Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 583 threats · Thursday, Oct 22· last check 2026-11-04 07:06 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Thursday, Oct 22

Most severe in everything

EXPLOITED IN THE WILD

Arista VeloCloud Orchestrator: SQL injection lets remote attacker reach internal functionsarista velocloud orchestrator

EXPLOITED IN THE WILD

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli packagebrotli20 talking

EXPLOITED IN THE WILD

DedeCMS: crafted Referer header lets unauthenticated visitors run PHP codeDedeCMS

EXPLOITED IN THE WILD

FineReport: unauthenticated path traversal lets attackers write webshellsFineReport

Thursday, Oct 22

HIGH8.7Kiloview E3 NDI encoder: hardcoded JWT key lets attackers forge admin sessionsKiloview E3 FirmwareInfrastructure2026-10-22 23:20 UTCby InfraStack Analyst–FIX 1.30 HIGH8.7Kiloview E3 NDI encoder: unauthenticated ONVIF calls change DNS and NTPKiloview E3 firmwareInfrastructure2026-10-22 23:18 UTCby InfraStack Analyst–FIX 1.30 HIGH7.5E3 camera ONVIF service: malformed requests cause unauthenticated denial of serviceKiloview E3 FirmwareInfrastructure2026-10-22 23:18 UTCby InfraStack Analyst–FIX 1.30 CRITICAL9.9Kiloview E3 NDI encoder: network setting lets logged-in user run root commandsKiloview E3 firmwareInfrastructure2026-10-22 23:18 UTCby InfraStack Analyst–FIX 1.30 CRITICAL9.9Kiloview E3 NDI encoder: hostname field lets logged-in users run root commandsKiloview E3 firmwareInfrastructure2026-10-22 23:18 UTCby InfraStack Analyst–FIX 1.30 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in react-native-bright-sdk (npm)react-native-bright-sdkPackage2026-10-22 23:01 UTCby osv-malicious–UNINSTALL CRITICAL10.0PUBLIC EXPLOITMicrosoft Entra App Proxy: flawed authentication lets an outsider gain higher privilegesMicrosoft Entra application proxyVendor2026-10-22 22:20 UTCby InfraStack Analyst–FIX service-side, no customer action HIGH8.3E3 web management: login tokens expire far too late, stay validKiloview E3 FirmwareInfrastructure2026-10-22 22:20 UTCby InfraStack Analyst–FIX 1.30 HIGH7.5Microsoft Exchange Online: stack buffer overflow lets an authorized user run codeMicrosoft Exchange OnlineVendor2026-10-22 22:19 UTCby InfraStack Analyst–FIX mitigated service-side by Microsoft, 2026-10-22 CRITICAL10.0PUBLIC EXPLOITAzure Kubernetes Configuration Service: missing auth lets attackers elevate privilegesInfrastructure2026-10-22 22:19 UTCby InfraStack Analyst–WHAT TO DO LOW3.5libslirp: ICMP echo reply leaks host IP to guestInfrastructure2026-10-22 22:18 UTCby EPSS–WHAT TO DO MEDIUM5.5OpenShift oc: malicious image layers can write files outside extraction directoryInfrastructure2026-10-22 22:18 UTCby EPSS–WHAT TO DO MEDIUM5.4FreeIPA: enrolled hosts can retrieve and revoke other entities' certificatesInfrastructure2026-10-22 22:18 UTCby EPSS–WHAT TO DO MEDIUM5.4Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFauthlibPackage2026-10-14 09:21 UTCby EPSS–FIX 1.9.0 MEDIUM4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensauthlibPackage2026-10-14 08:55 UTCby EPSS–FIX 1.9.0 MEDIUM6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audienceauthlibPackage2026-10-14 09:05 UTCby EPSS–FIX 1.9.0 MEDIUM4.2Authlib: ID token can disable its own nonce validation via the nonce_supported claimauthlibPackage2026-10-14 09:12 UTCby EPSS–FIX 1.9.0 HIGH7.4Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)AuthlibPackage2026-10-14 14:22 UTCby EPSS–FIX 1.9.1 HIGH7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysauthlibPackage2026-10-14 08:46 UTCby EPSS–FIX 1.9.0 CRITICAL9.2InterSystems IRIS for Health: TLS off by default exposes traffic and loginsInterSystems IRIS for HealthRuntime2026-10-22 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9ONVIF device service on E3 leaks device identifiers and user account listInfrastructure2026-10-22 22:18 UTCby EPSS–WHAT TO DO CRITICAL10.0PUBLIC EXPLOITAzure VM Inspector: link following lets attacker gain elevated privilegesVendor2026-10-22 22:18 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.4Kiloview E3 NDI encoder: static route field lets an authenticated user run root commandsKiloview E3 firmwareInfrastructure2026-10-22 22:17 UTCby InfraStack Analyst–FIX 1.30 HIGH7.7Azure AI Foundry: SSRF lets authorized users escalate privileges over networkAzure AI FoundryVendor2026-10-22 22:17 UTCby InfraStack Analyst–FIX service-side fix applied by Microsoft MEDIUM6.0Time zone parameter lets an authenticated user point localtime outside zoneinfoOther2026-10-22 22:17 UTCby EPSS–WHAT TO DO CRITICAL9.1PUBLIC EXPLOITAzure Pipelines: command injection lets an outsider run code over the networkAzure PipelinesVendor2026-10-22 22:17 UTCby InfraStack Analyst–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @factiii/runner (npm)@factiii/runnerPackage2026-10-22 21:37 UTCby osv-malicious–UNINSTALL HIGH7.5Duplicate Advisory: Mistune: Path Traversal and XSS in Include directivemistunePackage2026-10-22 21:32 UTCby GitHub Advisories–WHAT TO DO CRITICAL9.9EXPLOITEDArista VeloCloud Orchestrator: SQL injection lets remote attacker reach internal functionsarista velocloud orchestratorVendor2026-10-22 21:17 UTCby PoC on GitHub–FIX 5.2.3.18 LOW2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsauthlibPackage2026-10-10 10:04 UTCby EPSS–FIX 1.8.0 MEDIUM6.9Python tarfile: crafted links bypass tar filter, write files outside extraction directoryRuntime2026-10-22 21:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in journey-teste-shellhello (PyPI)journey-teste-shellhelloPackage2026-10-22 21:16 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @seggy116/next-diff (npm)@seggy116/next-diffPackage2026-10-22 21:01 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @pkgship/frps-linux-amd64 (npm)@pkgship/frps-linux-amd64Package2026-10-22 20:48 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @pkgship/frpc-linux-amd64 (npm)@pkgship/frpc-linux-amd64Package2026-10-22 20:39 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in sdk-utils-testmetest (npm)sdk-utils-testmetestPackage2026-10-22 20:37 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in kvarzo8f3atestmetest (npm)kvarzo8f3atestmetestPackage2026-10-22 20:37 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @lumen-labs-dev/whisper-node (npm)@lumen-labs-dev/whisper-nodePackage2026-10-22 20:23 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in darknode-cli (npm)darknode-cliPackage2026-10-22 20:23 UTCby osv-malicious–UNINSTALL MEDIUM4.2Jitsu console: missing await lets users alter other workspaces' sync cursorsPackage2026-10-22 20:17 UTCby EPSS–WHAT TO DO HIGH7.1Crawl4AI: unbounded regex in Docker API lets authenticated clients freeze serverAI agents & MCP2026-10-15 10:01 UTCby EPSS–WHAT TO DO MEDIUM5.1Vikunja: task and display names inject phishing links into notification emailsPackage2026-10-22 10:09 UTCby EPSS–WHAT TO DO HIGH8.7libexpat: late billion-laughs check lets XML cause long CPU stallslibexpatInfrastructure2026-10-22 20:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.6libsmb2: integer overflow in DCE/RPC decoder enables heap memory corruptionPackage2026-10-22 20:17 UTCby EPSS–WHAT TO DO HIGH8.5CFITSIO: crafted FITS file overflows buffer in ffgcls2, enabling code executionPackage2026-10-22 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Ghidra: crafted zip extension archive can exhaust disk spaceOther2026-10-22 12:09 UTCby EPSS–WHAT TO DO MEDIUM6.8Ghidra: crafted TAR or ZIP archive exhausts memory and hangs sessionOther2026-10-22 12:07 UTCby EPSS–WHAT TO DO HIGH8.7Motor.NET: crafted JSON message crash-loops consumer service permanentlyPackage2026-10-22 20:17 UTCby EPSS–WHAT TO DO HIGH8.7Motor.NET: one crafted Kafka record crash-loops the consumer servicePackage2026-10-22 20:17 UTCby EPSS–WHAT TO DO HIGH8.7Motor.NET: crafted message headers crash the service permanentlyMotor.NETPackage2026-10-22 20:17 UTCby InfraStack Analyst–FIX 0.19.0 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in x402-prompt-injection-scan (npm)x402-prompt-injection-scanPackage2026-10-22 19:46 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTOpenAI: New Ad Accounts failing to provision adminsOpenAIVendor2026-10-22 19:36 UTCby status page–WHAT TO DO LOWINCIDENTFly.io: Degraded Edge PerformanceFly.ioVendor2026-10-22 19:26 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in imgdecode (npm)imgdecodePackage2026-10-22 19:24 UTCby osv-malicious–UNINSTALL LOW3.3AOS-8 web management interface: memory corruption lets local users disrupt serviceInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO MEDIUM4.4AOS-8: buffer overflow lets an admin crash the systemInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO MEDIUM4.9AOS-10 CLI: arbitrary file deletion lets an admin crash the deviceInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.3Aruba AOS-8: PAPI protocol flaw lets unauthenticated attackers change some settingsInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.5AOS web management interface: stored XSS lets an admin run scripts in other sessionsInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.5AOS-10 PAPI protocol authentication bypass lets adjacent attackers change device settingsInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.8AOS-10 CLI: unauthenticated command injection gives OS-level control with physical accessInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.8AOS-10 API buffer overflow lets a privileged adjacent attacker run codeInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.0AOS-8 command line interface: unauthenticated buffer overflow allows disruption and limited data accessAOS-8Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.13.3.1 HIGH7.1Aruba AOS-8: PAPI protocol flaw leaks information to unauthenticated adjacent attackersInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.1AOS-10 web management interface lets unauthenticated adjacent attacker run host commandsInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.1Aruba AOS-10 and AOS-8 OS: unauthenticated overflow allows denial of serviceInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.2AOS-10: command injection lets an admin run OS commands as rootAOS-10Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 10.8.1.2 HIGH7.2Aruba AOS-10: command injection lets a privileged remote user run OS commandsArubaOS (AOS-10)Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.2Aruba AOS-8: PAPI buffer overflow lets high-privilege remote user run codeArubaOS (AOS-8)Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.2Aruba AOS-8: authenticated command injection lets attacker run OS commandsInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.2Aruba AOS-8: authenticated attacker runs commands via command injectionInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.2Wireless network management web interface flaw allows remote code executionAOS-10Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 10.8.1.2 HIGH7.2AOS-8 web interface: authenticated users can run OS commands remotelyAOS-8Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.13.3.1 HIGH7.5Aruba AOS-8: unauthenticated PAPI memory corruption lets remote attackers crash servicesArubaOS (AOS-8)Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.10.0.24 HIGH7.5Aruba AOS-10: unauthenticated remote attacker can disrupt an interfaceInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.5AOS-8: unauthenticated PAPI protocol flaw lets attackers disrupt availabilityInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.5Aruba AOS-10: memory corruption lets unauthenticated attackers crash the deviceInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH7.8AOS-8: memory corruption lets a local user run code as rootInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH8.1AOS-8 CLI buffer overflow lets unauthenticated remote attackers run host commandsArubaOS AOS-8 (8.13.x)Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.13.3.1 HIGH8.1Aruba AOS-8: crafted PAPI packets let unauthenticated attackers run code as rootInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH8.1AOS-8 web interface buffer overflow lets unauthenticated attackers run OS commandsInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH8.1AOS-8 web interface buffer overflow lets unauthenticated attackers run OS commandsAOS-8Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.10.0.24 HIGH8.1AOS-8 web interface flaw lets unauthenticated attackers run code remotelyInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH8.2Aruba AOS-8 controllers: unauthenticated PAPI buffer overflow disrupts serviceArubaOS (AOS-8)Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.13.3.1 HIGH8.2Aruba AOS-8: unauthenticated PAPI flaw lets remote attackers write filesInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH8.2Aruba AOS-8 web management interface lets adjacent attacker bypass authenticationInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH8.3HPE AOS-10: PAPI protocol buffer overflow leaks data to adjacent attackersInfrastructure2026-10-22 19:18 UTCby EPSS–WHAT TO DO HIGH8.3AOS-10 PAPI protocol flaw lets adjacent attacker run code as rootAOS-10Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 10.8.1.2 HIGH8.3AOS-8 operating system auth bypass lets remote attacker run code as rootAOS-8Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.10.0.24 HIGH8.7AOS-8 CLI flaw lets a privileged remote user run OS commandsHPE Aruba Networking AOS-8Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.13.3.1 HIGH8.8Aruba AOS-10: memory corruption lets adjacent attacker run code as rootAOS-10Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 10.8.1.2 HIGH8.8Alcatel-Lucent AOS-8: unauthenticated PAPI packets run code as rootHPE AOS-8Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 8.13.3.1 HIGH8.8Aruba AOS-10: unauthenticated adjacent attacker runs commands as rootHPE Networking AOS-101 talkingInfrastructure2026-10-22 19:18 UTCby InfraStack Analyst1talkingFIX 10.8.1.2 CRITICAL9.3Aruba AOS-10: Wi-Fi frame flaw leaks data to nearby unauthenticated attackersAOS-10 (ArubaOS)Infrastructure2026-10-22 19:18 UTCby InfraStack Analyst–FIX 10.4.1.14 CRITICAL9.3Aruba AOS-8: unauthenticated attacker on the network gains administrator accessHPE Networking AOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.3HPE Aruba AOS-10: API authentication bypass gives adjacent attackers admin accessAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.3HPE Aruba AOS-10: PAPI authentication bypass gives unauthenticated admin accessAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.4Aruba AOS-10 and AOS-8 controllers: buffer overflow gives remote root code executionAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.6Aruba AOS-10: unauthenticated CLI flaw leaks data that enables further network accessAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.6HPE Aruba AOS-8: PAPI authentication bypass gives unauthenticated admin accessAOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.6HPE AOS-10 auth bypass lets adjacent attacker run OS commands as rootHPE Networking AOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.6AOS-8 wireless controller: authentication bypass grants full administrative controlHPE Networking AOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.6Aruba AOS-8 controllers: authentication bypass lets adjacent attackers run host commandsAOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.6HPE Aruba AOS-8: unauthenticated PAPI path traversal reads, edits, deletes OS filesHPE Networking AOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.6HPE Aruba AOS-10: memory corruption lets adjacent attacker run code as rootAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.4.1.14 CRITICAL9.6HPE Aruba AOS-10: unauthenticated command injection gives root on controllersAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.6Aruba AOS-10 and AOS-8 controllers: buffer overflow lets nearby attacker run codeAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.4.1.14 CRITICAL9.6Aruba AOS-10 and AOS-8 controllers: buffer overflow lets adjacent attacker run codeAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.8HPE Aruba AOS-10: crafted PAPI packets let anyone run code as rootAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.4.1.14 CRITICAL9.8Aruba AOS-8 controllers: unauthenticated remote code execution over PAPI port 8211AOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.8ArubaOS AOS-8 controllers: buffer overflow lets unauthenticated attackers run code as rootArubaOS (AOS-8)Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.8HPE Aruba AOS-8 controllers: unauthenticated SQL injection lets attackers read and change dataHPE Networking AOS-8 (ArubaOS)Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.10.0.24 CRITICAL9.8ArubaOS AOS-8: unauthenticated crafted UDP packets run commands as rootArubaOS AOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.8HPE AOS-8 wireless controllers: PAPI buffer overflow grants unauthenticated admin accessHPE Networking AOS-8 (ArubaOS)Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.8AOS-8: SSH daemon authentication bypass grants unauthenticated administrative accessHPE Aruba AOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL9.8HPE AOS-10 wireless controllers: unauthenticated SQL injection leads to OS command executionHPE Networking AOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.8HPE AOS-10 wireless controllers: unauthenticated info leak leads to command executionHPE Networking AOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL9.8HPE Aruba AOS: unauthenticated SQL injection in web management leads to OS command executionAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 CRITICAL10.0HPE Aruba AOS-10: buffer overflow lets an unauthenticated attacker run code as rootAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.4.1.14 CRITICAL10.0HPE Aruba AOS-8: unauthenticated attacker runs root commands on wireless controllersAOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.10.0.24 CRITICAL10.0HPE Aruba AOS-8 controllers: unauthenticated SQL injection leads to OS command executionAOS-8 (ArubaOS)Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL10.0Aruba AOS-8 wireless controllers: unauthenticated SQL injection leads to OS command executionAOS-8Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL10.0Aruba AOS-10: crafted packets let unauthenticated attackers run code as rootHPE Networking AOS-101 talkingInfrastructure2026-10-22 19:17 UTCby InfraStack Analyst1talkingFIX 10.8.1.2 CRITICAL10.0HPE Aruba AOS-8 controllers: unauthenticated remote command injection on the hostAOS-8 8.13Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 8.13.3.1 CRITICAL10.0HPE Aruba AOS-10: auth bypass lets unauthenticated attackers run OS commandsAOS-10Infrastructure2026-10-22 19:17 UTCby InfraStack Analyst–FIX 10.8.1.2 LOW2.1KNIME Business Hub: session cookies missing security flags, enabling session compromiseOther2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.4KNIME Business Hub: unrestricted network access between execution contextsOther2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Ghidra: extension install with many files exhausts filesystem inodesPackage2026-10-22 12:08 UTCby EPSS–WHAT TO DO MEDIUM6.8Ghidra: crafted theme ZIP can fill disk and break later writesOther2026-10-22 12:09 UTCby EPSS–WHAT TO DO MEDIUM6.8Ghidra: theme ZIP import writes unlimited files, exhausting disk and inodesPackage2026-10-22 12:08 UTCby EPSS–WHAT TO DO MEDIUM6.8Ghidra: crafted GZF file exhausts memory and aborts importOther2026-10-22 12:10 UTCby EPSS–WHAT TO DO LOW3.8Wasmtime: Store APIs accept objects from other Engines, causing type confusionRuntime2026-07-31 16:23 UTCby EPSS–WHAT TO DO HIGH8.8Wasmtime: symlink trailing-slash flaw lets guests escape WASI filesystem sandboxwasmtimePackage2026-08-20 17:59 UTCby InfraStack Analyst–FIX 24.0.13 MEDIUM6.9Wasmtime: unbounded WASIp3 write buffering lets a guest exhaust host memoryRuntime2026-08-20 17:59 UTCby EPSS–WHAT TO DO MEDIUM6.9Wasmtime: fuel accounting flaw lets guest code evade timeoutsRuntime2026-09-24 19:25 UTCby EPSS–WHAT TO DO LOW2.3Wasmtime: crafted guest return values exhaust host memory, denial of serviceRuntime2026-09-24 19:25 UTCby EPSS–WHAT TO DO MEDIUM6.9Wasmtime: oversized HTTP body writes exhaust host memory from a guestRuntime2026-09-24 19:24 UTCby EPSS–WHAT TO DO MEDIUM6.9Wasmtime: overflowing filesystem timestamps let a guest program crash the hostRuntime2026-09-24 19:24 UTCby EPSS–WHAT TO DO LOW2.6Wasmtime: directory listing leaks host memory bytes to guest programsRuntime2026-10-02 19:38 UTCby EPSS–WHAT TO DO MEDIUM6.9Wasmtime: guest timestamp calls crash the host process on UnixRuntime2026-10-02 19:39 UTCby EPSS–WHAT TO DO CRITICAL9.9Wasmtime: malicious guest components overflow host stack and escape sandboxwasmtimePackage2026-10-02 19:39 UTCby InfraStack Analyst–FIX 48.0.4 MEDIUM5.9Wasmtime: crafted components corrupt GC heap and crash the runtimeRuntime2026-10-02 19:39 UTCby EPSS–WHAT TO DO MEDIUM5.9Wasmtime: zero between-bytes timeout lets a guest crash the hostRuntime2026-10-02 19:39 UTCby EPSS–WHAT TO DO MEDIUM5.9Wasmtime: guest write-zeroes request exhausts host memory, causing denial of serviceRuntime2026-10-02 19:39 UTCby EPSS–WHAT TO DO MEDIUM5.1Wasmtime: WASI poll_oneoff lets guest modules stall the hostRuntime2026-10-02 19:39 UTCby EPSS–WHAT TO DO MEDIUM6.9Wasmtime: missing GC rooting lets crafted Wasm corrupt the GC heapRuntime2026-10-02 19:38 UTCby EPSS–WHAT TO DO MEDIUM6.9Incus: malicious VM agent can write arbitrary host files during recursive pullInfrastructure2026-09-25 00:54 UTCby EPSS–WHAT TO DO CRITICAL9.9Incus: malicious migration sources can write any host file as rootincusInfrastructure2026-09-25 00:54 UTCby InfraStack Analyst–FIX 6.0.7 HIGH8.3Incus: project-restricted clients can copy other projects' storage volumesInfrastructure2026-09-25 00:54 UTCby EPSS–WHAT TO DO CRITICAL9.9Incus: crafted instance backup writes files outside storage, full host takeoverincus1 talkingInfrastructure2026-09-25 00:54 UTCby InfraStack Analyst1talkingFIX 7.0.2 HIGH7.1Incus: S3 server lets presigned URL holders copy other bucket objectsInfrastructure2026-09-25 00:54 UTCby EPSS–WHAT TO DO HIGH7.0Incus: restricted clients can read operations from other projectsInfrastructure2026-09-25 00:53 UTCby EPSS–WHAT TO DO CRITICAL9.0Incus: restricted project users can inject mkfs arguments as rootInfrastructure2026-09-25 00:53 UTCby EPSS–WHAT TO DO HIGH7.1Incus: restricted TLS clients can read storage bucket S3 keysInfrastructure2026-09-25 00:53 UTCby EPSS–WHAT TO DO MEDIUM5.3Incus: restricted project users can make the server probe internal servicesInfrastructure2026-09-25 00:53 UTCby EPSS–WHAT TO DO LOW2.2OpenBao: PKI role CIDR limit skipped for IP SANs taken from CSRsPackage2026-08-18 16:33 UTCby EPSS–WHAT TO DO LOW2.6OpenBao: child-namespace tokens can modify plugin registrations, causing denial of serviceInfrastructure2026-09-23 19:21 UTCby EPSS–WHAT TO DO HIGH7.5OpenBao: ACL policy cache lets tokens borrow policies from other namespacesPackage2026-09-23 19:19 UTCby EPSS–WHAT TO DO LOW2.2OpenBao: missing auth check lets attackers stop Agent and Proxy servicesInfrastructure2026-09-23 19:21 UTCby EPSS–WHAT TO DO LOW3.3OpenBao: sanitized config endpoint leaks ACME external account binding keyPackage2026-10-01 14:19 UTCby EPSS–WHAT TO DO LOW2.2OpenBao: expired AppRole Secret IDs still log in until tidy runsPackage2026-10-01 14:29 UTCby EPSS–WHAT TO DO MEDIUM4.1OpenBao: ACL bypass drops explicit deny rules under wildcard grantsPackage2026-09-23 19:21 UTCby EPSS–WHAT TO DO MEDIUM5.3OpenBao: UI OIDC login open redirect sends users to attacker sitesInfrastructure2026-09-23 19:20 UTCby EPSS–WHAT TO DO MEDIUM6.3OpenBao: role-scoped rate limits skipped for form-encoded requestsPackage2026-10-01 14:27 UTCby EPSS–WHAT TO DO LOW2.0OpenBao: malformed plugin parameters leak sensitive input into audit logsInfrastructure2026-09-23 19:22 UTCby EPSS–WHAT TO DO LOW2.2OpenBao: missing response audit entries hide root token generation and rekeyPackage2026-10-01 14:36 UTCby EPSS–WHAT TO DO MEDIUM5.4OpenBao: Kubernetes-auth tokens stay renewable after their service account is deletedPackage2026-10-01 14:26 UTCby EPSS–WHAT TO DO HIGH8.7Mistune: Path Traversal and XSS in Include directivemistunePackage2026-06-21 13:26 UTCby GitHub Advisories–FIX 3.3.0 HIGH7.1Mistune: Include directive path traversal reads local files from MarkdownPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO CRITICAL9.2Mistune: RST include directive reads arbitrary files via path traversalPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO HIGH8.7Mistune: inline link parser lets small markdown inputs burn CPUPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO MEDIUM5.3Mistune: unvalidated figure directive option lets markdown inject CSSPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO MEDIUM6.1Mistune: Include directive emits raw HTML files, enabling cross-site scriptingPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO HIGH8.7Mistune: nested square brackets cause quadratic parsing, exhausting server CPUPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO HIGH8.7Mistune: crafted Markdown with unbalanced brackets exhausts server CPUPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO HIGH8.7Mistune: crafted markdown with unbalanced brackets stalls workers for minutesPackage2026-06-21 13:25 UTCby EPSS–WHAT TO DO MEDIUM6.0libmongocrypt: unvalidated key vault values let attackers alter signed KMS requestsPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.9MongoDB C# Driver: out-of-range BSON binary subtype bypasses integrity checksPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO HIGH7.1MongoDB C# Driver: field-level encryption can silently store data in cleartextPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO HIGH7.1MongoDB C# Driver: update builder lets user input alter stored dataPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.3MongoDB C# Driver: BSON parsing can leak residual data from other requestsPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.9MongoDB .NET/C# driver: client-side encryption can silently store plaintext fieldsPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO HIGH7.6MongoDB C# Driver: shared connections can reuse another user's TLS identityPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO HIGH7.6MongoDB C# Driver: unescaped dot and dollar keys let users reach other fieldsPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM5.3MongoDB C# Driver: FindOneAndReplace accepts $-prefixed field names, altering documentsPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.9MongoDB C# Driver: unchecked BSON size lets outside input alter database commandsPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM5.7MongoDB C Driver: Windows Kerberos/SSPI length overflow corrupts client memoryPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO HIGH8.2MongoDB C# Driver BSON library: unbounded memory growth on untrusted inputPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM5.4MongoDB C# Driver: GeoJSON extra members can collide with reserved namesPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO HIGH7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failuremsgpackPackage2026-09-29 01:41 UTCby EPSS–FIX 1.2.3 CRITICAL9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt KeylitellmAI agents & MCP2026-09-30 01:13 UTCby EPSS–FIX 1.100.4 HIGH8.6Prospero Flow CRM: any basic user can read and delete other accountsOther2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUM5.3SmileCDR HAPI FHIR: conditional create leaks existing resource contentsOther2026-10-22 19:17 UTCby EPSS–WHAT TO DO LOW3.1SmileCDR HAPI FHIR: REST-hook subscriptions let users read restricted resourcesOther2026-10-22 19:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDLocalStack: reflected XSS in v4.9.2 runs script in a victim's browserPackage2026-10-22 19:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLocalStack: crafted CloudFormation template URL runs code in containerInfrastructure2026-10-22 19:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Bytebase: GitLab login trusts client URL, letting attackers log in as anyonePackage2022-05-25 02:37 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTOpenAI: Degraded Performance of Dots on EnterpriseOpenAIVendor2026-10-22 18:51 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @liauto/darwin-x64 (npm)@liauto/darwin-x64Package2026-10-22 18:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @pkgship/frpc-darwin-amd64 (npm)@pkgship/frpc-darwin-amd64Package2026-10-22 18:46 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in opencode-skills-collection (npm)opencode-skills-collectionPackage2026-10-22 18:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in agentic-awesome-skills (npm)agentic-awesome-skillsPackage2026-10-22 18:34 UTCby osv-malicious–UNINSTALL HIGH8.6Agent Zero Web UI: injected scripts run in victims' chat sessionsAgent ZeroAI agents & MCP2026-10-22 18:17 UTCby InfraStack Analyst–FIX 1.15 HIGH7.1Canonical Juju: unit agents can read other applications' charm resources and credentialsInfrastructure2026-10-22 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.4Checkmarx ast-cli: unverified helper download lets substituted binaries runPackage2026-10-22 16:30 UTCby EPSS–WHAT TO DO MEDIUM6.4ast-cli: tar extraction lets archive entries write outside install directoryPackage2026-10-22 16:28 UTCby EPSS–WHAT TO DO MEDIUM6.9CloudPirates Helm charts: CI cache poisoning can steal release tokensInfrastructure2026-06-15 19:29 UTCby EPSS–WHAT TO DO LOW3.1Supabase Realtime: expired JWT accepted when exp is a stringRuntime2026-06-16 06:30 UTCby EPSS–WHAT TO DO HIGH7.8ABB Ability Edgenius: missing authentication on a critical functionInfrastructure2026-10-22 18:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-115516 withdrawn by its numbering authority, no flawOther2026-10-22 18:17 UTCby NVD–WHAT TO DO CRITICAL9.1OCO-Server: unauthenticated forged MDM enrollment steals device identity certificatesOther2026-09-29 08:18 UTCby EPSS–WHAT TO DO MEDIUM6.5fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'fpdf2Package2026-08-10 00:01 UTCby EPSS–FIX 2.8.8 MEDIUM5.8fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled contentfpdf2Package2026-08-10 00:00 UTCby EPSS–FIX 2.8.8 HIGH8.6SmileCDR HAPI FHIR: bundle body can switch tenant partitionsHAPI FHIRPackage2026-10-22 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7SmileCDR HAPI FHIR: crafted compressed request can exhaust heap and crashHAPI FHIRPackage2026-10-22 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.4PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingphpoffice/phpspreadsheetPackage2026-10-12 20:56 UTCby EPSS–FIX 5.10.0 HIGH8.7PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)phpoffice/phpspreadsheetPackage2026-10-12 21:00 UTCby EPSS–FIX 5.10.0 HIGH8.8PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Servicephpoffice/phpspreadsheetPackage2026-10-12 20:49 UTCby EPSS–FIX 5.10.0 HIGH8.8PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Servicephpoffice/phpspreadsheetPackage2026-10-12 20:54 UTCby EPSS–FIX 5.10.0 MEDIUMINCIDENTSupabase: Log Drain IssuesSupabaseVendor2026-10-22 18:03 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Elevated error rates for Durable Objects in Western EuropeCloudflareVendor2026-10-22 17:51 UTCby status page–WHAT TO DO HIGHINCIDENTCloudflare: Delayed audit log delivery for WARP and Zero Trust servicesCloudflareVendor2026-10-22 17:32 UTCby status page–WHAT TO DO CRITICAL9.5PUBLIC EXPLOITEDK2 firmware: remote buffer overflow can lead to code executionedk27 talkingInfrastructure2026-10-22 14:34 UTCby InfraStack Analyst7talkingWHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-67597 was rejected and withdrawn by its numbering authorityOther2026-10-22 17:16 UTCby NVD–WHAT TO DO HIGH8.7OpenCATS: stored script injection via record names hijacks admin sessionsPackage2026-10-22 17:16 UTCby EPSS–WHAT TO DO MEDIUM6.3KNIME Business Hub: DataApp share links expose other users' jobsVendor2026-10-22 17:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOMEpylintPackage2026-09-23 05:17 UTCby EPSS–FIX 4.0.9 CRITICAL9.1better-auth: OAuth state can be used as a Magic Link to sign in as another userbetter-authPackage2026-09-30 21:31 UTCby EPSS–FIX 1.7.7 MEDIUM5.6draw.io Desktop: renderer can read arbitrary local files through IPCPackage2026-09-06 12:53 UTCby EPSS–WHAT TO DO HIGH7.5dnspython dns.name.from_wire_parser() excessive CPU usednspythonPackage2026-10-09 00:13 UTCby EPSS–FIX 2.9.0 HIGH8.6JetBackup WordPress plugin: crafted backup archive writes files outside restore folderPackage2026-10-22 17:16 UTCby EPSS–WHAT TO DO HIGHINCIDENTHashiCorp: GitHub and Other VCS workloads experiencing intermittent issuesHashiCorpVendor2026-10-22 17:15 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: Issue with 500 Errors on Porting Request SubmissionsTwilioVendor2026-10-22 17:10 UTCby status page–WHAT TO DO MEDIUMINCIDENTSupabase: Elevated Mgmt API Error Rates in Multiple RegionsSupabaseVendor2026-10-22 17:01 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Elevated errors for some requests in Ashburn, VirginiaCloudflareVendor2026-10-22 17:01 UTCby status page–WHAT TO DO HIGH8.1Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()pillowPackage2026-10-22 17:01 UTCby GitHub Advisories–FIX 13.0.0 CRITICALNOT SCOREDNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysnextPackage2026-10-22 16:42 UTCby GitHub Advisories–FIX 16.4.1 LOWINCIDENTTwilio: Issue with Realtime Transcriptions and DeepgramTwilioVendor2026-10-22 16:32 UTCby status page–WHAT TO DO HIGHINCIDENTCloudflare: Network Error Log Processing UnavailableCloudflareVendor2026-10-22 16:30 UTCby status page–WHAT TO DO HIGHNOT SCOREDGraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments@graphql-tools/utilsPackage2026-10-22 16:28 UTCby GitHub Advisories–FIX 12.0.2 HIGH7.5GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitgraphql-corePackage2026-08-27 20:46 UTCby GitHub Advisories–FIX 3.2.12 HIGH7.5GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rulegraphql-corePackage2026-08-27 20:45 UTCby GitHub Advisories–FIX 3.2.12 CRITICALNOT SCOREDDOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modesdompurifyPackage2026-10-22 16:25 UTCby GitHub Advisories–FIX 3.4.17 HIGHNOT SCOREDDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)dompurifyPackage2026-10-22 16:24 UTCby GitHub Advisories–FIX 3.4.17 LOWNOT SCOREDDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xmldompurifyPackage2026-10-22 16:24 UTCby GitHub Advisories–FIX 3.4.17 HIGHNOT SCOREDBlack: GitHub Action installs unvalidated required-version from pyproject.tomlblackPackage2026-10-22 16:18 UTCby GitHub Advisories–FIX 26.10.1 NOT SCOREDNOT SCOREDWebasyst Framework: crafted OAuth redirect_uri lets remote attacker run codeRuntime2026-10-22 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.9KNIME Business Hub: verbose catalog errors reveal workflow names to usersOther2026-10-22 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.3KNIME Business Hub: CSRF protection flaw lets attackers change resources silentlyOther2026-10-22 16:17 UTCby EPSS–WHAT TO DO HIGH7.5lsquic HTTP/3: unbounded buffered header sets exhaust server memoryPackage2026-10-22 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.3KNIME Business Hub: authenticated users can exhaust server resources via workflow editingOther2026-10-22 16:17 UTCby EPSS–WHAT TO DO HIGH7.1MarcosCamara01 Ecommerce Template: users can alter other users' carts and wishlistsOther2026-10-22 16:17 UTCby EPSS–WHAT TO DO HIGH7.1MarcosCamara01 Ecommerce Template: cart lets users pay less for expensive goodsMarcosCamara01/ecommerce-templateOther2026-10-22 16:17 UTCby InfraStack Analyst–FIX e6b364cd668f2ba875cfa7f6d55c63e771715df7 MEDIUM5.3OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiopentelemetry-apiPackage2026-10-12 03:14 UTCby GitHub Advisories–FIX 1.45.1 MEDIUMNOT SCOREDDevolutions Server: missing authorization lets users create PAM sub-providersOther2026-10-22 16:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDevolutions Server: token generation lets users reach denied hostsPackage2026-10-22 16:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDevolutions Server: user list API leaks every user's MFA secretOther2026-10-22 16:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: Intelligent Alerts Delivery IssuesTwilioVendor2026-10-22 16:01 UTCby status page–WHAT TO DO CRITICALNOT SCOREDNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usednextPackage2026-10-22 15:52 UTCby GitHub Advisories–FIX 15.5.28 HIGH8.2Next.js: Denial of Service in App Router using Server ActionsnextRuntime2026-10-14 17:47 UTCby GitHub Advisories–FIX 15.5.28 HIGH7.4PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgerypyjwtPackage2026-10-22 15:48 UTCby GitHub Advisories–FIX 2.14.0 MEDIUMINCIDENTCloudflare: Cloudflare Workers API LatencyCloudflareVendor2026-10-22 15:33 UTCby status page–WHAT TO DO CRITICAL9.8EXPLOITEDBrotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli packagebrotli20 talkingPackage2026-10-21 23:58 UTCby GitHub Advisories20talkingFIX 1.2.1 MEDIUMINCIDENTGitHub: Project updates delayedGitHubVendor2026-10-22 15:28 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDAiDot Linkind smart plug: SSDP header parsing overflow in firmware 1.01.32Infrastructure2026-10-22 15:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDSKYWORTH fiber router: remote attacker can obtain sensitive informationInfrastructure2026-10-22 15:17 UTCby EPSS–WHAT TO DO HIGH7.4OCO-Server: crafted hostname runs script in administrator sessionsPackage2026-07-23 07:46 UTCby EPSS–WHAT TO DO HIGH8.4CleanShot X for macOS: malicious project file runs code on openOther2026-10-22 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.5OCO-Server: Self-Service users can queue unauthorized software uninstall jobsPackage2026-09-29 08:18 UTCby EPSS–WHAT TO DO HIGH7.1Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document contentflexible-graphragAI agents & MCP2026-10-03 01:12 UTCby EPSS–FIX 0.8.2 HIGH7.5multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownmulterPackage2026-10-22 11:59 UTCby EPSS–FIX 2.5.0 HIGH7.5body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodybody-parserPackage2026-10-22 11:39 UTCby GitHub Advisories–FIX 2.4.0 MEDIUMINCIDENTTwilio: Hosted Number Verification Calls not Reaching CustomersTwilioVendor2026-10-22 14:56 UTCby status page–WHAT TO DO MEDIUMINCIDENTGitHub: Incident with Actions ResultsGitHubVendor2026-10-22 14:18 UTCby status page–WHAT TO DO HIGH7.5EmberZNet: malformed Price Matrix command enables out-of-bounds writeInfrastructure2026-10-22 14:17 UTCby EPSS–WHAT TO DO HIGH8.1rsyslog: dynaFile templates let untrusted input write logs outside intended directoryInfrastructure2026-08-20 11:02 UTCby EPSS–WHAT TO DO MEDIUM5.1Z-Wave SDK: malformed NCP SPI command leaks memory contentsInfrastructure2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Z-Wave SDK: missing checks let joined devices remove network nodesInfrastructure2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM6.0EmberZNet: malformed GetGroupMembership message crashes Zigbee device stackInfrastructure2026-10-22 14:17 UTCby EPSS–WHAT TO DO HIGH7.5EmberZNet: malformed Simple_Desc_req response enables out-of-bounds writeInfrastructure2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM6.0EmberZNet: malformed