Exploited and new serious CVEs: October 2026

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

• Pre-auth

mtrudel · bandit1 day ago

Quadratic bignum parsing of Content-Length and Host port values in Bandit

• Pre-auth

mtrudel · bandit1 day ago

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

• Pre-auth
• Denial of service

mtrudel · bandit1 day ago

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.

• RCE
• File upload

1 day ago

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic.

• RCE
• SSTI

1 day ago

An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and custom field properties.

• RCE
• Deserialization

1 day ago

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax).

• SQL injection

1 day ago

An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}).

• SQL injection

1 day ago

A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7.

• Pre-auth
• XSS

1 day ago

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

• Pre-auth
• Denial of service

mtrudel · bandit1 day ago

Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

• Pre-auth
• Weak crypto

benoitc · hackney1 day ago

Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

• Pre-auth
• CSRF

webasyst · webasyst framework1 day ago

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

• Pre-auth
• Auth bypass

maccmspro · maccms101 day ago

Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

• SQL injection

dolibarr · dolibarr1 day ago

Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

• RCE
• Command injection

dolibarr · dolibarr1 day ago

danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

• Pre-auth
• Auth bypass
• SSRF

huangxd- · danmu_api1 day ago

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

• Memory safety

nxp · mcuxsdk-middleware-usb1 day ago

NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

• Memory safety

nxp · mcuxsdk-middleware-usb1 day ago

Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API

• Broken access control (IDOR)

frappe · crm1 day ago

Unauthenticated RCE Vulnerability in WolfProt interface implementation

• pre-auth RCE
• Command injection

wolfvision · cynap pure (next gen), cynap bridge1 day ago

Shared SSH Authentication Key in vSolution Matrix File Sharing

• Pre-auth

wolfvision · cynap pro, cynap core pro1 day ago

Unbounded response body buffering and decompression in hackney

• Pre-auth

benoitc · hackney1 day ago

An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileg

1 day ago

TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

• Pre-auth
• Auth bypass
• Hard-coded credentials

sciener · ttlock1 day ago

MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs

• Pre-auth
• Weak crypto

mongodb, inc. · mongosh1 day ago

SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Lo

• RCE
• SQL injection

1 day ago

Avocent ACS8000 wsserver command injection

• pre-auth RCE
• Command injection

vertiv · avocent acs80001 day ago

Missing Authentication for Node-RED in boneIO

• pre-auth RCE
• Auth bypass

boneio · boneio1 day ago

Missing Authentication in Default Configuration in boneIO

• Pre-auth
• Auth bypass

boneio · boneio1 day ago

Improper Privilege Assignment in boneIO

• Local privilege escalation

boneio · black_debian_images1 day ago

Use of Default Credentials in boneIO

• Pre-auth
• Hard-coded credentials

boneio · black_debian_images1 day ago

TOCTOU Race Condition in boneIO

• Local privilege escalation
• Race condition

boneio · boneio1 day ago

Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Defaul

• Pre-auth
• XXE

apache software foundation · apache camel1 day ago

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

• Pre-auth
• Path traversal

google cloud · mcp toolbox for databases (googleapis/mcp-toolbox)1 day ago

Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

syncplify, inc. · syncplify server!1 day ago

Syncplify Server! < 8.8.0 Symbolic Link Jail Escape

• Path traversal

syncplify, inc. · syncplify server!1 day ago

OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE

• pre-auth RCE

openhands · openhands software agent sdk1 day ago

Apache Vysper: Unbounded allocation

• Pre-auth
• Denial of service

apache software foundation · apache vysper1 day ago

Apache Vysper: Authorization bypass

• Broken access control (IDOR)

apache software foundation · apache vysper1 day ago

Timescale pgvectorscale before 0.9.1 Type Confusion via Unqualified DiskANN Operator Classes

timescale · pgvectorscale1 day ago

Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO

• Pre-auth
• Memory safety

netty · netty-tcnative1 day ago

netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

• Pre-auth
• Memory safety

netty · netty-tcnative1 day ago

netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

• Pre-auth

netty · netty-tcnative1 day ago

Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser

• Pre-auth
• Memory safety

open5gs · open5gs1 day ago

Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

• pre-auth RCE

google cloud · cloud run mcp1 day ago

SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha

• SQL injection
• Local privilege escalation

aws · aws-cdk/aws-redshift-alpha1 day ago

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

• pre-auth RCE

zip-rs · zip21 day ago

zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size

• Pre-auth
• Denial of service

zip-rs · zip21 day ago

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787

• Pre-auth
• Path traversal

zip-rs · zip21 day ago

zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

• Pre-auth
• Denial of service

zip-rs · zip21 day ago

vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled

• Deserialization

vllm-project · vllm1 day ago

2K Games Sid Meier's Civilization VI Lua sandbox loadstring type confusion

• Pre-auth

2k games · sid meier's civilization iv1 day ago

A flaw was found in GStreamer Editing Services (gst-editing-services).

gstreamer project · gst-editing-services1 day ago

Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.

