Exploited and new serious CVEs: October 2026

Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation

• Pre-auth
• Info leak

ladybirdbrowser · ladybirdToday

HoneySQL unchecked entity names can lead to SQL injection results

• Pre-auth
• SQL injection

seancorfield · honeysqlToday

Ladybird: FinalizationRegistry::cleanup() heap use-after-free via reentrant unregister()

• Pre-auth
• Memory safety

ladybirdbrowser · ladybirdToday

draw.io Desktop allows Windows executable search-path hijacking

jgraph · drawio-desktopToday

Pi-hole: Local privilege escalation from `pihole` user to root via CVE-2026-41489 fix bypass

• RCE
• Local privilege escalation
• Command injection

pi-hole · pi-holeToday

Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

pi-hole · pi-holeToday

OpenVM's OpenVmHalo2Verifier self-call can bypass proof verification

• Pre-auth

openvm-org · openvmToday

OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots

• Pre-auth

openvm-org · openvmToday

RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization

• Broken access control (IDOR)

infiniflow · ragflowToday

Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow

• Pre-auth
• Broken access control (IDOR)

filecoin-project · filecoin-pinToday

Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution

• Deserialization

metalama · metalamaToday

ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

• Pre-auth
• Weak crypto

deadtrickster · ssl_verify_funToday

Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

• Local privilege escalation

metalama · metalamaToday

ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

• RCE
• Command injection

mqttsnet · thinglinksToday

ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

• Pre-auth
• SQL injection

mqttsnet · thinglinksToday

NovumOS: Nova Interpreter Privilege Escalation

• Local privilege escalation

minecanton209 · novumosToday

MoLing: unauthenticated SSE and wildcard CORS expose tool sessions

• Pre-auth

gojue · molingToday

Ring's nested-params middleware has inefficient regular expression complexity

• Pre-auth
• Denial of service

ring-clojure · ringToday

Dream Displays has command-line argument injection in yt-dlp invocation

• Pre-auth

arsmotorin · dreamdisplaysToday

libriscv: Out of bounds read vuln in the ELF parser (Denial of service)

libriscv · libriscvToday

SABnzbd: Orphan-job path traversal permits arbitrary file deletion

• Path traversal

sabnzbd · sabnzbdToday

ESPAsyncWebServer multipart parser has null-pointer write

• Pre-auth
• Memory safety
• Denial of service

esp32async · espasyncwebserverToday

ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser

• Broken access control (IDOR)

sinamics · ztnetToday

jack: upstream error responses expose backend and peer credentials

• Info leak

roziscoding · jackToday

ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)

• Pre-auth
• Denial of service

agamnentzar · ag-psdToday

Shopper: missing variant-delete authorization permits destructive single and bulk actions

• Broken access control (IDOR)

shopperlabs · shopperToday

Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

• XSS

shopperlabs · shopperToday

Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

• Pre-auth

trailofbits · ficklingToday

PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields

• Pre-auth
• XSS

unknown · pdf invoices & packing slips for woocommerceToday

Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

• Pre-auth

trailofbits · ficklingToday

LightSAML: Signature reference wrapping permits unsigned assertion claims

• Deserialization
• Weak crypto

litesaml · lightsamlToday

Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion

• Pre-auth
• SSRF

christianhelle · refitterToday

netopeer2-server logging has format string vulnerability via subtree filter

cesnet · netopeer2Today

OpenRemote has authenticated SQL injection in crosstab datapoint exports

• SQL injection

openremote · openremoteToday

Aedes has Uncaught Exception and Uncontrolled Resource Consumption

• Pre-auth
• Denial of service

moscajs · aedesToday

Refitter: C# source injection through OpenAPI path keys

• pre-auth RCE

christianhelle · refitterToday

Refitter: C# source injection through OpenAPI content-type map keys

• pre-auth RCE

christianhelle · refitterToday

Refitter: C# source injection through OpenAPI header parameter names

• pre-auth RCE

christianhelle · refitterToday

TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover

• Pre-auth
• Auth bypass

fctr-id · okta-ai-agentToday

TAKO AI Agent for Okta: Authenticated Python execution through validator bypass

• RCE

fctr-id · okta-ai-agentToday

OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

• RCE
• Deserialization

opensearch-project · sqlToday

IXP Manager has Broken Object-Level Authorization

• Broken access control (IDOR)

inex · ixp-managerToday

IXP Manager has authenticated non-administrator privilege escalation

inex · ixp-managerToday

Coop has a data leak via unauthenticated GraphQL Query.allOrgs

• Pre-auth
• Auth bypass

roostorg · coopToday

Coop has SAML cross-tenant authentication bypass

• Auth bypass

roostorg · coopToday

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

• Broken access control (IDOR)

shopify · shopify_appToday

AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

• RCE

Today

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

• Pre-auth

Today

AdminNeo SQLite Database-List Drop Arbitrary File Deletion

• Path traversal
• CSRF

Today

imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field

• Pre-auth
• Denial of service

Today

imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash

• Pre-auth
• Memory safety
• Denial of service

Today

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution

• pre-auth RCE
• Memory safety

Today

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

• pre-auth RCE
• Path traversal

Today

File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

• Pre-auth
• Broken access control (IDOR)

drupal · file force downloadToday

SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields

• RCE
• Command injection

softiron · hypercloudToday

Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

• pre-auth RCE
• XSS

tigroumeow · meow lightboxToday

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

• pre-auth RCE
• Race condition

wordpress foundation · wordpressToday

Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization

• Pre-auth
• XSS

kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builderToday

PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision

• Pre-auth
• XSS

buildwps · ppwp – password protect pagesToday