# CVEs published 2026-10-24

76 CVEs were published on October 24, 2026: 12 critical, 19 high. Days are UTC.

- [CVE-2026-115997](https://cve.now/CVE-2026-115997.md): pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection (CVSS 5.3, pig-mesh pig)
- [CVE-2026-115996](https://cve.now/CVE-2026-115996.md): Unitree Robotics Unitree Go2 chat\_go websocket.py WebSocketClient.connect certificate validation (CVSS 6.3, Unitree Robotics Unitree Go2)
- [CVE-2026-115995](https://cve.now/CVE-2026-115995.md): Unitree Robotics Unitree Go2 chat\_go gpt\_thread.py set\_volume os command injection (CVSS 9.4, Unitree Robotics Unitree Go2)
- [CVE-2026-115982](https://cve.now/CVE-2026-115982.md): phpIPAM Rack Link Creation show-rack-popup.php create\_rack\_link cross site scripting (CVSS 5.3, phpIPAM)
- [CVE-2026-115981](https://cve.now/CVE-2026-115981.md): phpIPAM index.php cross site scripting (CVSS 4.8, phpIPAM)
- [CVE-2026-114820](https://cve.now/CVE-2026-114820.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (CVSS 9.1, Oracle Java SE · Oracle GraalVM for JDK +1)
- [CVE-2026-115973](https://cve.now/CVE-2026-115973.md): FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery (CVSS 6.9, FaveoSuite Faveo Helpdesk)
- [CVE-2026-115972](https://cve.now/CVE-2026-115972.md): FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization (CVSS 6.9, FaveoSuite Faveo Helpdesk)
- [CVE-2026-115971](https://cve.now/CVE-2026-115971.md): Travisun Opptrix preParsing handler webhook Buffer.concat denial of service (CVSS 6.9, Travisun Opptrix)
- [CVE-2026-115970](https://cve.now/CVE-2026-115970.md): Travisun Opptrix Import Endpoint import code injection (CVSS 6.9, Travisun Opptrix)
- [CVE-2026-115969](https://cve.now/CVE-2026-115969.md): Travisun Opptrix Schedule API setup command injection (CVSS 6.9, Travisun Opptrix)
- [CVE-2026-115933](https://cve.now/CVE-2026-115933.md): Forged signed tokens let any registered user take over other users and organizations (CVSS 9.9, GitroomHQ postiz-app)
- [CVE-2026-115557](https://cve.now/CVE-2026-115557.md): Distrust compromised intermediate certificates in ssl module (CVSS 9.4, Python Software Foundation CPython)
- [CVE-2026-114191](https://cve.now/CVE-2026-114191.md): WordPress UPI QR Code Payment Gateway for WooCommerce plugin \<= 1.6.3 - Broken Access Control vulnerability (CVSS 7.5, Knit Pay UPI QR Code Payment Gateway for WooCommerce)
- [CVE-2026-114704](https://cve.now/CVE-2026-114704.md): WordPress Relevanssi plugin \<= 4.28.4 - PHP Object Injection vulnerability (CVSS 7.2, Christoph Vielgrader Relevanssi)
- [CVE-2026-114192](https://cve.now/CVE-2026-114192.md): WordPress WpEvently plugin \<= 5.7.8 - Broken Access Control vulnerability (CVSS 6.5, Magepeople WpEvently)
- [CVE-2026-114629](https://cve.now/CVE-2026-114629.md): Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters (no CVSS, Web-Simple)
- [CVE-2026-115932](https://cve.now/CVE-2026-115932.md): Path traversal in post media lets any registered user read server files (CVSS 9.6, GitroomHQ postiz-app)
- [RUSTSEC-2026-0408](https://cve.now/RUSTSEC-2026-0408.md): Aliasing violations in splice, mutable iteration and cursors (no CVSS, skiplist)
- [RUSTSEC-2026-0409](https://cve.now/RUSTSEC-2026-0409.md): Use-after-free from a comparator that answers inconsistently (no CVSS, skiplist)
- [CVE-2026-116020](https://cve.now/CVE-2026-116020.md): BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages (CVSS 5.3, BookStackApp BookStack)
- [CVE-2026-116019](https://cve.now/CVE-2026-116019.md): Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives (CVSS 8.7, getgrav grav)
- [CVE-2026-116018](https://cve.now/CVE-2026-116018.md): ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint (CVSS 5.3, ONEARMY community-platform)
- [CVE-2026-116017](https://cve.now/CVE-2026-116017.md): Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint (CVSS 5.3, xinnan-tech xiaozhi-esp32-server)
- [CVE-2026-116016](https://cve.now/CVE-2026-116016.md): yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header (CVSS 7.1, YunaiV yudao-cloud)
