# CVEs published 2026-10-17

100 CVEs were published on October 17, 2026: 3 critical, 42 high. Days are UTC.

- [CVE-2026-111866](https://cve.now/CVE-2026-111866.md): nemoTyrant manong func.php arr2sql sql injection (CVSS 6.9, nemoTyrant manong)
- [CVE-2026-111865](https://cve.now/CVE-2026-111865.md): THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection (CVSS 4.8, THU-MIG yoloe)
- [CVE-2026-110882](https://cve.now/CVE-2026-110882.md): WordPress SMS Alert Order Notifications plugin \<= 4.0.1 - Broken Access Control vulnerability (CVSS 4.3, Cozy Vision Technologies Pvt. SMS Alert Order Notifications)
- [CVE-2026-111934](https://cve.now/CVE-2026-111934.md): Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header (CVSS 6.3, coder)
- [CVE-2026-111933](https://cve.now/CVE-2026-111933.md): Coder before 2.34.2 User Enumeration via Login Placeholder Hash (CVSS 6.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-111932](https://cve.now/CVE-2026-111932.md): Coder before 2.34.2 Stored HTML Injection via Appearance Settings (CVSS 4.8, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-111931](https://cve.now/CVE-2026-111931.md): Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy (CVSS 5.3, coder)
- [CVE-2026-111930](https://cve.now/CVE-2026-111930.md): Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint (CVSS 5.3, coder)
- [CVE-2026-111929](https://cve.now/CVE-2026-111929.md): Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC (CVSS 6.0, coder)
- [CVE-2026-111928](https://cve.now/CVE-2026-111928.md): Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy (CVSS 5.3, coder)
- [CVE-2026-111927](https://cve.now/CVE-2026-111927.md): Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match (CVSS 8.7, coder)
- [CVE-2026-111926](https://cve.now/CVE-2026-111926.md): Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest (CVSS 4.8, coder)
- [CVE-2026-111924](https://cve.now/CVE-2026-111924.md): Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression (CVSS 8.7, fleetdm fleet)
- [CVE-2026-111923](https://cve.now/CVE-2026-111923.md): Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing (CVSS 8.7, fleetdm fleet)
- [CVE-2026-111922](https://cve.now/CVE-2026-111922.md): Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins (CVSS 7.2, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111921](https://cve.now/CVE-2026-111921.md): Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111920](https://cve.now/CVE-2026-111920.md): Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111919](https://cve.now/CVE-2026-111919.md): Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111918](https://cve.now/CVE-2026-111918.md): Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111917](https://cve.now/CVE-2026-111917.md): Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-111916](https://cve.now/CVE-2026-111916.md): Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed (CVSS 6.9, admidio)
- [CVE-2026-111914](https://cve.now/CVE-2026-111914.md): Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory\_data.php (CVSS 7.1, admidio)
- [CVE-2026-111913](https://cve.now/CVE-2026-111913.md): Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists\_show.php (CVSS 5.3, admidio)
- [CVE-2026-111912](https://cve.now/CVE-2026-111912.md): Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update (CVSS 7.1, admidio)
- [CVE-2026-111911](https://cve.now/CVE-2026-111911.md): phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection (CVSS 9.3, thorsten phpMyFAQ)
- [CVE-2026-111910](https://cve.now/CVE-2026-111910.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads (CVSS 7.1, thorsten phpMyFAQ)
- [CVE-2026-111909](https://cve.now/CVE-2026-111909.md): phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API (CVSS 7.2, thorsten phpMyFAQ)
- [CVE-2026-111908](https://cve.now/CVE-2026-111908.md): phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API (CVSS 8.7, thorsten phpMyFAQ)
- [CVE-2026-111907](https://cve.now/CVE-2026-111907.md): phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database (CVSS 7.1, thorsten phpMyFAQ)
- [CVE-2026-111906](https://cve.now/CVE-2026-111906.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations (CVSS 7.1, thorsten phpMyFAQ)
- [CVE-2026-111905](https://cve.now/CVE-2026-111905.md): phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data (CVSS 7.0, thorsten phpMyFAQ)
- [CVE-2026-111904](https://cve.now/CVE-2026-111904.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API (CVSS 6.9, thorsten phpMyFAQ)
- [CVE-2026-111903](https://cve.now/CVE-2026-111903.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass (CVSS 5.1, thorsten phpMyFAQ)
- [CVE-2026-111902](https://cve.now/CVE-2026-111902.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API (CVSS 6.9, thorsten phpMyFAQ)
- [CVE-2026-111901](https://cve.now/CVE-2026-111901.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Pagination (CVSS 8.7, thorsten phpMyFAQ)
- [CVE-2026-111900](https://cve.now/CVE-2026-111900.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php (CVSS 5.3, thorsten phpMyFAQ)
- [CVE-2026-111898](https://cve.now/CVE-2026-111898.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking (CVSS 7.7, thorsten phpMyFAQ)
- [CVE-2026-111897](https://cve.now/CVE-2026-111897.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints (CVSS 7.1, thorsten phpMyFAQ)
- [CVE-2026-111896](https://cve.now/CVE-2026-111896.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypass (CVSS 5.1, thorsten phpMyFAQ)
- [CVE-2026-111895](https://cve.now/CVE-2026-111895.md): phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred\_username (CVSS 7.6, thorsten phpMyFAQ)
- [CVE-2026-111894](https://cve.now/CVE-2026-111894.md): phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI (CVSS 5.1, thorsten phpMyFAQ)
- [CVE-2026-111893](https://cve.now/CVE-2026-111893.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions API (CVSS 8.5, thorsten phpMyFAQ)
- [CVE-2026-111892](https://cve.now/CVE-2026-111892.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpoints (CVSS 6.9, thorsten phpMyFAQ)
- [CVE-2026-111891](https://cve.now/CVE-2026-111891.md): phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions API (CVSS 7.0, thorsten phpMyFAQ)
- [CVE-2026-111890](https://cve.now/CVE-2026-111890.md): phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRights (CVSS 7.0, thorsten phpMyFAQ)
- [CVE-2026-111889](https://cve.now/CVE-2026-111889.md): phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard (CVSS 5.3, thorsten phpMyFAQ)
- [CVE-2026-111888](https://cve.now/CVE-2026-111888.md): phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API (CVSS 5.1, thorsten phpMyFAQ)
- [CVE-2026-111887](https://cve.now/CVE-2026-111887.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpoint (CVSS 6.9, thorsten phpMyFAQ)
- [CVE-2026-111886](https://cve.now/CVE-2026-111886.md): phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint (CVSS 7.1, thorsten phpMyFAQ)
- [CVE-2026-111885](https://cve.now/CVE-2026-111885.md): phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API (CVSS 7.0, thorsten phpMyFAQ)
- [CVE-2026-111884](https://cve.now/CVE-2026-111884.md): phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover (CVSS 8.7, thorsten phpMyFAQ)
- [CVE-2026-111882](https://cve.now/CVE-2026-111882.md): phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks (CVSS 8.6, thorsten phpMyFAQ)
- [CVE-2026-111881](https://cve.now/CVE-2026-111881.md): FreeRDP 3.14.1 before 3.32.0 Integer Underflow in BMP Writer via Clipboard (CVSS 7.2, FreeRDP)
- [CVE-2026-111880](https://cve.now/CVE-2026-111880.md): FreeRDP 2.0.0 before 3.32.0 Heap Out-of-Bounds Write via NTLM MIC Offset (CVSS 8.3, FreeRDP)
- [CVE-2025-71435](https://cve.now/CVE-2025-71435.md): Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token (CVSS 2.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2024-58398](https://cve.now/CVE-2024-58398.md): Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter (CVSS 5.3, coder · github.com/coder/coder/v2 +1)
- [CVE-2026-109701](https://cve.now/CVE-2026-109701.md): WordPress PAYCOMET for WooCommerce plugin \<= 5.45 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PAYCOMET for WooCommerce)
- [CVE-2026-110889](https://cve.now/CVE-2026-110889.md): WordPress Gantry 5 Framework plugin \<= 5.6.4 - Sensitive Data Exposure vulnerability (CVSS 7.5, Gantry 5 Framework)
- [CVE-2026-110253](https://cve.now/CVE-2026-110253.md): weForms \<= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf\_files' Parameter (CVSS 5.4, boldgrid weForms – Easy Drag & Drop Contact Form Builder Fo…)
- [CVE-2026-100316](https://cve.now/CVE-2026-100316.md): European VAT Compliance Assistant for WooCommerce \<= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header (CVSS 7.2, davidanderson European VAT Compliance Assistant for WooComm…)
- [CVE-2026-109983](https://cve.now/CVE-2026-109983.md): YMC Filter \<= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post\_title' Parameter (CVSS 6.4, wssoffice21 YMC Filter)
- [CVE-2026-111110](https://cve.now/CVE-2026-111110.md): Payment forms, Buy now buttons, and Invoicing System | GetPaid \<= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter (CVSS 7.2, stiofansisland Payment forms, Buy now buttons, and Invoicin…)
- [CVE-2026-110384](https://cve.now/CVE-2026-110384.md): WordPress Fancy Comments WordPress plugin \<= 1.2.21 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Heateor Support Fancy Comments WordPress)
- [CVE-2026-97314](https://cve.now/CVE-2026-97314.md): ThirstyAffiliates \< 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection (CVSS 6.5, ThirstyAffiliates)
- [CVE-2026-81344](https://cve.now/CVE-2026-81344.md): Frontend Admin by DynamiApps \<= 3.29.13 - Admin+ PHP Object Injection (CVSS 6.6, ACF Frontend Admin by DynamiApps)
- [CVE-2026-81343](https://cve.now/CVE-2026-81343.md): Frontend Admin by DynamiApps \<= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission (CVSS 5.3, ACF Frontend Admin by DynamiApps)
- [CVE-2026-110527](https://cve.now/CVE-2026-110527.md): WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass (CVSS 5.3, WP User Manager)
- [CVE-2026-106470](https://cve.now/CVE-2026-106470.md): WP Data Access \< 5.5.88 - Subscriber+ SSRF (CVSS 5.0, WP Data Access)
- [CVE-2026-103376](https://cve.now/CVE-2026-103376.md): PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check (CVSS 5.3, PeachPay — Payments & Express Checkout for WooCommerce)
- [CVE-2026-104122](https://cve.now/CVE-2026-104122.md): Ukr-To-Lat \<= 1.3.5 - Contributor+ SQLi via Term Name (CVSS 6.8, Ukr-To-Lat)
- [CVE-2026-92432](https://cve.now/CVE-2026-92432.md): Patreon WordPress \< 1.10.0 - Open Redirect via 'state' Parameter (CVSS 4.3, Patreon WordPress)
- [CVE-2026-92431](https://cve.now/CVE-2026-92431.md): Patreon WordPress \< 1.10.0 - Unauthenticated Taxonomy and Term Enumeration (CVSS 3.7, Patreon WordPress)
- [CVE-2026-92433](https://cve.now/CVE-2026-92433.md): Patreon WordPress \< 1.10.0 - Patreon Integration Takeover via CSRF (CVSS 6.5, Patreon WordPress)
- [CVE-2026-104246](https://cve.now/CVE-2026-104246.md): Contact Form 7 Signature Addon \<= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments (CVSS 5.9, Contact Form 7 Signature Addon)
- [CVE-2026-91074](https://cve.now/CVE-2026-91074.md): BSK PDF Manager \<= 3.8.1 - Contributor+ SQLi via tags\_specific Shortcode Attribute (CVSS 6.8, BSK PDF Manager)
- [CVE-2026-92798](https://cve.now/CVE-2026-92798.md): User Registration & Membership \<= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer\_url' Smart Tag (CVSS 8.1, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-103899](https://cve.now/CVE-2026-103899.md): EU VAT Assistant for WooCommerce \<= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat\_number' Parameter (CVSS 7.2, daigo75 EU VAT Assistant for WooCommerce)
- [CVE-2026-109989](https://cve.now/CVE-2026-109989.md): Themify Popup \<= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup\_width\_unit' Parameter (CVSS 6.4, themifyme Themify Popup)
- [CVE-2026-107744](https://cve.now/CVE-2026-107744.md): LearnPress \<= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action (CVSS 6.5, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-111726](https://cve.now/CVE-2026-111726.md): Themify Builder \<= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute (CVSS 6.4, themifyme Themify Builder)
