Эксплуатируемые и новые серьёзные CVE: октябрь 2026 г.

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the r

• RCE без входа
• Ошибки памяти

google · chrome2 окт. 2026 г.

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

• RCE без входа

google · chrome2 окт. 2026 г.

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engi

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome2 окт. 2026 г.

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML

• Без аутентификации
• Утечка информации

google · chrome2 окт. 2026 г.

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox

• RCE без входа
• Ошибки памяти

google · chrome2 окт. 2026 г.

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome2 окт. 2026 г.

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome2 окт. 2026 г.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

• Без аутентификации
• Обход пути

demsking · image-downloader2 окт. 2026 г.

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

• Без аутентификации
• Десериализация
• Отказ в обслуживании

lxsmnsyc · seroval2 окт. 2026 г.

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

• Без аутентификации
• Десериализация

lxsmnsyc · seroval2 окт. 2026 г.

ProseMirror: XSS vulnerability in prosemirror-view's paste handling

• Без аутентификации
• XSS

prosemirror · prosemirror-view2 окт. 2026 г.

MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

• Нарушение контроля доступа (IDOR)

misp · misp2 окт. 2026 г.

MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

• Нарушение контроля доступа (IDOR)

misp · misp2 окт. 2026 г.

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.

• RCE без входа

2 окт. 2026 г.

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.

• Нарушение контроля доступа (IDOR)

2 окт. 2026 г.

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.

• Без аутентификации
• Нарушение контроля доступа (IDOR)

2 окт. 2026 г.

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write

• Без аутентификации
• Обход пути

2 окт. 2026 г.

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write ima

• Обход пути

2 окт. 2026 г.

vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).

• RCE без входа

2 окт. 2026 г.

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller.

• Нарушение контроля доступа (IDOR)

2 окт. 2026 г.

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.

• Без аутентификации
• Нарушение контроля доступа (IDOR)

2 окт. 2026 г.

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/know

• Без аутентификации
• Нарушение контроля доступа (IDOR)

2 окт. 2026 г.

FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.

• RCE без входа

2 окт. 2026 г.

FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().

• RCE без входа

2 окт. 2026 г.

agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py).

• RCE без входа

2 окт. 2026 г.

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition

• Без аутентификации
• Отказ в обслуживании

2 окт. 2026 г.

Next.js: Server-Side Request Forgery in Image Optimization

• Без аутентификации
• SSRF

vercel · next.js2 окт. 2026 г.

Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

• Без аутентификации

vercel · next.js2 окт. 2026 г.

Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

• Без аутентификации

vercel · next.js2 окт. 2026 г.

Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

• Нарушение контроля доступа (IDOR)

meari · iot cloud platform openapi service2 окт. 2026 г.

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

• RCE без входа
• Prototype pollution

tinylibs · tinypool2 окт. 2026 г.

Tinypool: Prototype Pollution Gadget to RCE in run() options

• RCE без входа
• Prototype pollution

tinylibs · tinypool2 окт. 2026 г.

fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

• RCE без входа
• SSTI

fsspec · filesystem_spec2 окт. 2026 г.

Nx daemon and plugin worker sockets are accessible to other local users

• Локальное повышение привилегий

nrwl · nx2 окт. 2026 г.

LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

• XSS

limesurvey · limesurvey2 окт. 2026 г.

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

• Без аутентификации
• Нарушение контроля доступа (IDOR)

apache software foundation · apache traffic server2 окт. 2026 г.

Nx: OS command injection in the @nx/docker release pipeline

• RCE
• Локальное повышение привилегий
• Инъекция команд

nrwl · nx2 окт. 2026 г.

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

• Без аутентификации
• Отказ в обслуживании

nodeca · probe-image-size2 окт. 2026 г.

Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover

• Без аутентификации

apache software foundation · apache openoffice2 окт. 2026 г.

CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php

• Без аутентификации
• Обход аутентификации
• Обход пути

damjan · codeart google mp3 audio player2 окт. 2026 г.

Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile

• Без аутентификации
• SSRF

weaver · e-bridge2 окт. 2026 г.

H3C CVM Unauthenticated File Upload via fileUpload/upload Token

• RCE без входа
• Обход пути
• Загрузка файлов

h3c · cvm2 окт. 2026 г.

Missing authentication for critical function in Loom for AWS

• Без аутентификации
• Обход аутентификации

aws · loom2 окт. 2026 г.

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

• SSRF

aws · loom2 окт. 2026 г.

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

• SSRF

aws · loom2 окт. 2026 г.

Microsoft Exchange Server Elevation of Privilege Vulnerability

• Обход аутентификации

microsoft · exchange server2 окт. 2026 г.

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio

• RCE
• Инъекция команд

aws · sagemaker-distribution2 окт. 2026 г.

LangGraph SDK custom auth silently ignores actions= on resource decorators

• Нарушение контроля доступа (IDOR)

langchain-ai · langgraph2 окт. 2026 г.

Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject

• Обход аутентификации

red hat · red hat certificate system 102 окт. 2026 г.

Phproject < 1.8.7 Missing Authorization via Issues REST API

• Нарушение контроля доступа (IDOR)

alanaktion · phproject2 окт. 2026 г.

WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability

• Без аутентификации
• CSRF

webriti · wallstreet2 окт. 2026 г.

UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter

• RCE
• SQL-инъекция

utmstack · utmstack2 окт. 2026 г.

UTMStack < 11.2.16 SSRF via IdentityProviderService

• SSRF

utmstack · utmstack2 окт. 2026 г.

OS Command Injection in Digi Accelerated Linux (DAL OS)

• RCE без входа
• Инъекция команд

digi international · ix family2 окт. 2026 г.

UTMStack < 11.2.16 Missing Authorization via Command WebSocket

• RCE
• Нарушение контроля доступа (IDOR)

utmstack · utmstack2 окт. 2026 г.

UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter

• Без аутентификации
• Обход аутентификации

utmstack · utmstack2 окт. 2026 г.

UTMStack < 11.2.16 JPQL Injection via searchPropertyValues

• SQL-инъекция

utmstack · utmstack2 окт. 2026 г.

Armatura LLC Armatura One Use of Hard-coded Cryptographic Key

• Зашитые учётные данные

armatura llc · armatura one2 окт. 2026 г.

Armatura LLC Armatura One Use of Hard-coded Credentials

• Зашитые учётные данные

armatura llc · armatura one2 окт. 2026 г.

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

• Утечка информации

armatura llc · armatura one2 окт. 2026 г.

Monta monta.app Missing Authentication for Critical Function

• Без аутентификации
• Обход аутентификации

monta · monta.app2 окт. 2026 г.

Monta monta.app Improper Restriction of Excessive Authentication Attempts

• Без аутентификации

monta · monta.app2 окт. 2026 г.

Praxis affected by HTTP/2 Bomb

• Без аутентификации
• Отказ в обслуживании

2 окт. 2026 г.

PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation

• RCE
• Инъекция команд

peazip · peazip2 окт. 2026 г.

MikroTik RouterOS Integer Underflow

• RCE без входа
• Ошибки памяти

mikrotik · routeros2 окт. 2026 г.

Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

• Без аутентификации
• Ошибки памяти

kvcache-ai · mooncake3 окт. 2026 г.

Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive

• Без аутентификации
• Утечка информации

backdrop · backdrop3 окт. 2026 г.

Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

• Обход пути

getformwork · formwork3 окт. 2026 г.

Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

• Без аутентификации
• Утечка информации

rajnandan1 · kener3 окт. 2026 г.

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Cali

c4illin · convertx3 окт. 2026 г.

Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

• Без аутентификации
• Нарушение контроля доступа (IDOR)

ultimatemember · ultimate member – user profile, registration, login, member directory, content restriction & membership plugin3 окт. 2026 г.

Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter

• Без аутентификации
• XSS

ultimatemember · ultimate member – user profile, registration, login, member directory, content restriction & membership plugin3 окт. 2026 г.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Informa

• RCE

properfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress3 окт. 2026 г.

Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment

• Без аутентификации
• XSS

devowl · real cookie banner: gdpr & eprivacy cookie consent3 окт. 2026 г.

Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Par

trainingbusinesspros · groundhogg — crm, newsletters, and marketing automation3 окт. 2026 г.

WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission

• Без аутентификации
• XSS

unknown · wp ultimate review3 окт. 2026 г.

WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating

• Без аутентификации
• Отказ в обслуживании

unknown · wp ultimate review3 окт. 2026 г.

WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode

• Без аутентификации
• Отказ в обслуживании

unknown · wp ultimate review3 окт. 2026 г.

WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings

• XSS

unknown · wp ultimate review3 окт. 2026 г.

Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter

• Без аутентификации
• Нарушение контроля доступа (IDOR)

villatheme · photo reviews for woocommerce3 окт. 2026 г.

Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author

• Без аутентификации
• XSS

magicplugins · magic tooltips for contact form 73 окт. 2026 г.

WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay

• Обход аутентификации

unknown · wp 2fa3 окт. 2026 г.

GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing

• Без аутентификации
• SQL-инъекция

paoltaia · geodirectory – wp business directory plugin and classified listings directory3 окт. 2026 г.

Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters

• Без аутентификации
• XSS

uscnanbu · welcart e-commerce3 окт. 2026 г.

Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content

• Без аутентификации
• XSS

unknown · kubio ai page builder3 окт. 2026 г.

SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters

• Без аутентификации
• SQL-инъекция

unknown · saveto wishlist lite3 окт. 2026 г.

TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

• Без аутентификации
• Обход аутентификации

unknown · tillkit3 окт. 2026 г.

GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX

• Без аутентификации
• XSS

gdragon · gd rating system3 окт. 2026 г.

SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name

• Без аутентификации
• XSS

rainbowgeek · seopress – ai seo plugin & on-site seo3 окт. 2026 г.

Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder

• Без аутентификации
• XSS

ivijanstefan · transliterator – multilingual and multi-script text conversion3 окт. 2026 г.

Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field

• Без аутентификации
• XSS

wpchill · strong testimonials3 окт. 2026 г.

Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation

• Без аутентификации
• Нарушение контроля доступа (IDOR)

wpinsider-1 · simple membership3 окт. 2026 г.

Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header

• Без аутентификации
• XSS

wp-buy · visitor traffic real time statistics3 окт. 2026 г.

Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter

• SQL-инъекция

storeapps · smart manager – woocommerce bulk edit: products, orders, users & more (spreadsheet)3 окт. 2026 г.

WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting

• RCE

arraytics · wpcafe – restaurant menu, online food ordering & table booking system3 окт. 2026 г.

VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter

• RCE без входа
• Обход пути

e4jvikwp · vikappointments services booking calendar3 окт. 2026 г.

Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message

• Без аутентификации
• XSS

wardee · mail logging & catcher3 окт. 2026 г.

Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter

• Нарушение контроля доступа (IDOR)

nelio · nelio content – editorial calendar & social media auto-posting3 окт. 2026 г.

WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter

• Без аутентификации
• SQL-инъекция

osamaesh · wp visitor statistics (real time traffic)3 окт. 2026 г.

WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name

• Без аутентификации
• Обход аутентификации
• XSS

wpclever · wpc product options for woocommerce3 окт. 2026 г.