# CVEs published 2026-10-25

133 CVEs were published on October 25, 2026: 3 critical, 31 high. Days are UTC.

- [CVE-2026-116099](https://cve.now/CVE-2026-116099.md): Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write (CVSS 5.3, Fusion Creators Studio SCP Containment Breach Multiplayer)
- [CVE-2026-116098](https://cve.now/CVE-2026-116098.md): SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization (CVSS 5.3, SteelRaven7 Ravenfield)
- [CVE-2026-116097](https://cve.now/CVE-2026-116097.md): CloudClassroom-PHP-Project addnewstudent.php cross site scripting (CVSS 5.3, CloudClassroom-PHP-Project)
- [CVE-2026-116096](https://cve.now/CVE-2026-116096.md): ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list\_pockettts\_state\_slots out-of-bounds write (CVSS 4.8, ggml-org llama.cpp)
- [CVE-2026-116095](https://cve.now/CVE-2026-116095.md): smg-project smg llm-multimodal jpeg\_turbo.rs decode\_jpeg\_rgb memory allocation (CVSS 6.9, smg-project smg)
- [CVE-2026-116094](https://cve.now/CVE-2026-116094.md): EyouCMS function.php remote\_file\_to\_local server-side request forgery (CVSS 6.9, EyouCMS)
- [CVE-2026-115627](https://cve.now/CVE-2026-115627.md): AshPostgres ignores attribute multitenancy on the join resource when loading many\_to\_many and through relationships, returning records related through other tenants' rows (CVSS 6.0, ash-project ash\_postgres · ash\_postgres)
- [CVE-2026-115635](https://cve.now/CVE-2026-115635.md): AshPostgres returns another tenant's record for a skipped upsert when return\_skipped\_upsert? is set (CVSS 6.0, ash-project ash\_postgres · ash\_postgres)
- [CVE-2026-114214](https://cve.now/CVE-2026-114214.md): Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records (CVSS 6.0, ash-project ash · ash)
- [CVE-2026-116063](https://cve.now/CVE-2026-116063.md): DedeCMS update\_guide.php require\_once code injection (CVSS 5.1, DedeCMS)
- [CVE-2026-116062](https://cve.now/CVE-2026-116062.md): SourceCodester Performance Indicator System save\_profile.php sql injection (CVSS 6.9, SourceCodester Performance Indicator System)
- [CVE-2026-116061](https://cve.now/CVE-2026-116061.md): SourceCodester Performance Indicator System edit\_dealer.php sql injection (CVSS 6.9, SourceCodester Performance Indicator System)
- [CVE-2026-115825](https://cve.now/CVE-2026-115825.md): HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length (no CVSS, Plack)
- [CVE-2026-115824](https://cve.now/CVE-2026-115824.md): Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies (no CVSS, Starman)
- [CVE-2026-115823](https://cve.now/CVE-2026-115823.md): Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections (no CVSS, Starman)
- [CVE-2026-115822](https://cve.now/CVE-2026-115822.md): Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies (no CVSS, Starman)
- [CVE-2026-115817](https://cve.now/CVE-2026-115817.md): Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read\_timeout covers only the headers (no CVSS, Starman)
- [CVE-2026-116060](https://cve.now/CVE-2026-116060.md): SourceCodester Performance Indicator System adddealer.php sql injection (CVSS 6.9, SourceCodester Performance Indicator System)
- [CVE-2026-116058](https://cve.now/CVE-2026-116058.md): Alfresco Activiti JuelScriptEngine.java JuelScriptEngine.eval code injection (CVSS 5.3, Alfresco Activiti)
- [CVE-2026-116057](https://cve.now/CVE-2026-116057.md): KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload (CVSS 5.3, KodCloud KodExplorer)
- [CVE-2026-116056](https://cve.now/CVE-2026-116056.md): KodCloud KodExplorer Remote Download web.function.php request\_url\_safe server-side request forgery (CVSS 5.3, KodCloud KodExplorer)
- [CVE-2026-116055](https://cve.now/CVE-2026-116055.md): SourceCodester Performance Indicator System deleteproduct.php sql injection (CVSS 5.3, SourceCodester Performance Indicator System)
- [CVE-2026-116054](https://cve.now/CVE-2026-116054.md): SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash (CVSS 2.1, SH3)
- [CVE-2026-116053](https://cve.now/CVE-2026-116053.md): dbcli mycli Whitelist source.py source\_special\_command\_is\_safe os command injection (CVSS 4.8, dbcli mycli)
