang16 окт. 2026 г.

Spice-server: spice: heap oob read/write via unchecked migration data offsets

• Ошибки памяти

red hat · red hat enterprise linux 616 окт. 2026 г.

gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption

• Без аутентификации
• Отказ в обслуживании

gocsaf development community · csaf_provider16 окт. 2026 г.

WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

• Без аутентификации
• Нарушение контроля доступа (IDOR)

wp chill · passster16 окт. 2026 г.

WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability

• Нарушение контроля доступа (IDOR)

liquid web / stellarwp · advanced post manager16 окт. 2026 г.

WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability

• SQL-инъекция

pt norther lights production · mapsvg16 окт. 2026 г.

Apache Kylin: Low-Privilege Config Exposure

• Без аутентификации
• Утечка информации

apache software foundation · apache kylin16 окт. 2026 г.

Apache Kylin: Missing authorization and path-confinement on system meta dump

• Без аутентификации
• Нарушение контроля доступа (IDOR)

apache software foundation · apache kylin16 окт. 2026 г.

Apache Kylin: Redis unsafe Java deserialization

• Без аутентификации
• Десериализация

apache software foundation · apache kylin16 окт. 2026 г.

Apache Kylin: Missing authentication on certain cache API endpoints

• Без аутентификации
• Обход аутентификации
• SQL-инъекция

apache software foundation · apache kylin16 окт. 2026 г.

Apache Kylin: JDBC URL Whitelist Verification Bypass

• RCE

apache software foundation · apache kylin16 окт. 2026 г.

Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials

• Без аутентификации
• Зашитые учётные данные

guangzhou juan iot technology co., ltd. · eseecloud app16 окт. 2026 г.

WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability

• Без аутентификации
• CSRF

athemeart · athemeart theme helper16 окт. 2026 г.

Improper Encoding or Escaping of Output in Crafty Controller

• Без аутентификации
• XSS

arcadia technology, llc · crafty controller16 окт. 2026 г.

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting u

• RCE без входа
• XSS

16 окт. 2026 г.

J4Care dcm4che Inefficient Algorithmic Complexity

• Без аутентификации

j4care · dcm4chee-arc-light16 окт. 2026 г.

J4Care dcm4che Loop with Unreachable Exit Condition

• Без аутентификации
• Отказ в обслуживании

j4care · dcm4chee-arc-light16 окт. 2026 г.

J4Care dcm4che Missing Authentication for Critical Function

• Без аутентификации
• Обход аутентификации

j4care · dcm4chee-arc-light16 окт. 2026 г.

J4Care dcm4che Missing Authentication for Critical Function

• Без аутентификации
• Обход аутентификации

j4care · dcm4chee-arc-light16 окт. 2026 г.

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.

• Нарушение контроля доступа (IDOR)

16 окт. 2026 г.

J4Care dcm4che Loop with Unreachable Exit Condition

• Без аутентификации
• Отказ в обслуживании

j4care · dcm4chee-arc-light16 окт. 2026 г.

Thermo Fisher Torrent Suite Software Path Traversal

• Обход пути

thermo fisher · torrent suite software16 окт. 2026 г.

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace conf

• RCE
• Инъекция команд

16 окт. 2026 г.

An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening craf

• RCE без входа

16 окт. 2026 г.

An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack v

• RCE без входа

16 окт. 2026 г.

J4Care dcm4che Missing Authorization

• Без аутентификации
• Нарушение контроля доступа (IDOR)

j4care · dcm4chee-arc-light16 окт. 2026 г.

gomarkdown/markdown IsSafeURL panics on short URLs

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

gomarkdown · markdown16 окт. 2026 г.

Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the Ut

• RCE без входа
• Ошибки памяти

16 окт. 2026 г.

countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files

• Без аутентификации
• Обход пути

countly · countly-server16 окт. 2026 г.

countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion

• Обход пути

countly · countly-server16 окт. 2026 г.

countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception

• Без аутентификации
• Отказ в обслуживании

countly · countly-server16 окт. 2026 г.

countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

• XSS

countly · countly-server16 окт. 2026 г.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2.

• Без аутентификации
• Ошибки памяти

16 окт. 2026 г.

libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead

• Без аутентификации
• Ошибки памяти

mz-automation · libiec6185016 окт. 2026 г.

libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads to server-side DoS

• Без аутентификации
• Отказ в обслуживании

mz-automation · libiec6185016 окт. 2026 г.

TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

• RCE
• Локальное повышение привилегий

helge17 · tuxguitar16 окт. 2026 г.

pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

pupnp project · pupnp16 окт. 2026 г.

libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered

• Без аутентификации
• Отказ в обслуживании

pupnp project · pupnp16 окт. 2026 г.

pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling

• Без аутентификации
• Ошибки памяти

pupnp project · pupnp16 окт. 2026 г.

libIEC61850: Infinite loop and out-of-bounds read in ACSE parseUserInformation when parsing a malformed AARE PDU

• Без аутентификации
• Ошибки памяти

mz-automation · libiec6185016 окт. 2026 г.

libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments

• Без аутентификации
• Ошибки памяти

mz-automation · libiec6185016 окт. 2026 г.

pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

• Без аутентификации
• Отказ в обслуживании

pupnp project · pupnp16 окт. 2026 г.

SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

• RCE
• Инъекция команд

codewithcj · sparkyfitness16 окт. 2026 г.

libp2p-rust: Gossipsub GRAFT topics unbounded growth

• Без аутентификации
• Отказ в обслуживании

libp2p · rust-libp2p16 окт. 2026 г.

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

ubports · lomiri-download-manager16 окт. 2026 г.

RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access

• Без аутентификации
• Ошибки памяти

riot-os · riot16 окт. 2026 г.

RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID

• Без аутентификации
• Ошибки памяти

riot-os · riot16 окт. 2026 г.

RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read

• Без аутентификации
• Ошибки памяти

riot-os · riot16 окт. 2026 г.

Dockhand: Unauthenticated container exec via WebSocket upgrade

• RCE без входа
• Обход аутентификации

finsys · dockhand16 окт. 2026 г.

dcg: Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open

• Отказ в обслуживании

dicklesworthstone · destructive_command_guard16 окт. 2026 г.

MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

• Ошибки памяти

mariadb · mariadb16 окт. 2026 г.

MariaDB: Use-after-free with a large number of SYS_REFCURSOR's

• RCE
• Ошибки памяти

mariadb · mariadb16 окт. 2026 г.

Mailu domain managers can take over higher-privileged accounts

mailu · mailu16 окт. 2026 г.

Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control

• Нарушение контроля доступа (IDOR)

mailu · mailu16 окт. 2026 г.

MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

• SQL-инъекция

mariadb · mariadb16 окт. 2026 г.

MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

• RCE

mariadb · mariadb16 окт. 2026 г.

MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

mariadb · mariadb16 окт. 2026 г.

Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling

• Без аутентификации

freertos · freertos-plus-tcp16 окт. 2026 г.