CVEs published October 17, 2026
100 CVEs were published on October 17, 2026: 3 critical, 42 high.
- Published
- 100
- Critical
- 3
- High
- 42
- Medium
- 52
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 62
Most affected products
- thorsten phpMyFAQ
- 28
- coder
- 7
- go-vikunja vikunja · code.vikunja.io/api
- 6
- admidio
- 4
- coder · github.com/coder/coder/v2 +1
- 4
- murgroland WP Booking System – Booking Calendar
- 3
- Patreon WordPress
- 3
- Tektronix 3 Series MDO
- 3
- thimpress LearnPress – WordPress LMS Plugin for Create and…
- 3
- wpeverest User Registration & Membership – Free & Paid Memb…
- 3
Critical 3
- CVE-2026-111911phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injectionthorsten phpMyFAQ
- CVE-2026-104736LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-110653Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterAppointment Booking Plugin – LatePoint | Calendar & Schedul…
High 42
- CVE-2026-111927Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Matchcoder
- CVE-2026-111924Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompressionfleetdm fleet
- CVE-2026-111923Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsingfleetdm fleet
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Originsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooksgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111914Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.phpadmidio
- CVE-2026-111912Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Updateadmidio
- CVE-2026-111910phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloadsthorsten phpMyFAQ
- CVE-2026-111909phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser APIthorsten phpMyFAQ
- CVE-2026-111908phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST APIthorsten phpMyFAQ
- CVE-2026-111907phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-databasethorsten phpMyFAQ
- CVE-2026-111906phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operationsthorsten phpMyFAQ
- CVE-2026-111905phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/datathorsten phpMyFAQ
- CVE-2026-111901phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Paginationthorsten phpMyFAQ
- CVE-2026-111898phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linkingthorsten phpMyFAQ
- CVE-2026-111897phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpointsthorsten phpMyFAQ
- CVE-2026-111895phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_usernamethorsten phpMyFAQ
- CVE-2026-111893phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions APIthorsten phpMyFAQ
- CVE-2026-111891phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions APIthorsten phpMyFAQ
- CVE-2026-111890phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRightsthorsten phpMyFAQ
- CVE-2026-111886phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpointthorsten phpMyFAQ
- CVE-2026-111885phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup APIthorsten phpMyFAQ
- CVE-2026-111884phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeoverthorsten phpMyFAQ
- CVE-2026-111882phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacksthorsten phpMyFAQ
- CVE-2026-111881FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via ClipboardFreeRDP
- CVE-2026-111880FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC OffsetFreeRDP
- CVE-2026-109701WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerabilityPAYCOMET for WooCommerce
- CVE-2026-110889WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerabilityGantry 5 Framework
- CVE-2026-100316European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Headerdavidanderson European VAT Compliance Assistant for WooComm…
- CVE-2026-111110Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameterstiofansisland Payment forms, Buy now buttons, and Invoicin…
- CVE-2026-110384WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerabilityHeateor Support Fancy Comments WordPress
- CVE-2026-92798User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tagwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-103899EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameterdaigo75 EU VAT Assistant for WooCommerce
- CVE-2026-108123WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Actionmurgroland WP Booking System – Booking Calendar
- CVE-2026-96660User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Valuewpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-109208LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parametersthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-104734Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Importthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-107762Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameterthemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-111855An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.Tektronix 3 Series MDO
- CVE-2026-111854An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.Tektronix 3 Series MDO
- CVE-2026-111853An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.Tektronix 3 Series MDO
Medium, low and unrated 55
- CVE-2026-111866nemoTyrant manong func.php arr2sql sql injectionnemoTyrant manong
- CVE-2026-111865THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injectionTHU-MIG yoloe
- CVE-2026-110882WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerabilityCozy Vision Technologies Pvt. SMS Alert Order Notifications
- CVE-2026-111934Coder before 2.34.7 IP Spoofing via X-Forwarded-For Headercoder
- CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder Hashcoder · github.com/coder/coder/v2 +1
- CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance Settingscoder · github.com/coder/coder/v2 +1
- CVE-2026-111931Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxycoder
- CVE-2026-111930Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpointcoder
- CVE-2026-111929Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPCcoder
- CVE-2026-111928Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policycoder
- CVE-2026-111926Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifestcoder
- CVE-2026-111921Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletiongo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project Permissionsgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111918Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creationgo-vikunja vikunja · code.vikunja.io/api
- CVE-2026-111916Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feedadmidio
- CVE-2026-111913Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.phpadmidio
- CVE-2026-111904phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions APIthorsten phpMyFAQ
- CVE-2026-111903phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypassthorsten phpMyFAQ
- CVE-2026-111902phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments APIthorsten phpMyFAQ
- CVE-2026-111900phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.phpthorsten phpMyFAQ
- CVE-2026-111896phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypassthorsten phpMyFAQ
- CVE-2026-111894phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URIthorsten phpMyFAQ
- CVE-2026-111892phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpointsthorsten phpMyFAQ
- CVE-2026-111889phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboardthorsten phpMyFAQ
- CVE-2026-111888phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update APIthorsten phpMyFAQ
- CVE-2026-111887phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpointthorsten phpMyFAQ
- CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Tokencoder · github.com/coder/coder/v2 +1
- CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parametercoder · github.com/coder/coder/v2 +1
- CVE-2026-110253weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameterboldgrid weForms – Easy Drag & Drop Contact Form Builder Fo…
- CVE-2026-109983YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameterwssoffice21 YMC Filter
- CVE-2026-97314ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic InjectionThirstyAffiliates
- CVE-2026-81344Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object InjectionACF Frontend Admin by DynamiApps
- CVE-2026-81343Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form SubmissionACF Frontend Admin by DynamiApps
- CVE-2026-110527WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment BypassWP User Manager
- CVE-2026-106470WP Data Access < 5.5.88 - Subscriber+ SSRFWP Data Access
- CVE-2026-103376PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status CheckPeachPay — Payments & Express Checkout for WooCommerce
- CVE-2026-104122Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term NameUkr-To-Lat
- CVE-2026-92432Patreon WordPress < 1.10.0 - Open Redirect via 'state' ParameterPatreon WordPress
- CVE-2026-92431Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term EnumerationPatreon WordPress
- CVE-2026-92433Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRFPatreon WordPress
- CVE-2026-104246Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email AttachmentsContact Form 7 Signature Addon
- CVE-2026-91074BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode AttributeBSK PDF Manager
- CVE-2026-109989Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameterthemifyme Themify Popup
- CVE-2026-107744LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Actionthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-111726Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attributethemifyme Themify Builder
- CVE-2026-92978User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()wpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-109369WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reusemurgroland WP Booking System – Booking Calendar
- CVE-2026-109368WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX actionmurgroland WP Booking System – Booking Calendar
- CVE-2026-92715Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameterthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-107752Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookieuscnanbu Welcart e-Commerce
- CVE-2026-109985xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameterwpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP…
- CVE-2026-110268Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameterwpazleen Post Export Import with Media
- CVE-2026-111602Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' ParameterAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-111601Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameterhippooo Hippoo Mobile App for WooCommerce
- CVE-2026-107763Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hookhostspa Fastcache by Host.it