Published threat advisories for October 2, 2026

An integer underflow vulnerability exists in the web management service of RouterOS, allowing unauthenticated network attackers to achieve arbitrary code execution or denial of service. This is a critical concern for network and security teams responsible for device administration, requiring confirmation of the technol

NVD modified: NVD date unavailable

A critical vulnerability exists in WebSocket endpoints, allowing unauthenticated attackers to impersonate charging stations. This could lead to unauthorized access to sensitive data, unauthorized actions, and potential privilege escalation, impacting system security. The vulnerability is reachable over the network.

NVD modified: NVD date unavailable

A critical vulnerability in Loom for AWS allows unauthenticated remote actors to gain super-admin authority over the agent control plane. This could enable them to register tool servers, read integration credentials, and rewrite IAM policies. The issue is present in deployments where no identity provider is configured.

NVD modified: NVD date unavailable

A vulnerability in the Tinypool Node.js library could allow an attacker to execute arbitrary JavaScript and access or modify task data. This occurs when an application passes a custom options object to the `pool.run()` function, and an attacker can manipulate the prototype. The issue is fixed in version 2.1.2.

NVD modified: NVD date unavailable

A code injection vulnerability exists in the `agentscope` framework, potentially allowing attackers to execute arbitrary code or commands if specific entry points are reachable. This could impact applications built using the framework by compromising system integrity. Confirmation of its use and any external exposure i

NVD modified: NVD date unavailable

FinRobot has a code injection vulnerability in its file creation function, potentially allowing unauthenticated attackers to execute arbitrary code remotely. This could compromise system integrity and confidentiality. Confirming FinRobot's integration and reachability within our environment is necessary to assess poten

NVD modified: NVD date unavailable

An improper access control vulnerability exists in SuperAGI's agent execution controller, allowing authenticated users to create or run agents from different organizations. This could lead to unauthorized actions or data exposure. Platform owners should identify SuperAGI instances, verify cross-organization exposure, a

NVD modified: NVD date unavailable

A path traversal vulnerability in image-downloader allows an attacker to write downloaded data outside the intended directory, potentially leading to unauthorized data modification or system compromise. This issue is relevant if systems utilize this utility for downloads, especially when the download URL is controllabl

NVD modified: NVD date unavailable

An incorrect authorization vulnerability in Google Chrome's FileSystem component could allow a remote attacker, via social engineering, to execute code outside the browser sandbox. This occurs when a user visits a crafted HTML page. The potential impact includes compromise of confidentiality, integrity, and availabilit

NVD modified: NVD date unavailable

A vulnerability in GitLab's AI Gateway allows an authenticated user to execute arbitrary commands by escaping the prompt template sandbox with a crafted flow configuration. This could impact the AI Gateway system, and its relevance needs to be confirmed.

NVD modified: NVD date unavailable

The Divi Membership WordPress plugin has a privilege escalation vulnerability allowing unauthenticated attackers to register as an administrator and gain full site control. This occurs because the plugin does not properly validate user roles during registration, enabling attackers to submit a crafted hash for the admin

NVD modified: NVD date unavailable

A stack-based buffer overflow vulnerability exists in the Boa Web Server component of Tenda home gateway devices. This vulnerability can be exploited remotely by an unauthenticated attacker through a specially crafted request, potentially leading to full device compromise. It is important to confirm if these devices ar

NVD modified: NVD date unavailable

YesWiki contains an authorization bypass vulnerability allowing unauthenticated attackers to access administrative routes and sensitive backup archives if public API mode is enabled. This could permit unauthorized modification of system configurations and exposure of stored data.

NVD modified: NVD date unavailable

A heap-based buffer overflow in Apache Thrift's THeaderTransport can occur when processing compressed data, potentially leading to memory corruption. This vulnerability is relevant if Thrift is exposed to network traffic and uses the ZLIB transform, impacting service availability.

NVD modified: NVD date unavailable

A critical authorization bypass vulnerability exists in the WPMobile.App WordPress plugin, allowing unauthenticated attackers to exfiltrate password-reset URLs if the mail-to-push feature is enabled. This could lead to account takeover for any user, including administrators.

NVD modified: NVD date unavailable

A critical directory traversal vulnerability exists in the Super Forms WordPress plugin, impacting all versions up to 6.3.316. This flaw allows unauthenticated attackers to read arbitrary files from the server. While a configuration setting can mitigate unauthenticated access, the underlying vulnerability remains. This

NVD modified: NVD date unavailable

A critical vulnerability in the Mooncake transfer engine allows unauthenticated attackers to read and write arbitrary process memory via its TCP transport. This could expose sensitive data or enable code execution. Confirmation is needed on whether this technology is in use and accessible.

NVD modified: NVD date unavailable