CVEs published in October 2026

CVE-2026-79848Critical

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

CVE-2026-79847Critical

Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10

CVE-2026-79846Critical

Unauthenticated Command Injection Vulnerabilities in AOS-8

CVE-2026-79844Critical

Authentication Bypass Leading to Remote Code Execution in AOS-10

CVE-2026-97631Critical

Pre-boot RCE in EDK II PXE driver

CVE-2026-111497CriticalCISA KEV

Google Brotli Unchecked Return Value Vulnerability

CVE-2026-113582High

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera

CVE-2026-115253High

incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated non-administrative user to create, modify, append to, or delete the agent's log files and write other files into the directory

CVE-2026-96293Medium

cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users

CVE-2026-103634Medium

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)

CVE-2026-110264Critical

issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression

CVE-2026-12664Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with a read_api-scoped token to retrieve a project's incoming email address and create work items, bypassing the token's restrictions, due to insufficient scope enforcement on a GraphQL field

CVE-2026-13319Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project paths, from arbitrary private projects across the instance without any project membership, due to missing authorization checks on a user-supplied project filter parameter in the group milestones API

CVE-2026-14288Low

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access control during approval rule synchronization

CVE-2026-15723High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking

CVE-2026-16255Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled

CVE-2026-103515Low

GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo availability, an authenticated user with group Owner permissions could have re-enabled AI-backed data egress to a third-party service for that group and its descendant projects, due to insufficient granularity of the admin-lock enforcement controls

CVE-2026-105711Low

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when a merge request in a public project referenced a confidential issue from a private project, an authenticated user with no project membership could have read the confidential issue's title, due to a viewer-independent fragment cache key that incorrectly shared per-user-redacted rendered content across all users

CVE-2026-105777Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers

CVE-2026-112378Medium

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated user to access paid AI features without a valid subscription due to insufficient server-side validation in billing eligibility checks

CVE-2026-112212High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses

CVE-2026-112326Low

GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an authenticated user with read-only permissions to permanently delete existing vulnerability records due to improper cleanup logic that failed to distinguish between pre-existing records from newly created ones during error handling

CVE-2026-76531Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76530High

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76529Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76528Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76527Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76526High

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76408Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76407Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76406Medium

In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted credential data from an affected Splunk SOAR instance could submit Basic authentication data to the Representational State Transfer (REST) API to expose and decrypt that encrypted credential data

CVE-2026-76308Medium

Splunk Enterprise: In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change

CVE-2026-76307High

In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users

CVE-2026-76306High

In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users

CVE-2026-76305Medium

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app

CVE-2026-76304Medium

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file

CVE-2026-76303Medium

In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk SOAR displays in app documentation by installing an app

CVE-2026-76302Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76301Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76300High

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76299Critical

Splunk: As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review

CVE-2026-76298High

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster members

CVE-2026-76297Medium

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the edit_federated_providers capability into turning off all federated search providers

CVE-2026-76296Medium

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access

CVE-2026-76295Medium

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does not hold the "admin" or "power" Splunk roles could view dashboard and report listings beyond the requested filter scope while remaining within objects that the user can access

CVE-2026-76294Medium

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field extractions or field transformations to apps for which the user does not have read access

CVE-2026-76293High

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the Splunk Web Manager page

CVE-2026-76292Medium

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints

CVE-2026-76291High

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow

CVE-2026-76290High

In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download endpoint in the Splunk Pipeline Builders app

CVE-2026-76289Medium

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer (REST) API endpoint for lookup table files

CVE-2026-76288High

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests

CVE-2026-76287Medium

In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope

CVE-2026-91403Critical

Distrust eMudhra intermediate CA certificates due to security concerns

CVE-2026-112381High

Denial of Service via race condition during request teardown

CVE-2026-111817Medium

Denial of Service via dropped chunked trailers

CVE-2026-111812High

origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

CVE-2026-111811Critical

tsmemcache plugin exposes the shared proxy cache over the network with no authentication

CVE-2026-111809Medium

HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling

CVE-2026-111810High

Denial of Service via unthrottled logging of stripped headers

CVE-2026-111815High

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy

CVE-2026-111814High

Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin

CVE-2026-111808High

Denial of Service via malformed padded HTTP/2 DATA frame

CVE-2026-111805High

Denial of Service via truncated HTTP/2 Content-Length header

CVE-2026-111816Critical

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path

CVE-2025-55702High

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request

CVE-2025-31699Critical

Origin connection still owed a request body is reused, enabling request smuggling

CVE-2026-111804High

Denial of Service via use-after-free in WASM plugin

CVE-2026-111813Critical

magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

CVE-2026-105945High

Unauthorized cross-tenant package manipulation via path traversal

CVE-2026-105944Critical

Apache Pulsar Manager is a web console for administering Apache Pulsar clusters

CVE-2026-105942High

Apache Pulsar: When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions

CVE-2026-105938Low

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles

CVE-2026-105937High

Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger

CVE-2026-105936Medium

Apache Pulsar: The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors)

CVE-2026-105935Medium

org.apache.pulsar/pulsar-functions-worker: pulsar-functions-worker: Unauthorized message publication via missing topic authorization check

CVE-2026-105934High

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate)

CVE-2026-105933Low

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy

CVE-2026-105932Low

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic

CVE-2026-105931Low

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions

CVE-2026-105930Medium

org.apache.pulsar/pulsar-functions-worker: Apache Pulsar: Information disclosure via improper package authorization in Functions worker

CVE-2026-105927Medium

Unauthorized message injection via missing dead letter topic permission check

CVE-2026-105926Medium

Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands

CVE-2026-105869Critical

Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

CVE-2026-90484Medium

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet

CVE-2026-87849Medium

The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects

CVE-2026-86249Unrated

Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

CVE-2026-86147Unrated

Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof

CVE-2026-86146Unrated

Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing

CVE-2026-84748Unrated

Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration

CVE-2026-84747Unrated

Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments

CVE-2026-84727Medium

Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message

CVE-2026-82953Medium

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command

CVE-2026-82942Unrated

Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service

CVE-2026-82425Unrated

Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service

CVE-2026-82231Unrated

Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client

CVE-2026-82230High

Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data

CVE-2026-82210Unrated

Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames

CVE-2026-81755Unrated

Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request

CVE-2026-80463Unrated

Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly