CVEs published in October 2026

CVE-2026-120135High

Apache Thrift: Java TProtocolUtil.skip does not limit the recursion depth by default

CVE-2026-118636Critical

Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

CVE-2026-73322Medium

Information disclosure via lookup transform function

CVE-2026-64618Critical

Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0)

CVE-2026-65874High

Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints

CVE-2026-91484High

CVE-2026-91385High

CVE-2026-46470High

CVE-2026-46137Medium

Linux Kernel Vulnerability in NetApp Products

CVE-2026-31448Critical

Linux Kernel Vulnerability in NetApp Products

CVE-2025-21796Medium

Linux Kernel Vulnerability in NetApp Products

CVE-2026-119251Medium

Ubiquiti: malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device

CVE-2026-119250High

Ubiquiti: malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device

CVE-2026-119249High

Ubiquiti: malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device

CVE-2026-71569Medium

Server-Side Request Forgery via inconsistent address validation

CVE-2026-115942Medium

Denial of Service via misconfigured wildcard TLS certificate

CVE-2026-114230High

Authentication bypass via misidentified AMQP frames

CVE-2026-105042High

Denial of Service via stack overflow in pn_message_body

CVE-2026-105031High

improper certificate validation via retention of default system trust anchors

CVE-2025-62841High

Hybrid Backup Sync: use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync.

CVE-2025-62839High

Hybrid Backup Sync: use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync.

CVE-2026-107239High

CVE-2026-107238High

CVE-2023-22793High

CVE-2026-118633Critical

path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled

CVE-2026-116273High

Denial of Service via memory exhaustion from excessive message parts

CVE-2026-116272Medium

Security filter bypass via nested comments in boundary parameters

CVE-2026-116271Medium

Arbitrary file overwrite via symbolic link following

CVE-2026-116270High

Denial of Service via memory exhaustion from crafted MIME headers

CVE-2026-116269Medium

Attachment filter bypass via improper filename decoding

CVE-2026-116268Medium

Denial of Service via unclosed comments in header parameters

CVE-2026-116267High

Denial of Service via memory exhaustion from deeply nested messages

CVE-2026-116266Medium

Security filter bypass via partially encoded multipart boundary

CVE-2026-116265Medium

Security filter bypass via ambiguous multipart boundary continuations

CVE-2026-116264Medium

Security filter bypass via invalid Content-Type parameter

CVE-2026-100105High

Information disclosure via legacy schema switch in contact points

CVE-2026-114349Medium

Denial of Service via excessive memory allocation during record decompression

CVE-2026-112375Medium

Information disclosure via unauthorized broker configuration validation

CVE-2026-116593High

Information disclosure via configuration validation endpoint

CVE-2026-115644Medium

Authentication bypass via separate admin listener

CVE-2026-111551High

Denial of Service via memory exhaustion during deserialization

CVE-2026-111496Medium

Denial of Service via integer overflow in timestamp calculation

CVE-2026-111115High

Denial of Service via uncontrolled memory allocation in flexible request headers

CVE-2026-111108High

Apache kafka: Denial of Service via excessive memory allocation during request parsing

CVE-2026-111073Medium

Denial of Service via unbounded telemetry payload decompression

CVE-2026-106079High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration

CVE-2026-110985High

Authentication bypass via missing JWT signature verification

CVE-2026-103411High

Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply

CVE-2026-110952Unrated

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

CVE-2026-83525Medium

Denial of Service via crafted FetchSnapshot request

CVE-2026-103410High

Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate

CVE-2026-103409Critical

Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root

CVE-2026-103408High

Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply

CVE-2026-103407High

Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API

CVE-2026-103406Critical

Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID

CVE-2026-103405Medium

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the web server in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to inject arbitrary HTTP headers via unsanitized request body parameters

CVE-2026-103404Medium

Incorrect Permission Assignment for Critical Resource vulnerability in RoutingManager in Juniper Networks Session Smart Conductor allows a local user to access sensitive routing credentials via triggering processes that write to the /tmp directory

CVE-2026-103403High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule

CVE-2026-103402High

Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files

CVE-2026-103401High

Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints

CVE-2026-103400Medium

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the ember service in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with local access to unmount arbitrary filesystems or cause a denial of service via the creation of specially named directories and a service restart

CVE-2026-103394Low

Improper Initialization vulnerability in the SSR software in Juniper Networks Session Smart Router allows an attacker to decrypt traffic or cause a denial of service via security policy assignment

CVE-2026-103393Medium

Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networks Session Smart Router allows an L2-adjacent attacker to read stale memory contents or cause a system fault via a specially crafted VRRPv3 advertisement

CVE-2026-103392Medium

Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Networks Session Smart Router allows an attacker to corrupt TCP payload data and potentially cause session desynchronization via a transit TCP packet with an oversized SACK option length

CVE-2026-103391Medium

Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length

CVE-2026-103390Medium

Out-of-Bounds Read vulnerability in the HttpParser component in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to cause a denial of service via a specially crafted HTTP request

CVE-2026-76506High

Cisco UCS Central Software Remote Code Execution Vulnerability

CVE-2026-76419Medium

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

CVE-2026-76418HighCISA KEV

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

CVE-2026-20241Medium

Cisco Identity Services Engine Authorization Bypass Vulnerability

CVE-2026-88967High

Grafana Vulnerability in NetApp Products

CVE-2026-65634High

Erlang/OTP Vulnerability in NetApp Products

CVE-2026-103506High

SSO secrets readable by low-privileged users when an experimental feature is enabled

CVE-2026-101737Medium

Java SE Vulnerability in NetApp Products

CVE-2026-97045High

Cross-Site Scripting via improper namespace handling during HTML rendering

CVE-2026-78661High

Denial of Service via crafted HTML input

CVE-2026-115495Medium

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password

CVE-2026-90465High

Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation

CVE-2026-93862High

Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service

CVE-2026-112709Critical

Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

CVE-2026-90464High

external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command

CVE-2026-103593Critical

Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution

CVE-2026-113881Medium

Fireware OS Stack Buffer Overflow in VPN Network Access Enforcement Allows Unprivileged Code Execution

CVE-2026-93434High

XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request

CVE-2026-90442High

Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service

CVE-2026-112710Critical

Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution

CVE-2026-82332Medium

improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification

CVE-2026-93857Critical

Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution

CVE-2026-93866Critical

integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled

CVE-2026-93864High

link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update

CVE-2026-103594Critical

stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload

CVE-2026-104381Medium

Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service

CVE-2026-111107High

NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request

CVE-2026-93865Critical

Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection

CVE-2026-114409Medium

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction

CVE-2026-116839High

malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device

CVE-2026-116838High

malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device

CVE-2026-116837High

malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device

CVE-2026-116836High

malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device

CVE-2026-22063Medium

eMudhra CA Certificate Compromise in NetApp Products