• Hard-coded credentials

johnson controls · kantech entrapass1 day ago

Bluetooth OTS server discloses uninitialized stack memory in failed Calculate Checksum responses

• Pre-auth

zephyrproject · zephyr1 day ago

Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset

• Pre-auth
• Auth bypass

padok-team · burrito1 day ago

Consul vulnerable to an authorization bypass in service mesh registration

hashicorp · consul1 day ago

Consul vulnerable to a denial of service in HTTP APIs

• Pre-auth
• Denial of service

hashicorp · consul1 day ago

Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API

• Pre-auth
• Broken access control (IDOR)

hashicorp · consul1 day ago

BUG-000187511 - ArcGIS Server has a security vulnerability.

• Pre-auth
• SQL injection

esri · arcgis server1 day ago

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

• pre-auth RCE

vllm-project · vllm1 day ago

OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens

• Pre-auth
• Auth bypass

cheaper-inference · omniroute1 day ago

BUG-000186514 - ArcGIS Server has a security vulnerability.

• Pre-auth
• Denial of service

esri · arcgis server1 day ago

Unauthorized Access to vSolution Matrix RTSP

• Pre-auth
• Weak crypto

wolfvision · cynap pro, cynap core pro1 day ago

Routinator incorrectly handles delta updates

• Pre-auth

nlnet labs · routinator1 day ago

Routinator exits when parsing an incorrect or very large CRL file

• Pre-auth
• Denial of service

nlnet labs · routinator1 day ago

Routinator exits on malformed rsync URIs

• Pre-auth
• Denial of service

nlnet labs · routinator1 day ago

Routinator may exit on malformed ranges

• Pre-auth
• Denial of service

nlnet labs · routinator1 day ago

Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules

• Broken access control (IDOR)

hashicorp · tooling1 day ago

Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs

• Pre-auth
• Path traversal

danielgatis · rembg1 day ago

Asterisk: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing

• Memory safety

asterisk · asterisk1 day ago

Weak PBKDF2 parameters for password-encrypted private-key export in jose

• Hard-coded credentials

potatosalad · jose1 day ago

Insecure TLS Fingerprint Validation in ForeScout SecureConnector Configuration Enables Remote Code Execution

• pre-auth RCE
• Weak crypto

forescout technologies · secureconnectorToday

An authentication issue was addressed with improved state management.

• pre-auth RCE
• Auth bypass

apple · macosToday

A logic issue was addressed with improved state management.

• RCE

apple · macosToday

A double free issue was addressed with improved memory management.

• Pre-auth
• Memory safety

apple · macosToday

This issue was addressed with improved file handling.

• RCE
• Local privilege escalation

apple · macosToday

A use-after-free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · safariToday

A use-after-free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · safariToday

A use-after-free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · safariToday

A use-after-free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · safariToday

A use-after-free issue was addressed with improved memory management.

• pre-auth RCE
• Memory safety

apple · safariToday

A type confusion issue was addressed with improved memory handling.

• pre-auth RCE

apple · safariToday

A memory corruption issue was addressed with improved memory handling.

• pre-auth RCE
• Memory safety

apple · ios and ipadosToday

This issue was addressed with improved access restrictions.

• pre-auth RCE

apple · macosToday

TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection

• RCE
• Command injection

totolink · a950rgToday

TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection

• RCE
• Command injection

totolink · a950rgToday

TOTOLINK A950RG firewall.so apmib_set command injection

• RCE
• Command injection

totolink · a950rgToday

systeminformation: Windows command injection in services() through Unicode quotation marks

• RCE
• Command injection

sebhildebrandt · systeminformationToday

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

• Pre-auth
• Deserialization

lxsmnsyc · serovalToday

Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

• Pre-auth
• Deserialization
• Denial of service

lxsmnsyc · serovalToday

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

• Pre-auth
• Denial of service

lxsmnsyc · serovalToday

An integer overflow was addressed with improved input validation.

• pre-auth RCE
• Memory safety

apple · ios and ipadosToday

A logic issue was addressed with improved checks.

• Local privilege escalation

apple · macosToday

A use after free issue was addressed with improved memory management.

• RCE
• Local privilege escalation
• Memory safety

apple · ios and ipadosToday

An out-of-bounds write issue was addressed with improved bounds checking.

• pre-auth RCE
• Memory safety

apple · macosToday

TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

• Pre-auth
• Memory safety

totolink · a950rgToday

Go JOSE: DoS when parsing JWKs that contain RSA keys

• Pre-auth
• Denial of service

go-jose · go-joseToday

Datadog dd-trace-py: ReDOS in URL query string obfuscation

• Pre-auth
• Denial of service

datadog · dd-trace-pyToday

Datadog dd-trace-py: IAST instrumentation can lead to application DOS

• Pre-auth

datadog · dd-trace-pyToday