- [CVE-2026-116186](https://cve.now/CVE-2026-116186.md): OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId (CVSS 2.3, openremote core)
- [CVE-2026-116185](https://cve.now/CVE-2026-116185.md): OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos (CVSS 5.3, openremote core)
- [CVE-2026-116184](https://cve.now/CVE-2026-116184.md): OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket (CVSS 2.1, openremote core)
- [CVE-2026-116211](https://cve.now/CVE-2026-116211.md): YesWiki 4.5.0 before 4.7.0 SQL Injection via date\_maj\_fiche in Bazar entry create (CVSS 8.8, yeswiki)
- [CVE-2026-116208](https://cve.now/CVE-2026-116208.md): YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts (CVSS 7.2, yeswiki)
- [CVE-2026-116207](https://cve.now/CVE-2026-116207.md): YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API (CVSS 8.8, yeswiki)
- [CVE-2026-116206](https://cve.now/CVE-2026-116206.md): YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax (CVSS 5.3, yeswiki)
- [CVE-2026-116205](https://cve.now/CVE-2026-116205.md): YesWiki before 4.7.0 Unauthenticated SSRF via \[\[|URL\]\] Raw-Inclusion Syntax (CVSS 6.9, yeswiki)
- [CVE-2026-116204](https://cve.now/CVE-2026-116204.md): YesWiki before 4.7.0 CSRF via despam Admin Action (CVSS 7.2, yeswiki)
- [CVE-2026-116203](https://cve.now/CVE-2026-116203.md): YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters (CVSS 5.3, yeswiki)
- [CVE-2026-116202](https://cve.now/CVE-2026-116202.md): YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload (CVSS 5.1, yeswiki)
- [CVE-2026-116201](https://cve.now/CVE-2026-116201.md): Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition (CVSS 8.7, grokability snipe-it)
- [CVE-2026-116200](https://cve.now/CVE-2026-116200.md): Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap() (CVSS 8.2, grokability snipe-it)
- [CVE-2026-116199](https://cve.now/CVE-2026-116199.md): Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback (CVSS 9.2, grokability snipe-it)
- [CVE-2026-116198](https://cve.now/CVE-2026-116198.md): Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store (CVSS 5.3, grokability snipe-it)
- [CVE-2026-116197](https://cve.now/CVE-2026-116197.md): Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection (CVSS 2.1, edgelesssys contrast)
- [CVE-2026-116196](https://cve.now/CVE-2026-116196.md): Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url (CVSS 6.0, rclone)
- [CVE-2026-116195](https://cve.now/CVE-2026-116195.md): Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim (CVSS 7.0, rclone)
- [CVE-2026-116194](https://cve.now/CVE-2026-116194.md): Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callback (CVSS 7.6, rclone)
- [CVE-2026-116193](https://cve.now/CVE-2026-116193.md): Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests (CVSS 6.9, rclone)
- [CVE-2026-116192](https://cve.now/CVE-2026-116192.md): rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots (CVSS 8.2, rclone)
- [CVE-2026-116191](https://cve.now/CVE-2026-116191.md): Rclone before 1.75.2 Path Traversal via serve webdav MKCOL (CVSS 8.7, rclone)
- [CVE-2026-116190](https://cve.now/CVE-2026-116190.md): rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect (CVSS 6.3, rclone)
- [CVE-2026-116189](https://cve.now/CVE-2026-116189.md): rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMS (CVSS 7.7, rclone)
- [CVE-2026-116188](https://cve.now/CVE-2026-116188.md): rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow (CVSS 6.9, rclone)
- [CVE-2026-116187](https://cve.now/CVE-2026-116187.md): Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads (CVSS 6.1, rclone)
- [CVE-2026-116183](https://cve.now/CVE-2026-116183.md): phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID (CVSS 8.7, thorsten phpMyFAQ)
- [CVE-2026-116182](https://cve.now/CVE-2026-116182.md): phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching (CVSS 5.3, thorsten phpMyFAQ)
- [CVE-2026-116181](https://cve.now/CVE-2026-116181.md): vLLM 0.20.1 before 0.29.0 DoS and GPU Out-of-Bounds Write via stop\_token\_ids (CVSS 7.1, vllm-project vllm)
- [CVE-2026-116180](https://cve.now/CVE-2026-116180.md): vLLM from 0.8.5 before 0.31.0 Cross-Tenant DoS via Uninitialized LogprobsTensors (CVSS 8.3, vllm-project vllm)
- [CVE-2026-116179](https://cve.now/CVE-2026-116179.md): vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media\_io\_kwargs num\_frames Override (CVSS 8.7, vllm-project vllm)
- [CVE-2026-116178](https://cve.now/CVE-2026-116178.md): vLLM 0.20.0 before 0.30.0 DoS via /inference/v1/generate mm\_placeholders (CVSS 8.2, vllm-project vllm · vllm)
- [CVE-2026-116177](https://cve.now/CVE-2026-116177.md): vLLM 0.10.2 before 0.25.0 DoS via Nemotron-VL Processor Decompression-Bomb Guard Bypass (CVSS 8.7, vllm-project vllm · vllm)
- [CVE-2026-116176](https://cve.now/CVE-2026-116176.md): vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector (CVSS 8.8, vllm-project vllm · vllm)
- [CVE-2026-116175](https://cve.now/CVE-2026-116175.md): vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions (CVSS 7.1, vllm-project vllm)
- [CVE-2026-116174](https://cve.now/CVE-2026-116174.md): vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate (CVSS 8.2, vllm-project vllm)
- [CVE-2026-116173](https://cve.now/CVE-2026-116173.md): vLLM 0.22.0 before 0.24.0 Denial of Service via gRPC output\_candidates.token\_ids (CVSS 8.2, vllm-project vllm · vllm)
- [CVE-2026-116172](https://cve.now/CVE-2026-116172.md): vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top\_n (CVSS 8.2, vllm-project vllm)
- [CVE-2026-116171](https://cve.now/CVE-2026-116171.md): SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix (CVSS 5.9, siyuan-note siyuan)
- [CVE-2026-116170](https://cve.now/CVE-2026-116170.md): SiYuan before v3.8.7 SQL Injection via History Search op and query (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-116169](https://cve.now/CVE-2026-116169.md): SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \\href in Math Blocks (CVSS 5.1, siyuan-note siyuan)
- [CVE-2026-116168](https://cve.now/CVE-2026-116168.md): SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-116167](https://cve.now/CVE-2026-116167.md): SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter (CVSS 7.6, siyuan-note siyuan)
- [CVE-2026-116166](https://cve.now/CVE-2026-116166.md): SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting (CVSS 7.6, siyuan-note siyuan)
- [CVE-2026-116165](https://cve.now/CVE-2026-116165.md): Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB (CVSS 8.8, parse-community parse-server)
- [CVE-2026-116164](https://cve.now/CVE-2026-116164.md): Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes (CVSS 6.3, parse-community parse-server)
- [CVE-2026-116163](https://cve.now/CVE-2026-116163.md): Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses (CVSS 9.1, parse-community parse-server)
- [CVE-2026-116162](https://cve.now/CVE-2026-116162.md): Parse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login (CVSS 2.1, parse-community parse-server)
- [CVE-2026-116161](https://cve.now/CVE-2026-116161.md): Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions (CVSS 6.0, parse-community parse-server)
- [CVE-2026-116160](https://cve.now/CVE-2026-116160.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Heap Buffer Overflow via X11 Animate (CVSS 4.8, ImageMagick)
- [CVE-2026-116159](https://cve.now/CVE-2026-116159.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option (CVSS 4.8, ImageMagick)
- [CVE-2026-116158](https://cve.now/CVE-2026-116158.md): ImageMagick before 7.1.2-33 Memory Leak in magick compare (CVSS 2.0, ImageMagick)
- [CVE-2026-116157](https://cve.now/CVE-2026-116157.md): ImageMagick before 7.1.2-33 Memory Leak in PerlMagick Property Reading (CVSS 4.8, ImageMagick)
- [CVE-2026-116156](https://cve.now/CVE-2026-116156.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -set profile Option (CVSS 4.8, ImageMagick)
- [CVE-2026-116155](https://cve.now/CVE-2026-116155.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile (CVSS 6.9, ImageMagick)
- [CVE-2026-116154](https://cve.now/CVE-2026-116154.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via XML Parsing Depth Limit (CVSS 6.9, ImageMagick)
- [CVE-2026-116153](https://cve.now/CVE-2026-116153.md): ImageMagick before 7.1.2-33 Heap Buffer Overflow via Convex-Hull on 32-bit (CVSS 2.0, ImageMagick)
- [CVE-2026-116152](https://cve.now/CVE-2026-116152.md): ImageMagick before 7.1.2-33 Memory Leak in MAT Decoder Error Path (CVSS 6.9, ImageMagick)
- [CVE-2026-116151](https://cve.now/CVE-2026-116151.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder (CVSS 6.3, ImageMagick)
- [CVE-2026-116150](https://cve.now/CVE-2026-116150.md): ImageMagick before 7.1.2-33 Memory Leak in FPX Encoder (CVSS 2.3, ImageMagick)
- [CVE-2026-116149](https://cve.now/CVE-2026-116149.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Buffer Overflow via bzip2 Compressed Images (CVSS 7.2, ImageMagick)
- [CVE-2026-116148](https://cve.now/CVE-2026-116148.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options (CVSS 4.8, ImageMagick)
- [CVE-2026-116147](https://cve.now/CVE-2026-116147.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Null Pointer Dereference in DJVU Decoder (CVSS 6.3, ImageMagick)
- [CVE-2026-116146](https://cve.now/CVE-2026-116146.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in MSL Decoder (CVSS 6.3, ImageMagick)
- [CVE-2026-116145](https://cve.now/CVE-2026-116145.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 Security Policy Bypass via Incomplete Fix (CVSS 1.8, ImageMagick)
- [CVE-2026-116144](https://cve.now/CVE-2026-116144.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder (CVSS 4.8, ImageMagick)
- [CVE-2026-116143](https://cve.now/CVE-2026-116143.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass in PS, PDF and XPS Decoders (CVSS 4.8, ImageMagick)
- [CVE-2026-116142](https://cve.now/CVE-2026-116142.md): ImageMagick before 7.1.2-33 Heap Buffer Over-Read via Minimum-Bounding-Box (CVSS 4.8, ImageMagick)
- [CVE-2026-116141](https://cve.now/CVE-2026-116141.md): ImageMagick before 7.1.2-33 Policy Bypass in UHDR Decoder (CVSS 6.9, ImageMagick)
- [CVE-2026-116140](https://cve.now/CVE-2026-116140.md): ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing (CVSS 4.8, ImageMagick)
- [CVE-2026-116139](https://cve.now/CVE-2026-116139.md): WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering (CVSS 5.1, WWBN AVideo)
- [CVE-2026-116052](https://cve.now/CVE-2026-116052.md): LinkStackOrg LinkStack cross-site request forgery (CVSS 5.3, LinkStackOrg LinkStack)
- [CVE-2026-116137](https://cve.now/CVE-2026-116137.md): adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names (CVSS 6.3, cthackers adm-zip)
- [CVE-2026-116136](https://cve.now/CVE-2026-116136.md): ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking (CVSS 6.0, ProjectSend)
- [CVE-2026-116073](https://cve.now/CVE-2026-116073.md): Leon before commit 50df142 Path Traversal via /download model Command (CVSS 6.9, leon-ai leon)
- [CVE-2026-116072](https://cve.now/CVE-2026-116072.md): Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity (CVSS 5.3, Docile-Alligator Infinity for Reddit)
- [CVE-2026-116071](https://cve.now/CVE-2026-116071.md): rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption (CVSS 8.2, rotki)
- [CVE-2026-116070](https://cve.now/CVE-2026-116070.md): Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config (CVSS 6.9, dqzboy Docker-Proxy)
- [CVE-2026-116069](https://cve.now/CVE-2026-116069.md): NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field (CVSS 6.9, Albert-Weasker niubigeo)
- [CVE-2026-116068](https://cve.now/CVE-2026-116068.md): Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router (CVSS 8.7, dokploy)
- [CVE-2026-116067](https://cve.now/CVE-2026-116067.md): Paisa before 0.7.8 Path Traversal via Editor and Sheet API (CVSS 8.8, ananthakumaran paisa)
- [CVE-2026-116066](https://cve.now/CVE-2026-116066.md): Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service (CVSS 7.0, Firecrawl)
- [CVE-2026-116050](https://cve.now/CVE-2026-116050.md): krupalshah Employee Recruitment System Registration registerform3.php sql injection (CVSS 6.9, krupalshah Employee Recruitment System)
- [CVE-2026-116049](https://cve.now/CVE-2026-116049.md): krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql\_query sql injection (CVSS 6.9, krupalshah EmployeeRecruitmentSystem)
- [CVE-2026-116048](https://cve.now/CVE-2026-116048.md): krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql\_query sql injection (CVSS 6.9, krupalshah EmployeeRecruitmentSystem)
- [CVE-2026-116047](https://cve.now/CVE-2026-116047.md): Privoce Vocechat Query Parameter widget.html cross site scripting (CVSS 5.3, Privoce Vocechat)
- [CVE-2026-116046](https://cve.now/CVE-2026-116046.md): eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal (CVSS 4.8, eventcatalog sdk)
- [CVE-2026-116045](https://cve.now/CVE-2026-116045.md): 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get\_reference path traversal (CVSS 5.3, 1999AZZAR designer-mcp)
- [CVE-2026-115251](https://cve.now/CVE-2026-115251.md): Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade (CVSS 7.2, Duplicator)
- [CVE-2026-115214](https://cve.now/CVE-2026-115214.md): Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers (CVSS 9.8, Datawiza Proxy Auth Plugin)
- [CVE-2026-115183](https://cve.now/CVE-2026-115183.md): Qi Addons For Elementor \< 1.11.2 - Contributor+ Content Injection via Animated Text Widget (CVSS 2.4, Qi Addons For Elementor)
- [CVE-2026-114743](https://cve.now/CVE-2026-114743.md): InstaWP Connect \< 0.1.4.2 - Authenticated Plugin Settings Update via instawp\_update\_settings (CVSS 3.1, InstaWP Connect)
- [CVE-2026-114742](https://cve.now/CVE-2026-114742.md): WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR (CVSS 2.7, WPVR)
- [CVE-2026-114741](https://cve.now/CVE-2026-114741.md): WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR (CVSS 3.8, WPVR)
- [CVE-2026-114740](https://cve.now/CVE-2026-114740.md): WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard (CVSS 4.9, WPVR)
- [CVE-2026-111981](https://cve.now/CVE-2026-111981.md): GiveWP \< 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor\_manage\_addresses (CVSS 2.7, GiveWP)
- [CVE-2026-111980](https://cve.now/CVE-2026-111980.md): GiveWP \< 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant (CVSS 5.5, GiveWP)
- [CVE-2026-111979](https://cve.now/CVE-2026-111979.md): GiveWP \< 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color (CVSS 6.8, GiveWP)
- [CVE-2026-111978](https://cve.now/CVE-2026-111978.md): GiveWP \< 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import (CVSS 6.0, GiveWP)
- [CVE-2026-111976](https://cve.now/CVE-2026-111976.md): GiveWP \< 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route (CVSS 5.3, GiveWP)
- [CVE-2026-110285](https://cve.now/CVE-2026-110285.md): WP Stripe Checkout \< 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret (CVSS 5.3, WP Stripe Checkout)
- [CVE-2025-15705](https://cve.now/CVE-2025-15705.md): Contact Form by Supsystic \< 1.8.0 - Admin+ Stored XSS (CVSS 3.5, Contact Form by Supsystic)
- [CVE-2026-94295](https://cve.now/CVE-2026-94295.md): Chikkili Google Pay for WooCommerce \<= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature (CVSS 5.3, Chikkili- Google Pay India for Woocommerce)
- [CVE-2026-116044](https://cve.now/CVE-2026-116044.md): prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload (CVSS 5.3, prasathmani TinyFileManager)
- [CVE-2026-116007](https://cve.now/CVE-2026-116007.md): YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeServiceImpl.validateSmsCode0 excessive authentication (CVSS 6.3, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-116006](https://cve.now/CVE-2026-116006.md): YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication (CVSS 6.9, YunaiV ruoyi-vue-pro · zhijiantianya ruoyi-vue-pro)
- [CVE-2026-116004](https://cve.now/CVE-2026-116004.md): onyx-dot-app Onyx PreviewTab.tsx cross site scripting (CVSS 5.1, onyx-dot-app Onyx)
- [CVE-2026-116000](https://cve.now/CVE-2026-116000.md): Zylon PrivateGPT URI Artifact Loader uri\_loader.py load\_file\_from\_uri server-side request forgery (CVSS 6.9, Zylon PrivateGPT)
- [CVE-2026-115999](https://cve.now/CVE-2026-115999.md): mansi-k Restaurant\_IMS lsmodal.php mysqli\_connect sql injection (CVSS 6.9, mansi-k Restaurant\_IMS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.