billing command causes endless recursion and device hangInfrastructure2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM6.0EmberZNet: malformed Discover Attributes command causes infinite loop on deviceInfrastructure2026-10-22 14:17 UTCby EPSS–WHAT TO DO HIGH7.2Connect SDK and Flex SDK: crafted message bypasses authentication, disrupts networkPackage2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.3crawlseo: SSRF lets authenticated users reach internal hosts and metadataPackage2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM6.7crawlseo: Google OAuth refresh tokens stored in plaintext in databasePackage2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Online clinic management system: appointment booking input validation flawPackage2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Online clinic management system: booking handler flaw lets remote users bypass workflowOther2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Online clinic management system stores patient and doctor passwords unencryptedPackage2026-10-22 14:17 UTCby EPSS–WHAT TO DO HIGH8.7Apache Abdera: XML external entities let attackers read files or make requestsApache AbderaPackage2026-10-22 14:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.2EXPLOITEDBroccoli2ShellHTTP2ShellBrotli: crafted compressed stream overflows buffer, enables remote code executionbrotli21 talkingPackage2026-10-21 23:58 UTCby InfraStack Analyst21talkingFIX 1.0.10 NOT SCOREDNOT SCOREDSystrome Validation & Certification: URL parameter causes denial of serviceOther2026-10-22 14:17 UTCby EPSS–WHAT TO DO MEDIUM4.0Online clinic management system: reflected XSS via patdocmsg.php Query argumentOther2026-10-22 13:17 UTCby EPSS–WHAT TO DO CRITICAL10.0PUBLIC EXPLOITYOOtheme Pro: unauthenticated image handler lets attackers upload and run PHPYOOtheme Pro2 talkingPackage2026-10-21by InfraStack Analyst2talkingFIX 5.0.53 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 1h1 (PyPI)1h1Package2026-10-22 13:03 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in aanthropic (PyPI)aanthropicPackage2026-10-22 13:02 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures from Twilio to Malitel MaliTwilioVendor2026-10-22 12:42 UTCby status page–WHAT TO DO HIGHINCIDENTSupabase: Elevated Mgmt API Error Rates in Multiple RegionsSupabaseVendor2026-10-22 11:29 UTCby status page–WHAT TO DO MEDIUM4.3Mattermost Playbooks: null import condition crashes plugin for all usersPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH7.6Lotus: authorization bypass lets any user join other organizationsOther2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.2Lotus: event ingestion accepts API key prefix alone, skipping secret checklotusOther2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Lotus: authenticated tenants can inject SQL via subscription filter keyslotusOther2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Lotus: SQL injection via billable metric values exposes all tenants' databaselotusPackage2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Lotus: stacked SQL in custom metrics reads or edits all tenants' datalotusOther2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.0Lotus: any tenant can read and modify other organizations' subscriptionsPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.8JSON-SCADA: SQL injection in opcApi lets users alter historian dataOther2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.0libyang: uninitialized pointer free in NETCONF parser allows crash or heap corruptionPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.4QloApps: customers can submit refunds for other customers' service linesPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.7Netmaker: network users can take over WireGuard clients on other networksnetmakerPackage2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.2mem0ai Databricks vector store vulnerable to SQL injectionmem0aiAI agents & MCP2026-10-22 11:17 UTCby InfraStack Analyst–FIX 1.0.8 HIGH7.3EverShop: missing authorization lets anyone change other customers' addressesPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Bytebase: task run logs readable across projects by UIDPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Bytebase: low-privilege users can overwrite comments in other projectsPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO LOW2.5fzf: quadratic string concatenation lets local requests stall its listen serverPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.5GNU patch: crafted patch file creates files outside the working directoryPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH7.1Goploy: symlink following lets members read arbitrary server filesPackage2026-06-01 02:59 UTCby EPSS–WHAT TO DO MEDIUM6.5Paid Member Subscriptions WordPress plugin: missing authorization check through 3.1.2Package2026-10-22 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Rootblox WordPress theme: PHP file inclusion lets attackers run server filesPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.5Workreap Core WordPress plugin: blind SQL injection exposes database contentsPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.1Academist Core WordPress plugin: PHP file inclusion lets attackers load local filesPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH7.1ACF Extended WordPress plugin: stored XSS through version 0.9.2.7Package2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH7.4Goose: terminal integration sends unredacted shell history to LLM providersAI agents & MCP2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.8Weaver E-cology: unauthenticated SQL injection leaks database contentsWeaver E-cologyOther2026-10-22 11:17 UTCby InfraStack Analyst–FIX 10.76 HIGH8.7EXPLOITEDYouDataSum CPAS audit system lets anyone read server filesCPAS Audit Management SystemOther2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1Retool: image proxy serves attacker SVG, runs script in user sessionsOther2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.8EXPLOITEDi-Netsolution Unilevel MLM ecommerce: SQL injection lets anonymous visitors read the databaseReadymade Unilevel Ecommerce MLMOther2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1WPML Multilingual CMS: reflected XSS via wp_lang on login pagePackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH7.1Penta WAPPLES web firewall: path traversal lets attackers download arbitrary server filesInfrastructure2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.7Kavita: path traversal lets anyone without login read server filesOther2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.8PHPOK: unauthenticated SQL injection in sort parameter leaks database dataPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.1EXPLOITEDYiShaAdmin: unauthenticated path traversal reads and deletes server filesYiShaAdminPackage2026-10-22 11:17 UTCby InfraStack Analyst–FIX commit 025b0628b1295bd2d9fd6c9b5b82692a345151ef HIGH8.8NotificationX WordPress plugin: unauthenticated SQL injection leaks database contentsPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.7EXPLOITEDOrbiTeam BSCW Server: unauthenticated path traversal reads local filesBSCW ServerPackage2026-10-22 11:17 UTCby InfraStack Analyst–FIX 5.2.5 CRITICAL9.8EXPLOITEDDedeCMS: crafted Referer header lets unauthenticated visitors run PHP codeDedeCMSOther2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7JeeWMS: unauthenticated path traversal lets attackers read arbitrary server filesOther2026-10-22 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.8EXPLOITEDFineReport: unauthenticated path traversal lets attackers write webshellsFineReportVendor2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7EXPLOITEDWeaver E-cology 8.0: unauthenticated path traversal reads arbitrary server filesE-cologyOther2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1Sickbeard: reflected XSS in testNaming page runs scripts in browsersOther2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.7WooThemes Diarise: unauthenticated file read exposes server files like /etc/passwdDiarisePackage2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8EXPLOITEDSeaCMS: unauthenticated SQL injection leaks database contents via error messagesSeaCMSPackage2026-10-22 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7MetInfo CMS: unauthenticated path traversal reads arbitrary server filesPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.7Group-Office: unauthenticated file read via compress.php path traversalPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Discourse: unsubscribe page reflects email parameter, runs script in browsersRuntime2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH7.7Broadstreet Ad Widget WordPress plugin: local file inclusion runs attacker-chosen PHPPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.1QCubed PHP framework: reflected XSS via installer step_2 parameterPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO HIGH8.7Javo Spot WordPress theme: unauthenticated file read exposes wp-config secretsPackage2026-10-22 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3webpack-dev-server: Host header check leaks stack traces and file pathsPackage2026-10-22 00:36 UTCby EPSS–WHAT TO DO HIGH8.2webpack-dev-server: proxied WebSockets skip Host and Origin checks, enabling cross-origin accessPackage2026-10-22 00:36 UTCby EPSS–WHAT TO DO MEDIUM6.3OpenVPN 3 Core: certificate checks can be bypassed, skipping key usage restrictionsPackage2026-10-22 10:17 UTCby EPSS–WHAT TO DO MEDIUM6.9WatchGuard Endpoint Security: macOS log leaks FileVault recovery keys locallyInfrastructure2026-10-22 09:17 UTCby EPSS–WHAT TO DO HIGH8.7esaml: crafted SAMLResponse exhausts memory and crashes Erlang VMesamlPackage2026-10-22 09:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.2esaml: unsigned logout requests can crash Erlang node via atom exhaustionPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO LOW2.2HCL AppScan Azure Boards Plugin: credentials sent in cleartext over HTTPOther2026-10-22 09:17 UTCby EPSS–WHAT TO DO LOW3.8HCL AppScan Azure Boards Plugin: secrets readable in plaintext during pipeline runsOther2026-10-22 09:17 UTCby EPSS–WHAT TO DO HIGH7.3WatchGuard Agent: log directory permissions let local users tamper with logsWatchGuard Agent (Windows)Other2026-10-22 09:17 UTCby InfraStack Analyst–FIX 1.25.14.0000 MEDIUM6.5Leaflet Map WordPress extension: stored XSS through input handlingPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.5ND Shortcodes For Visual Composer: stored XSS through web page generationPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Waitlist WooCommerce plugin: stored XSS through 2.9.1 in back-in-stock notifierPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Gloriafood Restaurant Menu plugin: stored XSS through versions up to 2.4.4Package2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3WooCommerce YooKassa plugin: missing authorization check through version 2.17.3Package2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.4myCred WordPress plugin: authorization bypass through user-controlled keyPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3miniOrange Page Restriction WordPress plugin: missing authorization check on access controlPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3WP Desk ShopMagic for WooCommerce: embedded sensitive data exposed in accessible filesPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress Off-Canvas Sidebars plugin: stored XSS through 0.5.9Package2026-10-22 09:17 UTCby EPSS–WHAT TO DO HIGH7.1Contact Form Email WordPress plugin: stored XSS through 1.3.68Package2026-10-22 09:17 UTCby EPSS–WHAT TO DO CRITICAL9.3WordPress Amelia booking plugin: SQL injection lets visitors read databaseameliabookingPackage2026-10-22 09:17 UTCby InfraStack Analyst–FIX 2.4.12 HIGH7.5WordPress ACF Extended: missing authorization check through version 0.9.2.7Runtime2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.5ACF Extended WordPress plugin: path traversal flaw through version 0.9.2.7Other2026-10-22 09:17 UTCby EPSS–WHAT TO DO HIGH8.8Profile Builder WordPress plugin: flaw lets users escalate their privilegesPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO CRITICAL9.8SureCart WordPress plugin: authentication bypass by spoofing up to 4.9.5Package2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Majestic Support WordPress plugin: missing authorization check exposes access controlsPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO HIGH7.6Royal Elementor Addons WordPress plugin: unsafe reflection allows code injectionPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3WordPress Sunshine Photo Cart: missing authorization check exposes restricted actionsPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO HIGH7.1WP Mailster: stored XSS through 1.9.1.0 lets injected scripts runPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.3Vaadin android-json: deep JSON nesting crashes the parsing thread with StackOverflowErrorPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3SureDash WordPress plugin: missing authorization check exposes access controlsPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3SureDash WordPress plugin: missing authorization check exposes access controlsPackage2026-10-22 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3mod_qos: off-by-one lets requests hide values from security rulesRuntime2026-10-22 07:16 UTCby EPSS–WHAT TO DO LOW3.7mod_qos: out-of-bounds read in response inspection lets remote crash Apache workersRuntime2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.9mod_qos: unauthenticated remote attacker crashes Apache web server processRuntime2026-10-22 07:16 UTCby EPSS–WHAT TO DO LOW3.7mod_qos: crafted JSON request crashes Apache worker processRuntime2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Elementor Addon Elements WordPress plugin: stored XSS through version 1.14.4Package2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3PowerPack Addons for Elementor: missing authorization check exposes protected actionsPackage2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Metform WordPress plugin: missing authorization check through version 4.3.2Package2026-10-22 07:16 UTCby EPSS–WHAT TO DO HIGH8.8Xpro Elementor Addons WordPress plugin: CSRF lets attackers act as adminsPackage2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.4eRoom Zoom Meetings plugin: missing authorization check exposes access controlsPackage2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5H5P: stored cross-site scripting through unsanitized input up to 1.17.9Package2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3WordPress Strong Testimonials plugin: missing authorization check through 3.3.14Package2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Falcon WordPress plugin: missing authorization lets unauthorized users change settingsPackage2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.4MarketKing WooCommerce plugin: missing authorization check exposes access controlPackage2026-10-22 07:16 UTCby EPSS–WHAT TO DO HIGH8.7esaml: crafted SAMLResponse exhausts Erlang atom table and crashes nodeesamlPackage2026-10-22 07:16 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDApache DataSketches C++: crafted Count-Min sketch corrupts heap memoryPackage2026-10-22 07:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTnpm: Degraded Publish, Install, and View PackagenpmVendor2026-10-22 06:43 UTCby status page–WHAT TO DO HIGH7.5WebP Express WordPress plugin: unescaped HTML attributes enable stored cross-site scriptingPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO LOW2.7MasterStudy LMS WordPress plugin lets instructors rename any userPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Link Library WordPress plugin: stored XSS through unescaped link preview fieldPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO MEDIUM4.9WordPress Core: display names let contributors plant scripts in admin screensRuntime2026-10-22 06:17 UTCby EPSS–WHAT TO DO MEDIUM4.9Photo Engine WordPress plugin lets authors delete any user's media attachmentsPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Photo Engine WordPress plugin: stored XSS via collection names in dashboardPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO HIGH7.5Royal MCP WordPress plugin: preview token grants full administrator accessPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO LOW2.7MB Custom Post Types WordPress plugin: export leaks non-public posts to contributorsPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO MEDIUM4.8WordPress MB Custom Post Types plugin: unauthenticated request reverts post type settingsPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO HIGH7.2PixelYourSite WordPress plugins: cookie value stored XSS via full-page cachePackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO LOW3.7Infility Global WordPress plugin: unauthenticated visitors can overwrite translation settingsPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO HIGH7.2HIPAA Forms WordPress plugin: missing capability check lets users escalate to adminPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO MEDIUM4.8WP Ultimate Review WordPress plugin: unescaped review fields run shortcodesPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO MEDIUM5.3FluentCart WordPress plugin lets anyone read stored customer addressesPackage2026-10-22 06:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in net-codec-testmetest (npm)net-codec-testmetestPackage2026-10-22 06:11 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in log-rotate-testmetest (npm)log-rotate-testmetestPackage2026-10-22 06:11 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in formatting-subtitles (npm)formatting-subtitlesPackage2026-10-22 06:11 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @conduitops/logview-archive (npm)@conduitops/logview-archivePackage2026-10-22 06:10 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in simplewave (npm)simplewavePackage2026-10-22 06:10 UTCby osv-malicious–UNINSTALL MEDIUM6.7NT OneAPP: plaintext usernames and passwords exposed in Android backup dataOther2026-10-22 05:16 UTCby EPSS–WHAT TO DO MEDIUM6.9NT OneAPP: Deep Link bypasses App PIN lock on AndroidOther2026-10-22 05:16 UTCby EPSS–WHAT TO DO HIGH7.4NT OneAPP: WebView credential disclosure leaks NUP Portal passcode to remote attackersNT OneAPPOther2026-10-22 05:16 UTCby InfraStack Analyst–FIX 1.5.35 CRITICAL9.3NT OneAPP: missing certificate checks let attackers intercept app trafficNT OneAPPOther2026-10-22 05:16 UTCby InfraStack Analyst–FIX 1.5.35 CRITICAL9.1NT OneAPP: hard-coded key lets attackers decrypt login credentialsNT OneAPPOther2026-10-22 05:16 UTCby InfraStack Analyst–FIX 1.5.35 MEDIUMINCIDENTTwilio: RCS Inbound Events DelayedTwilioVendor2026-10-22 04:30 UTCby status page–WHAT TO DO HIGHINCIDENTSupabase: Project lifecycle operation errors in the EU regionSupabaseVendor2026-10-22 03:53 UTCby status page–WHAT TO DO MEDIUMINCIDENTAnthropic: Elevated errors affecting ConnectorsAnthropicVendor2026-10-22 03:50 UTCby status page–WHAT TO DO MEDIUM6.8Roundcube Webmail: alias login can resolve to a user on another IMAP hostPackage2026-10-22 03:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Roundcube Webmail: CSS proxy reads unlimited remote stylesheets, exhausting server memoryPackage2026-10-22 03:16 UTCby EPSS–WHAT TO DO HIGH7.2Roundcube Webmail: SSRF filter bypass via NAT64 IPv6 addresses reaches internal hostsOther2026-10-22 03:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Roundcube Webmail: SVG animation attribute bypasses remote content blockingPackage2026-10-22 03:16 UTCby EPSS–WHAT TO DO HIGH7.5HAProxy 3: crafted chunked request pins worker threads at 100% CPUInfrastructure2026-10-22 03:16 UTCby EPSS–WHAT TO DO HIGH7.5HAProxy: truncated HTTP/2 PING frame spins worker threads, causing denial of serviceRuntime2026-10-22 03:16 UTCby EPSS–WHAT TO DO HIGHINCIDENTnpm: Degraded Package Install and PublishingnpmVendor2026-10-22 02:33 UTCby status page–WHAT TO DO MEDIUMINCIDENTOpenAI: Elevated ChatGPT conversation and Responses API errorsOpenAIVendor2026-10-22 02:18 UTCby status page–WHAT TO DO MEDIUM4.3Drupal Webform: incorrect authorization lets users browse forbidden pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.5Drupal AI CKEditor: template engine flaw allows code injection up to 1.4.3Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDrupal Webform REST: missing authorization lets users browse forbidden dataPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Drupal Editoria11y Accessibility Checker: privilege escalation through unsafe permission actionsPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal Tawk.to live chat module: CSRF lets attackers act as adminsPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.8Drupal Stop administrator login module: authentication bypass via alternate pathOther2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal Smart Content: missing access check lets visitors browse restricted contentPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal REST & JSON API Authentication: authentication bypass via alternate channelPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.5Drupal Mermaid Diagram Field: forceful browsing exposes content without authorizationPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Diba carousel slider: stored XSS through input handling up to 3.0.2Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal CSS Usage Analyzer: missing authorization lets users browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal CookieCuttr: stored XSS lets attackers inject scripts into pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Drupal Commerce Decoupled Checkout: object injection flaw in versions 1.0.0 to 1.8.0Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Combined Image Style module: excessive resource allocation enables denial of servicePackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.4Drupal Cloud: OS command injection in versions up to 7.0.1Runtime2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Drupal Cloud: improper certificate validation lets attackers intercept trafficVendor2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.2Drupal Project Browser: CSRF flaw lets attackers trigger unwanted admin actionsPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.3Drupal Webform: incorrect authorization lets users browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal Webform: weak access control lets users browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal Webform: unsafe privilege actions let stored script injectionPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal Webform: incorrect authorization allows server-side request forgeryPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.1Drupal Webform: sensitive data cached in browser exposes submissions to othersPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Webform: stored cross-site scripting via form inputPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Webform: privilege flaw lets users plant stored XSSPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Webform: incorrect authorization lets users browse forbidden pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO HIGH7.5Drupal Webform: excessive resource allocation lets requests exhaust server memoryPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Webform: missing rate limit lets attackers misuse form functionalityPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDrupal Webform: privilege misconfiguration lets users plant stored XSSPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.2Drupal Webform: cross-site scripting flaw in web page outputPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Webform: cross-site scripting flaw lets input run scripts in pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.5Drupal Webform: cross-site scripting flaw in form pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Webform: cross-site scripting flaw in page generationPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Webform: input handling flaw allows cross-site scripting in pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Webform: stored cross-site scripting in web page outputPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Webform: incorrect authorization lets users browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO CRITICAL9.1Drupal Webform: template engine flaw lets attackers inject and run codePackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Drupal Ultimate Table Field: missing access check allows forceful browsingPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Drupal Taxonomy Term Glossary: missing authorization lets users browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.3Drupal SAML SSO Service Provider: server-side request forgery through versions 3.2.0Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.1Drupal SAML SSO Service Provider: capture-replay lets stolen logins authenticatePackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.8Drupal SAML SSO Service Provider: stored sensitive data retrievable from embedded storagePackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal SAML SSO Service Provider: hard-coded credentials expose embedded secretsPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.3Drupal SAML SSO Service Provider: cross-site scripting via unsanitized inputPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.5Drupal SAML SSO Service Provider: cross-site scripting via input handlingPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Drupal SAML SSO Service Provider: signature checks can be spoofedPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Drupal SAML SSO: timing difference lets attackers brute force loginsPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal SAML SSO Service Provider: open redirect enables fake data sourcePackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Drupal SAML SSO Service Provider: improper certificate validation enables man-in-the-middlePackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal SAML SSO module: missing authorization lets users force pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal SafeDelete: stored cross-site scripting in versions up to 1.0.88Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal Patreon module: unspecified flaw in version 7.xPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal Key auth: sensitive data cached in browser, exposed by access control misconfigurationRuntime2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.2Drupal Feed Block: stored XSS in feed renderingOther2026-10-22 02:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDrupal CSP log module: SQL injection via unsanitized inputPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal CAS Server: open redirect lets attackers send users to untrusted sitesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal amazee.ai Private AI Provider: SQL injection in versions up to 1.4.3Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal Email Verification module: reflected XSS in versions up to 2.4.0Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal Email/SMS/OTP Verification: authentication bypass via alternate channelPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Webform Submissions Delete: missing access check lets users delete submissionsPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Unpublished Node Permissions: incorrect authorization lets users browse unpublished contentPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal PhotoSwipe gallery module: stored XSS through unsanitized inputPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.7Drupal Monobank payment API: signature verification flaw allows spoofed signaturesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Drupal JSON:API Role Access: incorrect authorization lets users browse restricted contentPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.7Drupal Islandora: missing authorization lets users forcibly browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal Component blocks: stored XSS in versions up to 1.2.7Other2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Drupal Calculate Working Days: missing access check exposes pages to forced browsingPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal AI Translate: missing authorization lets users force-browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Drupal AI module: missing authorization lets users browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.1Drupal AI module: stored XSS lets input run scripts in pagesAI agents & MCP2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.2Drupal Advanced Search: missing access check lets users browse restricted pagesPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Drupal Media Library Importer: path traversal through versions up to 2.1.6Package2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.8Drupal Mailer Plus Log: sensitive data written to log fileOther2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Roundcube Webmail: CSS escapes bypass remote content blocking in HTML mailPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO HIGH8.3Roundcube Webmail: contact photo upload passes SVG and EPS into ImageMagickPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.8Roundcube Webmail: bounce action lets crafted sender names inject mail headersPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM5.0Roundcube Webmail: header injection lets logged-in users add mail headersPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO HIGH7.4Roundcube Webmail: session parsing flaw enables PHP object injectionPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.7Roundcube Webmail: image thumbnail fallback skips memory limit, exhausting server memoryPackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Roundcube Webmail: crafted HTML email restyles the whole interfacePackage2026-10-22 02:17 UTCby EPSS–WHAT TO DO LOW3.1Roundcube Webmail: deprecated action aliases bypass disabled_actions settingPackage2026-10-22 02:16 UTCby EPSS–WHAT TO DO HIGH7.1Roundcube Webmail: CRLF in mark action lets attackers run IMAP commandsPackage2026-10-22 02:16 UTCby EPSS–WHAT TO DO LOW3.7Roundcube Webmail: CSRF bypass lets forged requests mark mail as junkPackage2026-10-22 02:16 UTCby EPSS–WHAT TO DO MEDIUM4.7Roundcube Webmail: password plugin error text lets script run in webmailPackage2026-10-22 02:16 UTCby EPSS–WHAT TO DO MEDIUM4.0Roundcube Webmail: forwarded-as-attachment subject lets mail headers be injectedPackage2026-10-22 02:16 UTCby EPSS–WHAT TO DO HIGH8.5Roundcube Webmail: crafted inline image lets attackers inject mail headersPackage2026-10-22 02:16 UTCby EPSS–WHAT TO DO MEDIUM6.8Roundcube: password plugin's Modoboa driver can change another account's passwordPackage2026-10-22 02:16 UTCby EPSS–WHAT TO DO HIGH7.1Frappe Framework: blind SQL injection in event listing lets logged-in users read databaseRuntime2026-10-07 14:28 UTCby EPSS–WHAT TO DO HIGH8.6Vyper compiler: imported constants resolve to wrong variable, corrupting contract logicvyperPackage2026-10-07 11:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Obot: CLI login flaw lets attackers steal non-expiring API keysRuntime2026-10-06 23:53 UTCby EPSS–WHAT TO DO CRITICAL9.0OpenRemote: any logged-in user can open network tunnels into edge gatewaysopenremoteOther2026-10-07 08:35 UTCby InfraStack Analyst–FIX 1.31.0 HIGH7.0Grav CMS: page frontmatter lets authors delete protected pagesRuntime2026-10-07 03:04 UTCby EPSS–WHAT TO DO HIGH7.1Grav Flex Objects plugin lets low-privilege users bypass page permissionsPackage2026-10-07 03:04 UTCby EPSS–WHAT TO DO HIGH8.8Grav Login plugin: invite task lets page authors create super usersPackage2026-10-07 03:04 UTCby EPSS–WHAT TO DO MEDIUM6.9Grav CMS: page authors can capture visitors' HTTP Basic credentialsRuntime2026-10-07 03:04 UTCby EPSS–WHAT TO DO HIGH7.5Traefik: negated Host rules let clients skip client-certificate checksInfrastructure2026-10-07 08:47 UTCby EPSS–WHAT TO DO HIGH8.7Traefik: NTLM backend slot reuses TLS settings across servicestraefikRuntime2026-10-07 08:47 UTCby InfraStack Analyst–FIX 2.11.58 MEDIUM6.3Traefik: race in NTLM and Kerberos backend auth lets remote requests crash itRuntime2026-10-07 08:47 UTCby EPSS–WHAT TO DO HIGH8.7Traefik: forged client certificate headers bypass mTLS authentication on HTTPRuntime2026-10-07 08:47 UTCby EPSS–WHAT TO DO HIGH8.7Traefik: shared backend connection pool lets attackers reuse authenticated socketstraefikInfrastructure2026-10-07 08:47 UTCby InfraStack Analyst–FIX 2.11.58 HIGH8.7Traefik: Kubernetes Ingress NGINX client CA merge lets other CA certificates inRuntime2026-10-07 08:47 UTCby EPSS–WHAT TO DO HIGH8.7Traefik: experimental FastProxy lets unauthenticated clients reach victim sessionstraefikInfrastructure2026-10-07 08:47 UTCby InfraStack Analyst–FIX 3.7.14 HIGH8.7Traefik: Kubernetes Ingress NGINX provider skips access controls on HTTPRuntime2026-10-07 08:47 UTCby EPSS–WHAT TO DO HIGH8.7Traefik: TLS SNI check skipped, bypasses client certificate requirement on routerstraefikRuntime2026-10-07 08:47 UTCby InfraStack Analyst–FIX 2.11.58 MEDIUM5.3WWBN AVideo: redirect flaw lets uploaders make server send internal requestsPackage2026-10-07 13:40 UTCby EPSS–WHAT TO DO HIGH7.0WWBN AVideo: delegated user admins can delete or demote administratorsRuntime2026-10-07 14:04 UTCby EPSS–WHAT TO DO HIGH7.5php-travel-agency-system: SQL injection in admin insert handler lets attackers read or alter dataOther2026-10-22 02:16 UTCby EPSS–WHAT TO DO LOW3.7Linksys RE6250 range extender: weak web session IDs allow session guessingInfrastructure2026-10-22 02:16 UTCby EPSS–WHAT TO DO LOWINCIDENTTwilio: Billing DelaysTwilioVendor2026-10-22 01:29 UTCby status page–WHAT TO DO MEDIUM5.9GitLab EE: stale requests bypass SAML or LDAP membership lockPackage2026-10-22 01:16 UTCby EPSS–WHAT TO DO HIGH8.2PUBLIC EXPLOITGitLab CE/EE: SAML and LDAP auto-linking lets users take over LDAP accountsInfrastructure2026-10-22 01:16 UTCby EPSS–WHAT TO DO LOW3.1GitLab EE: authenticated users can bypass merge request approval policyVendor2026-10-22 01:16 UTCby EPSS–WHAT TO DO MEDIUM4.3GitLab: authenticated users can read private project milestone metadataOther2026-10-22 01:16 UTCby EPSS–WHAT TO DO MEDIUM6.8GitLab: read_api token can bypass scope and create work itemsVendor2026-10-22 01:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Roundcube: login name path traversal reads files outside data directoryPackage2026-10-22 01:16 UTCby EPSS–WHAT TO DO CRITICAL10.0TOTOLINK A950RG router: FileMd5 argument allows remote command injectionA950RG firmwareInfrastructure2026-10-22 01:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.0massCode: local HTTP service leaks information to remote attackersOther2026-10-22 01:16 UTCby EPSS–WHAT TO DO MEDIUM4.3GitLab EE: authenticated users reach paid AI features without subscriptionVendor2026-10-22 01:16 UTCby EPSS–WHAT TO DO LOW3.1GitLab EE: read-only users can permanently delete vulnerability recordsRuntime2026-10-22 01:16 UTCby EPSS–WHAT TO DO HIGH7.5GitLab: poisoned OAuth discovery cache can redirect login flows externallyRuntime2026-10-22 01:16 UTCby EPSS–WHAT TO DO CRITICAL10.0PUBLIC EXPLOITGitLab: crafted regular expression lets unauthenticated users run code on server2 talkingRuntime2026-10-22 01:16 UTCby EPSS2talkingWHAT TO DO MEDIUM4.3GitLab CE/EE: unauthenticated users could retrieve internal server credentials via headersPackage2026-10-22 01:16 UTCby EPSS–WHAT TO DO LOW3.5GitLab CE/EE: cached merge request previews leaked confidential issue titlesInfrastructure2026-10-22 01:16 UTCby EPSS–WHAT TO DO LOW2.7GitLab EE: group owner re-enables locked AI data egress to third partyInfrastructure2026-10-22 01:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to MTN NigeriaTwilioVendor2026-10-22 01:15 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in acoustichub (PyPI)acoustichubPackage2026-10-22 00:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in phonemeprobe (PyPI)phonemeprobePackage2026-10-22 00:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ttsflow (PyPI)ttsflowPackage2026-10-22 00:57 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in evalstream (PyPI)evalstreamPackage2026-10-22 00:57 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in speakbench (PyPI)speakbenchPackage2026-10-22 00:56 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in audiokit (PyPI)audiokitPackage2026-10-22 00:56 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in phonemeforge (PyPI)phonemeforgePackage2026-10-22 00:56 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vocabbench (PyPI)vocabbenchPackage2026-10-22 00:55 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in asrloom (PyPI)asrloomPackage2026-10-22 00:55 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in benchworks (PyPI)benchworksPackage2026-10-22 00:54 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in benchbridge (PyPI)benchbridgePackage2026-10-22 00:46 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in speechprobe (PyPI)speechprobePackage2026-10-22 00:45 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in soundsocket (PyPI)soundsocketPackage2026-10-22 00:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in modelworks (PyPI)modelworksPackage2026-10-22 00:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vocabblend (PyPI)vocabblendPackage2026-10-22 00:34 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in voicekit (PyPI)voicekitPackage2026-10-22 00:33 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ttsweaver (PyPI)ttsweaverPackage2026-10-22 00:33 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ttsprobe (PyPI)ttsprobePackage2026-10-22 00:31 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ttsdock (PyPI)ttsdockPackage2026-10-22 00:30 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in voxweaver (PyPI)voxweaverPackage2026-10-22 00:30 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in speaksocket (PyPI)speaksocketPackage2026-10-22 00:29 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in asrdock (PyPI)asrdockPackage2026-10-22 00:28 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTCloudflare: Network congestion in Portland and Seattle, USCloudflareVendor2026-10-22 00:23 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in pipegrip (PyPI)pipegripPackage2026-10-22 00:22 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in hookgantry (PyPI)hookgantryPackage2026-10-22 00:21 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in acousticpack (PyPI)acousticpackPackage2026-10-22 00:20 UTCby osv-malicious–UNINSTALL HIGH7.7Amazon Athena: authorization flaw exposed other accounts' metadata to usersVendor2026-10-22by EPSS–WHAT TO DO HIGH8.4AWS SAM CLI: Terraform hook lets crafted config run commands during buildsPackage2026-10-22by EPSS–WHAT TO DO MEDIUMNOT SCOREDCVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqttPackage2026-10-22by Vendor & lab pages–WHAT TO DO HIGHNOT SCOREDCVE-2026-115414 - OS Command Injection Issue in SAM CLI Terraform HookPackage2026-10-22by Vendor & lab pages–WHAT TO DO HIGH8.2AWS aws-c-mqtt: oversized allocation in MQTT 3.1.1 adapter lets remote peer crash clientPackage2026-10-22by EPSS–WHAT TO DO HIGH8.6Strands Agents SDK: Exposure of data element to wrong session in the A2A Serverstrands-agentsAI agents & MCP2026-10-22by GitHub Advisories–FIX 1.43.0

Wednesday, Oct 21Thursday, Oct 22Friday, Oct 23