Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services

Published 2026-10-30 by GitHub_M

WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability

Published 2026-10-30 by Patchstack

Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()

Published 2026-10-30 by apache

WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability

Published 2026-10-30 by Patchstack

WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability

Published 2026-10-30 by Patchstack

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

Published 2026-10-30 by Patchstack

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Published 2026-10-30 by Patchstack

Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

Published 2026-10-30 by AMZN

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

Published 2026-10-30 by redhat

LM Studio before 0.4.22+1 Path Traversal via Model Downloader

Published 2026-10-30 by VulnCheck

37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload

Published 2026-10-30 by VulDB

gettext: Directory traversal via the LANGUAGE environment variable

Published 2026-10-30 by glibc

Missing type validation in xQueueSelectFromSet in FreeRTOS-Kernel

Published 2026-10-30 by AMZN

Published 2026-10-30 by JetBrains

Published 2026-10-30 by JetBrains

Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore

Published 2026-10-30 by VulnCheck

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Published 2026-10-30 by microsoft

Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview

Published 2026-10-30 by VulnCheck

changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

Published 2026-10-30 by VulnCheck

Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests

Published 2026-10-30 by VulnCheck

Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name

Published 2026-10-30 by VulnCheck

sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

Published 2026-10-30 by VulnCheck

Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

Published 2026-10-30 by Wordfence

GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter

Published 2026-10-30 by Wordfence

Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update

Published 2026-10-30 by Wordfence