- [CVE-2026-108123](https://cve.now/CVE-2026-108123.md): WP Booking System \<= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs\_action=email\_logs' Action (CVSS 7.5, murgroland WP Booking System – Booking Calendar)
- [CVE-2026-92978](https://cve.now/CVE-2026-92978.md): User Registration & Membership \<= 5.2.8 - Cross-Site Request Forgery to trigger\_bulk\_action() (CVSS 4.3, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-109369](https://cve.now/CVE-2026-109369.md): WP Booking System \<= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user\_permission' Parameter via Cross-Form Nonce Reuse (CVSS 6.8, murgroland WP Booking System – Booking Calendar)
- [CVE-2026-96660](https://cve.now/CVE-2026-96660.md): User Registration & Membership \<= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value (CVSS 7.2, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2026-104736](https://cve.now/CVE-2026-104736.md): LearnPress \<= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter (CVSS 9.8, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-109368](https://cve.now/CVE-2026-109368.md): WP Booking System \<= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs\_refresh\_calendar\_editor AJAX action (CVSS 6.5, murgroland WP Booking System – Booking Calendar)
- [CVE-2026-92715](https://cve.now/CVE-2026-92715.md): Tutor LMS \<= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-107752](https://cve.now/CVE-2026-107752.md): Welcart e-Commerce \<= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp\_usces\_order\_old' Cookie (CVSS 4.9, uscnanbu Welcart e-Commerce)
- [CVE-2026-109985](https://cve.now/CVE-2026-109985.md): xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN \<= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post\_content' Parameter (CVSS 6.4, wpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP…)
- [CVE-2026-110268](https://cve.now/CVE-2026-110268.md): Post Export Import with Media \<= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme\_slug' Parameter (CVSS 4.9, wpazleen Post Export Import with Media)
- [CVE-2026-111602](https://cve.now/CVE-2026-111602.md): Appointment Booking Plugin \<= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer\[uuid\]' Parameter (CVSS 3.7, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-110653](https://cve.now/CVE-2026-110653.md): Appointment Booking Plugin \<= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter (CVSS 9.1, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-109208](https://cve.now/CVE-2026-109208.md): LearnPress \<= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order\_comments' Parameters (CVSS 7.2, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2026-111601](https://cve.now/CVE-2026-111601.md): Hippoo Mobile App for WooCommerce \<= 1.12.0 - Reflected Cross-Site Scripting via 'token\_id' Parameter (CVSS 6.1, hippooo Hippoo Mobile App for WooCommerce)
- [CVE-2026-104734](https://cve.now/CVE-2026-104734.md): Kirki \<= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import (CVSS 7.2, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-107762](https://cve.now/CVE-2026-107762.md): Kirki \<= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter (CVSS 7.5, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-107763](https://cve.now/CVE-2026-107763.md): Fastcache by Host.it \<= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin\_action\_update Hook (CVSS 4.3, hostspa Fastcache by Host.it)
- [CVE-2026-111855](https://cve.now/CVE-2026-111855.md): An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. (CVSS 7.5, Tektronix 3 Series MDO)
- [CVE-2026-111854](https://cve.now/CVE-2026-111854.md): An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. (CVSS 8.1, Tektronix 3 Series MDO)
- [CVE-2026-111853](https://cve.now/CVE-2026-111853.md): An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. (CVSS 8.8, Tektronix 3 Series MDO)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.