- [CVE-2026-116015](https://cve.now/CVE-2026-116015.md): yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint (CVSS 5.3, YunaiV yudao-cloud)
- [CVE-2026-116014](https://cve.now/CVE-2026-116014.md): open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType (CVSS 9.2, open62541)
- [CVE-2026-116013](https://cve.now/CVE-2026-116013.md): OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing (CVSS 6.3, openresty lua-resty-dns)
- [CVE-2026-116012](https://cve.now/CVE-2026-116012.md): Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser (CVSS 2.0, NationalSecurityAgency ghidra)
- [CVE-2026-116011](https://cve.now/CVE-2026-116011.md): Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load() (CVSS 8.7, CrowCpp Crow)
- [CVE-2026-116010](https://cve.now/CVE-2026-116010.md): RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers (CVSS 5.3, francoisjacquet RosarioSIS)
- [CVE-2026-116009](https://cve.now/CVE-2026-116009.md): Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop\_url Action (CVSS 8.7, owen2345 camaleon-cms)
- [CVE-2026-116008](https://cve.now/CVE-2026-116008.md): DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign (CVSS 5.3, Bottelet DaybydayCRM)
- [CVE-2026-110018](https://cve.now/CVE-2026-110018.md): aBlocks \<= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute (CVSS 8.8, kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…)
- [CVE-2026-114705](https://cve.now/CVE-2026-114705.md): WordPress WP Social Feed Gallery plugin \<= 5.0.13 - Broken Access Control vulnerability (CVSS 6.5, quadlayers WP Social Feed Gallery)
- [CVE-2026-115998](https://cve.now/CVE-2026-115998.md): IDOR: User reads and modifies findings from other people's projects (CVSS 4.3, CervantesSec cervantes)
- [CVE-2026-114194](https://cve.now/CVE-2026-114194.md): WordPress Ad Inserter plugin \<= 2.8.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Igor Funa Ad Inserter)
- [CVE-2026-115994](https://cve.now/CVE-2026-115994.md): BOLA Allows Cross-Project Target Tampering (CVSS 5.4, CervantesSec cervantes)
- [CVE-2026-115993](https://cve.now/CVE-2026-115993.md): Stored XSS in the “Notes” field of project checklists (CVSS 6.8, CervantesSec cervantes)
- [CVE-2026-114196](https://cve.now/CVE-2026-114196.md): WordPress Paytium plugin \<= 5.0.5 - PHP Object Injection vulnerability (CVSS 9.8, paytiumsupport Paytium)
- [CVE-2026-114695](https://cve.now/CVE-2026-114695.md): WordPress VOD Infomaniak plugin \<= 1.5.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Infomaniak Network VOD Infomaniak)
- [CVE-2026-114694](https://cve.now/CVE-2026-114694.md): WordPress Events Manager plugin \<= 7.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pixelite Events Manager)
- [CVE-2026-114693](https://cve.now/CVE-2026-114693.md): WordPress All-in-One Video Gallery plugin \<= 4.9.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Plugins360 Labs All-in-One Video Gallery)
- [CVE-2026-110892](https://cve.now/CVE-2026-110892.md): WordPress SureDash plugin \<= 1.12.2 - Broken Access Control vulnerability (CVSS 6.5, Brainstorm Force SureDash)
- [CVE-2026-114697](https://cve.now/CVE-2026-114697.md): WordPress QA Analytics plugin \<= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, QuarkA QA Analytics)
- [CVE-2026-114178](https://cve.now/CVE-2026-114178.md): WordPress W3 Total Cache plugin \<= 2.10.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bold Grid W3 Total Cache)
- [CVE-2026-114190](https://cve.now/CVE-2026-114190.md): WordPress LiteSpeed Cache plugin \<= 7.9 - Sensitive Data Exposure vulnerability (CVSS 5.9, Hai Zheng / Lite Speed Cache LiteSpeed Cache)
- [CVE-2026-112866](https://cve.now/CVE-2026-112866.md): WordPress Product Filter by WBW plugin \<= 3.4.6 - SQL Injection vulnerability (CVSS 9.3, WPFactory Product Filter by WBW)
- [CVE-2026-94075](https://cve.now/CVE-2026-94075.md): WordPress Newsletters plugin \<= 4.18.1 - PHP Object Injection vulnerability (CVSS 9.8, Tribulant Software Newsletters)
- [CVE-2026-112869](https://cve.now/CVE-2026-112869.md): WordPress We’re Open! plugin \<= 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Noah Hearle We’re Open!)
- [CVE-2026-111402](https://cve.now/CVE-2026-111402.md): WordPress Newsletters plugin \<= 4.18.1 - SQL Injection vulnerability (CVSS 9.3, Tribulant Software Newsletters)
- [CVE-2026-112844](https://cve.now/CVE-2026-112844.md): WordPress WP Event Solution plugin \<= 4.1.26 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Arraytics WP Event Solution)
- [CVE-2026-114179](https://cve.now/CVE-2026-114179.md): WordPress BP Better Messages plugin \<= 3.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wordplus BP Better Messages)
- [CVE-2026-115975](https://cve.now/CVE-2026-115975.md): Broken access control in JiraController (CVSS 7.1, CervantesSec cervantes)
- [CVE-2026-115803](https://cve.now/CVE-2026-115803.md): Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization (CVSS 5.3, Scada-LTS)
- [CVE-2026-115802](https://cve.now/CVE-2026-115802.md): InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere (CVSS 5.3, InternScience InternAgent)
- [CVE-2026-108013](https://cve.now/CVE-2026-108013.md): HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID) (CVSS 6.8, HCL Software BigFix Platform)
- [CVE-2026-114429](https://cve.now/CVE-2026-114429.md): WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content (CVSS 6.8, WPVR)
- [CVE-2026-113674](https://cve.now/CVE-2026-113674.md): GeoDirectory \< 2.8.194 - Unauthenticated Guest-Submitted Listing Modification (CVSS 3.7, GeoDirectory)
- [CVE-2026-113673](https://cve.now/CVE-2026-113673.md): GeoDirectory \< 2.8.194 - Admin+ RCE via DB Text Export (CVSS 7.2, GeoDirectory)
- [CVE-2026-113493](https://cve.now/CVE-2026-113493.md): GeoDirectory \< 2.8.194 - Contributor+ Stored XSS via gd\_map Shortcode width Attribute (CVSS 6.8, GeoDirectory)
- [CVE-2026-113492](https://cve.now/CVE-2026-113492.md): GeoDirectory \< 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action (CVSS 5.3, GeoDirectory)
- [CVE-2026-113491](https://cve.now/CVE-2026-113491.md): GeoDirectory \< 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal (CVSS 6.4, GeoDirectory)
- [CVE-2026-113490](https://cve.now/CVE-2026-113490.md): GeoDirectory \< 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint (CVSS 5.3, GeoDirectory)
- [CVE-2026-113489](https://cve.now/CVE-2026-113489.md): GeoDirectory \< 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR (CVSS 4.3, GeoDirectory)
- [CVE-2026-112207](https://cve.now/CVE-2026-112207.md): Download Monitor \< 5.3.4 - Reflected XSS via Cross-Origin Download Link (CVSS 7.1, Download Monitor)
- [CVE-2026-110956](https://cve.now/CVE-2026-110956.md): asVereinbase \< 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation (CVSS 9.8, asVereinbase)
- [CVE-2026-105199](https://cve.now/CVE-2026-105199.md): Pixel Tag Manager for WooCommerce \< 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID (CVSS 6.8, Pixel Tag Manager for WooCommerce)
- [CVE-2026-97353](https://cve.now/CVE-2026-97353.md): News Kit Addons For Elementor \<= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit\_update\_mega\_menu\_form (CVSS 5.4, News Kit Addons For Elementor)
- [CVE-2026-97352](https://cve.now/CVE-2026-97352.md): News Kit Addons For Elementor \< 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit\_install\_importer (CVSS 4.3, News Kit Addons For Elementor)
- [CVE-2026-107907](https://cve.now/CVE-2026-107907.md): MAS Videos \<= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete\_video/delete\_playlist (CVSS 6.5, MAS Videos)
- [CVE-2026-87835](https://cve.now/CVE-2026-87835.md): Front End Users \<= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment (CVSS 6.5, Front End Users)
- [CVE-2026-107887](https://cve.now/CVE-2026-107887.md): Advanced Twenty Seventeen \<= 1.3.1 - Subscriber+ Site Theme Switch via ats\_create\_child\_theme (CVSS 5.4, Advanced Twenty Seventeen)
- [CVE-2026-115806](https://cve.now/CVE-2026-115806.md): Prime Mover \<= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace (CVSS 9.8, codexonics Prime Mover – Backup and Migration)
- [CVE-2026-115807](https://cve.now/CVE-2026-115807.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute (CVSS 7.1, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2026-115929](https://cve.now/CVE-2026-115929.md): MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs (CVSS 7.6, MongoDB Compass)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.