CVEs published October 25, 2026
133 CVEs were published on October 25, 2026: 4 critical, 35 high. Browse them by severity, product and exploitation status.
- Published
- 133
- Critical
- 4
- High
- 35
- Medium
- 79
- Low
- 15
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 107
Most affected products
- ImageMagick
- 21
- rclone
- 10
- yeswiki
- 8
- siyuan-note siyuan
- 6
- vllm-project vllm
- 6
- GiveWP
- 5
- grokability snipe-it
- 4
- parse-community parse-server
- 4
- SourceCodester Performance Indicator System
- 4
- Starman
- 4
Critical 4
- CVE-2026-115823Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connectionsStarman
- CVE-2026-116199Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callbackgrokability snipe-it
- CVE-2026-116163Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclassesparse-community parse-server
- CVE-2026-115214Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role HeadersDatawiza Proxy Auth Plugin
High 35
- CVE-2026-115825HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-LengthPlack
- CVE-2026-115824Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodiesStarman
- CVE-2026-115822Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodiesStarman
- CVE-2026-115817Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headersStarman
- CVE-2026-116211YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry createyeswiki
- CVE-2026-116208YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPostsyeswiki
- CVE-2026-116207YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search APIyeswiki
- CVE-2026-116204YesWiki before 4.7.0 CSRF via despam Admin Actionyeswiki
- CVE-2026-116201Snipe-IT before 8.5.0 SAML Assertion Replay via Race Conditiongrokability snipe-it
- CVE-2026-116200Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()grokability snipe-it
- CVE-2026-116195Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trimrclone
- CVE-2026-116194Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callbackrclone
- CVE-2026-116192rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote rootsrclone
- CVE-2026-116191Rclone before 1.75.2 Path Traversal via serve webdav MKCOLrclone
- CVE-2026-116189rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMSrclone
- CVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionIDthorsten phpMyFAQ
- CVE-2026-116181vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop_token_idsvllm-project vllm
- CVE-2026-116180vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensorsvllm-project vllm
- CVE-2026-116179vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Overridevllm-project vllm
- CVE-2026-116178vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm_placeholdersvllm-project vllm · vllm
- CVE-2026-116177vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypassvllm-project vllm · vllm
- CVE-2026-116176vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnectorvllm-project vllm · vllm
- CVE-2026-116175vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completionsvllm-project vllm
- CVE-2026-116174vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generatevllm-project vllm
- CVE-2026-116173vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output_candidates.token_idsvllm-project vllm · vllm
Show all 35 entriesShow fewer entries
- CVE-2026-116172vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_nvllm-project vllm
- CVE-2026-116167SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parametersiyuan-note siyuan
- CVE-2026-116166SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Settingsiyuan-note siyuan
- CVE-2026-116165Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDBparse-community parse-server
- CVE-2026-116149ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed ImagesImageMagick
- CVE-2026-116071rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryptionrotki
- CVE-2026-116068Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Routerdokploy
- CVE-2026-116067Paisa before 0.7.8 Path Traversal via Editor and Sheet APIananthakumaran paisa
- CVE-2026-116066Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright ServiceFirecrawl
- CVE-2026-115251Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click UpgradeDuplicator
Medium, low and unrated 94
- CVE-2026-116099Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds writeFusion Creators Studio SCP Containment Breach Multiplayer
- CVE-2026-116098SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserializationSteelRaven7 Ravenfield
- CVE-2026-116097CloudClassroom-PHP-Project addnewstudent.php cross site scriptingCloudClassroom-PHP-Project
- CVE-2026-116096ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds writeggml-org llama.cpp
- CVE-2026-116095smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocationsmg-project smg
- CVE-2026-116094EyouCMS function.php remote_file_to_local server-side request forgeryEyouCMS
- CVE-2026-115627AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rowsash-project ash_postgres · ash_postgres
- CVE-2026-115635AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setash-project ash_postgres · ash_postgres
- CVE-2026-114214Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination recordsash-project ash · ash
- CVE-2026-116063DedeCMS update_guide.php require_once code injectionDedeCMS
- CVE-2026-116062SourceCodester Performance Indicator System save_profile.php sql injectionSourceCodester Performance Indicator System
- CVE-2026-116061SourceCodester Performance Indicator System edit_dealer.php sql injectionSourceCodester Performance Indicator System
- CVE-2026-116060SourceCodester Performance Indicator System adddealer.php sql injectionSourceCodester Performance Indicator System
- CVE-2026-116058Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injectionAlfresco Activiti
- CVE-2026-116057KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted uploadKodCloud KodExplorer
- CVE-2026-116056KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgeryKodCloud KodExplorer
- CVE-2026-116055SourceCodester Performance Indicator System deleteproduct.php sql injectionSourceCodester Performance Indicator System
- CVE-2026-116054SH3 Módulo de Gestão/Módulo de Arrecadação weak password hashSH3
- CVE-2026-116053dbcli mycli Whitelist source.py source_special_command_is_safe os command injectiondbcli mycli
- CVE-2026-116186OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdopenremote core
- CVE-2026-116185OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosopenremote core
- CVE-2026-116184OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocketopenremote core
- CVE-2026-116206YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntaxyeswiki
- CVE-2026-116205YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntaxyeswiki
- CVE-2026-116203YesWiki before 4.7.0 Stored XSS via filtertags Action Parametersyeswiki
Show all 94 entriesShow fewer entries
- CVE-2026-116202YesWiki before 4.7.0 Stored XSS via ImageField SVG Uploadyeswiki
- CVE-2026-116198Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController storegrokability snipe-it
- CVE-2026-116197Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selectionedgelesssys contrast
- CVE-2026-116196Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-urlrclone
- CVE-2026-116193Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requestsrclone
- CVE-2026-116190rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirectrclone
- CVE-2026-116188rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflowrclone
- CVE-2026-116187Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploadsrclone
- CVE-2026-116182phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetchingthorsten phpMyFAQ
- CVE-2026-116171SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefixsiyuan-note siyuan
- CVE-2026-116170SiYuan before v3.8.7 SQL Injection via History Search op and querysiyuan-note siyuan
- CVE-2026-116169SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blockssiyuan-note siyuan
- CVE-2026-116168SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Toolsiyuan-note siyuan
- CVE-2026-116164Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writesparse-community parse-server · parse
- CVE-2026-116162Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Loginparse-community parse-server
- CVE-2026-116161Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptionsparse-community parse-server
- CVE-2026-116160ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 AnimateImageMagick
- CVE-2026-116159ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl OptionImageMagick
- CVE-2026-116158ImageMagick before 7.1.2-33 Memory Leak in magick compareImageMagick
- CVE-2026-116157ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property ReadingImageMagick
- CVE-2026-116156ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile OptionImageMagick
- CVE-2026-116155ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP ProfileImageMagick
- CVE-2026-116154ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth LimitImageMagick
- CVE-2026-116153ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bitImageMagick
- CVE-2026-116152ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error PathImageMagick
- CVE-2026-116151ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG EncoderImageMagick
- CVE-2026-116150ImageMagick before 7.1.2-33 Memory Leak in FPX EncoderImageMagick
- CVE-2026-116148ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing OptionsImageMagick
- CVE-2026-116147ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU DecoderImageMagick
- CVE-2026-116146ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL DecoderImageMagick
- CVE-2026-116145ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete FixImageMagick
- CVE-2026-116144ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG DecoderImageMagick
- CVE-2026-116143ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS DecodersImageMagick
- CVE-2026-116142ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-BoxImageMagick
- CVE-2026-116141ImageMagick before 7.1.2-33 Policy Bypass in UHDR DecoderImageMagick
- CVE-2026-116140ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation ParsingImageMagick
- CVE-2026-116139WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown RenderingWWBN AVideo
- CVE-2026-116052LinkStackOrg LinkStack cross-site request forgeryLinkStackOrg LinkStack
- CVE-2026-116137adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Namescthackers adm-zip
- CVE-2026-116136ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version LinkingProjectSend
- CVE-2026-116073Leon before commit 50df142 Path Traversal via /download model Commandleon-ai leon
- CVE-2026-116072Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivityDocile-Alligator Infinity for Reddit
- CVE-2026-116070Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/configdqzboy Docker-Proxy
- CVE-2026-116069NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain FieldAlbert-Weasker niubigeo
- CVE-2026-116050krupalshah Employee Recruitment System Registration registerform3.php sql injectionkrupalshah Employee Recruitment System
- CVE-2026-116049krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injectionkrupalshah EmployeeRecruitmentSystem
- CVE-2026-116048krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injectionkrupalshah EmployeeRecruitmentSystem
- CVE-2026-116047Privoce Vocechat Query Parameter widget.html cross site scriptingPrivoce Vocechat
- CVE-2026-116046eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversaleventcatalog sdk
- CVE-2026-1160451999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal1999AZZAR designer-mcp
- CVE-2026-115183Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text WidgetQi Addons For Elementor
- CVE-2026-114743InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settingsInstaWP Connect
- CVE-2026-114742WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDORWPVR
- CVE-2026-114741WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDORWPVR
- CVE-2026-114740WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup WizardWPVR
- CVE-2026-111981GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addressesGiveWP
- CVE-2026-111980GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability GrantGiveWP
- CVE-2026-111979GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary ColorGiveWP
- CVE-2026-111978GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings ImportGiveWP
- CVE-2026-111976GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View RouteGiveWP
- CVE-2026-110285WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing SecretWP Stripe Checkout
- CVE-2025-15705Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSSContact Form by Supsystic
- CVE-2026-94295Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified SignatureChikkili- Google Pay India for Woocommerce
- CVE-2026-116044prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted uploadprasathmani TinyFileManager
- CVE-2026-116007YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authenticationYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-116006YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authenticationYunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro
- CVE-2026-116004onyx-dot-app Onyx PreviewTab.tsx cross site scriptingonyx-dot-app Onyx
- CVE-2026-116000Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgeryZylon PrivateGPT
- CVE-2026-115999mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injectionmansi-k Restaurant_IMS