CVEs published in October 2026

CVE-2026-68498High

DoS (Denial of Service) tools.jackson.core:jackson-core Dependency in Crowd Data Center

CVE-2026-108743Unrated

Apache Kylin: spark job OS command injection

CVE-2026-108709Unrated

Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

CVE-2026-69080Unrated

Apache Kylin: Broken Access Control in QuerySQLBlacklistController

CVE-2026-69077Unrated

Apache Kylin: JobController allows unauthorized cross-project manipulation

CVE-2026-69076Unrated

Apache Kylin: Unauthorized cross-project job discard

CVE-2026-68573Unrated

Apache Kylin: Unauthenticated Metastore Cleanup

CVE-2026-68572Unrated

Apache Kylin: Unauthorized SQL execution to Spark SQL env

CVE-2026-85746Critical

Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections

CVE-2026-92262Critical

Numerous issues caused by historical #mysql50# tablename encoding bypass.

CVE-2026-68571Unrated

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin

CVE-2026-64959Unrated

Apache Kylin: Missing authentication on certain cache API endpoints

CVE-2026-64610Unrated

Apache Kylin: Redis unsafe Java deserialization

CVE-2026-63619Unrated

Apache Kylin: Missing authorization and path-confinement on system meta dump

CVE-2026-63618High

Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin

CVE-2025-24070High

ASP.NET Core Vulnerability in NetApp Products

CVE-2026-96806Medium

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in

CVE-2026-94135Critical

CVE-2026-94134Critical

CVE-2026-92228Medium

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs

CVE-2026-108452High

Microsoft Office SharePoint Remote Code Execution Vulnerability

CVE-2026-111357HighCISA KEV

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

CVE-2026-111233Low

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter

CVE-2026-111232Medium

Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field

CVE-2026-111231High

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore and config_install ignore the 'User - Config: Deny Config Write' privilege

CVE-2026-111230Medium

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php

CVE-2026-111229High

pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root

CVE-2026-111228Medium

Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives

CVE-2026-111227Medium

Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives

CVE-2026-111226High

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings

CVE-2026-111225Low

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user

CVE-2026-111224High

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames

CVE-2026-111223High

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field

CVE-2026-111222High

Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value

CVE-2026-111221High

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret

CVE-2026-111220High

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields

CVE-2026-111219High

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields

CVE-2026-111218High

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field

CVE-2026-111217High

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID

CVE-2026-111216High

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index

CVE-2026-111215High

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name

CVE-2026-111214High

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name

CVE-2026-50619Critical

path traversal vulnerability has been reported to affect Qsirch.

CVE-2026-47790Medium

cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service.

CVE-2026-47786Critical

OS command injection vulnerability has been reported to affect HybridDesk Station.

CVE-2026-39997High

missing authentication for critical function vulnerability has been reported to affect HybridDesk Station.

CVE-2026-39991Medium

cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3.

CVE-2026-34009High

improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3.

CVE-2026-34008High

incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3.

CVE-2026-34007Medium

OS command injection vulnerability has been reported to affect Notes Station 3.

CVE-2026-53882High

improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Stat…

CVE-2026-50612Critical

QuMagie: unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.

CVE-2026-44084High

Video Station: authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.

CVE-2026-41545High

QuMagie: relative path traversal vulnerability has been reported to affect QuMagie.

CVE-2026-41541Medium

Qsync: unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central.

CVE-2026-39989Medium

server-side request forgery (SSRF) vulnerability has been reported to affect Download Station.

CVE-2026-34015High

Video Station: path traversal vulnerability has been reported to affect Video Station.

CVE-2026-34014High

incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station.

CVE-2026-34006Critical

missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE.

CVE-2026-26245High

Video Station: SQL injection vulnerability has been reported to affect Video Station.

CVE-2026-26244High

Video Station: SQL injection vulnerability has been reported to affect Video Station.

CVE-2026-26243High

Qsync: path traversal vulnerability has been reported to affect Qsync Central.

CVE-2026-41544High

path traversal vulnerability has been reported to affect QcalAgent.

CVE-2026-39993High

relative path traversal vulnerability has been reported to affect Download Station.

CVE-2026-24723Medium

NULL pointer dereference vulnerability has been reported to affect File Station 5.

CVE-2026-24722Medium

NULL pointer dereference vulnerability has been reported to affect File Station 5.

CVE-2026-24721Medium

NULL pointer dereference vulnerability has been reported to affect File Station 5.

CVE-2026-24718Medium

Qsync: path traversal vulnerability has been reported to affect Qsync Central.

CVE-2026-24715Medium

observable timing discrepancy vulnerability has been reported to affect QuRouter.

CVE-2026-22896Medium

QuTS hero: cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch.

CVE-2025-68404High

time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter.

CVE-2025-68403Medium

external control of system or configuration setting vulnerability has been reported to affect QuRouter.

CVE-2025-66275High

Video Station: path traversal vulnerability has been reported to affect Video Station.

CVE-2025-66272High

Video Station: path traversal vulnerability has been reported to affect Video Station.

CVE-2025-29897Low

Qsync: buffer copy without checking size of input vulnerability has been reported to affect Qsync Central.

CVE-2025-29896Low

Qsync: NULL pointer dereference vulnerability has been reported to affect Qsync Central.

CVE-2025-29895Low

Qsync: NULL pointer dereference vulnerability has been reported to affect Qsync Central.

CVE-2026-110908High

pfSense Plus: Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter

CVE-2026-99999Critical

validate checksum_start before completing checksum

CVE-2026-98432Critical

free inet_opt and ireq_opt after an RCU grace period

CVE-2026-0317Medium

PAN-OS: Denial of Service Vulnerability

CVE-2026-100232High

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute arbitrary OS commands, resulting in remote code execution

CVE-2026-96540High

improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information

CVE-2026-88164High

Microsoft Office SharePoint Elevation of Privilege Vulnerability

CVE-2026-101954Critical

Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled

CVE-2026-101952High

Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP ISO-VPN peer to cause an rpd crash by sending a specific ISO-VPN update which is then processed by BMP route monitoring or NSR

CVE-2026-101949High

NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated remote BGP neighbor to cause a denial of service via a VPN-flowspec BGP update if it is readvertised and BMP post-policy RIB-out monitoring is configured

CVE-2026-101964Medium

Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session

CVE-2026-101963High

Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured

CVE-2026-101962High

Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update which is attempted to be readvertised to cause an rpd crash

CVE-2026-101961High

NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matcher of Juniper Networks Junos OS and Junos OS Evolved allows a configured eBGP peer to cause a routing-daemon denial of service via a specific BGP packet received while a nexthop-ecmp qualifier is attached to a BGP import policy

CVE-2026-101959Medium

Function Call With Incorrect Variable or Reference as Argument vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause an rpd crash via specifically malformed LSP-ping

CVE-2026-101983Critical

Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain configured

CVE-2026-101982Critical

Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS Evolved via protocol-valid route advertisements for an EVPN-VPWS service

CVE-2026-101981High

Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message

CVE-2026-101979High

Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP packet, when SNMP and AAA are enabled

CVE-2026-101976High

Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update to cause a Denial-of-Service (DoS)

CVE-2026-101975Medium

Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet Routing best-route Prefix-SID installation is configured

CVE-2026-101972Medium

Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets sent on an OSPF-enabled interface

CVE-2026-102077High

Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS)