CVEs published in October 2026

CVE-2026-93546High

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces

CVE-2026-79768Medium

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68

CVE-2026-73637High

Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0

CVE-2026-73636High

Authentication bypass via credential replay in mod_auth_digest

CVE-2026-63718High

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding

CVE-2026-63292High

Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default

CVE-2026-63045High

unauthorized connection to arbitrary hosts via crafted FTP PASV response

CVE-2026-59797Critical

mod_ssl SSLRequire allows.htaccess ap_expr file-function

CVE-2026-59685High

Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded

CVE-2026-13043Critical

missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory

CVE-2026-58415Medium

Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the.DAV state directory This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68

CVE-2026-57941Critical

mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy

CVE-2026-56449High

Denial of Service via crafted HTTP response bodies in mod_proxy_html

CVE-2026-56154Critical

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68

CVE-2026-56153High

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite

CVE-2026-48005High

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck

CVE-2026-47360High

Information disclosure via session cookie leakage during internal redirects

CVE-2026-46729High

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener

CVE-2026-42356Low

arbitrary code execution via incorrect handler assignment during internal CGI redirects

CVE-2026-42528Medium

memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes

CVE-2026-97258Medium

WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability

CVE-2026-94276Medium

Improper Authentication vulnerability in Apache APISIX

CVE-2026-94269Medium

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX

CVE-2026-94250High

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX

CVE-2026-94220Low

Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX

CVE-2026-94212Medium

Improper verification of cryptographic signature vulnerability in Apache APISIX

CVE-2026-82806Medium

Exposure of data element to wrong session vulnerability in Apache APISIX

CVE-2026-78242Medium

Insertion of sensitive information into log file vulnerability in Apache APISIX

CVE-2026-88789High

Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or issue requests to internal network locations via an external entity declaration in that document

CVE-2026-104286CriticalCISA KEV

Fortinet FortiMail Path Traversal Vulnerability