Published threat advisories for October 29, 2026

A critical vulnerability exists in the Veeam Virtualization Extensions service, potentially allowing unauthenticated remote code execution on affected servers. This issue could lead to unauthorized system control if the service is exposed and reachable. Confirming the presence and network exposure of this service withi

NVD modified: NVD date unavailable

A vulnerability in SOCFortress CoPilot allows a low-privilege user to upload a malicious template that executes arbitrary code on the backend when reports are generated, potentially exposing all tenant data and credentials. The un-sandboxed Jinja2 engine processes these templates, leading to command execution as root a

NVD modified: NVD date unavailable

An arbitrary file upload vulnerability exists in the Docat `Upload API` due to a lack of validation on the uploaded file's path and type. This could allow an attacker to overwrite configuration files or place malicious content on the web server, potentially leading to remote code execution or cross-site scripting. Conf

NVD modified: NVD date unavailable

A vulnerability in the ServiceNow AI Platform allows an authenticated administrator to bypass sandbox restrictions and execute arbitrary code on the host operating system. This could lead to unintended access and potential system compromise. Promptly applying updates is recommended.

NVD modified: NVD date unavailable

A vulnerability in the Botan cryptography library's C API could allow an attacker to cause memory corruption by manipulating block cipher parameters. This may occur in applications that accept external algorithm parameters and use the FFI raw ECB mode with the Lion cipher, leading to insufficient memory allocation and

NVD modified: NVD date unavailable

A vulnerability in a Monkeytype development workflow allows arbitrary code execution and data exfiltration when a pull request is processed with specific labels, potentially enabling modification of repository content. This issue affects the repository's CI workflow, not the application itself, and is fixed in version

NVD modified: NVD date unavailable

A critical authentication issue in the Shelter application allows an attacker to register their own key and take over another user's service API and preferences. This could impact user data integrity and application functionality if the vulnerability is reachable.

NVD modified: NVD date unavailable

A critical vulnerability in IBM Langflow OSS allows remote attackers to bypass security restrictions due to improper authentication. This could enable unauthorized access and impact system integrity and confidentiality. Determining if this technology is used and exposed is essential for security.

NVD modified: NVD date unavailable

A critical OS command injection vulnerability in Progress Software WS_FTP Server allows for arbitrary command execution under certain configurations. This could enable attackers to compromise system integrity and data. It is uncertain if specific versions or configurations within our environment are affected or reachab

NVD modified: NVD date unavailable

A path traversal vulnerability exists in WS_FTP Server, allowing a delegated administrator to access unauthorized locations. This could potentially lead to remote code execution. WS_FTP Server is often internet-facing, making the reachability of this vulnerability a concern for security-aware leaders.

NVD modified: NVD date unavailable

An OS command injection vulnerability exists in Progress Software WS_FTP Server, potentially allowing arbitrary command execution with elevated privileges under certain configurations. This affects the integrity and availability of the server and its hosted data, making it a significant security concern for file transf

NVD modified: NVD date unavailable

A path traversal vulnerability in Progress Software WS_FTP Server could allow a delegated administrator to access or modify unauthorized files. This issue is relevant if the affected product is deployed and reachable over a network.

NVD modified: NVD date unavailable

A critical vulnerability exists in Progress Software WS_FTP Server's administrative interface, allowing delegated administrators to exceed their permissions. This could result in arbitrary command execution with elevated privileges and complete server compromise. The administrative interface is often network-exposed, m

NVD modified: NVD date unavailable

An unauthenticated remote attacker could exploit an improper authentication vulnerability in Progress Software WS_FTP Server to access sensitive information, such as administrative credentials. This could lead to unauthorized administrative access, making it important to confirm if this technology is in use and reachab

NVD modified: NVD date unavailable

An unauthenticated PHP Object Injection vulnerability exists in Zoho Flow, potentially allowing attackers to execute arbitrary code on the server. This could impact the integrity and availability of the service and its data. Confirmation of the product's presence and assessment of its exposure are necessary.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Gunslinger theme, allowing unauthenticated attackers to inject PHP objects. If reachable, this could lead to remote code execution and potential system compromise, impacting data integrity and availability. Organizations using this theme should verify its presence and assess poten

NVD modified: NVD date unavailable

A critical PHP Object Injection vulnerability exists in the Good Homes theme, allowing unauthenticated attackers to inject malicious code. If reachable, this could lead to unauthorized code execution and compromise of the affected system's integrity. Readers should confirm if this theme is in use to assess potential ex

NVD modified: NVD date unavailable

A PHP Object Injection vulnerability exists in the Gamic theme. If reachable, an unauthenticated attacker could exploit this to execute arbitrary code on the server. This could lead to unauthorized access or modification of data. Confirming the use and exposure of this theme in your environment is important for maintai

NVD modified: NVD date unavailable

An unauthenticated PHP Object Injection vulnerability exists in the Gamezone theme. Attackers can exploit this remotely to inject malicious code, potentially leading to system compromise. Confirming if this theme is used and assessing its reachability is crucial for understanding potential business impact.

NVD modified: NVD date unavailable

A critical unauthenticated PHP object injection vulnerability exists in the EmojiNation theme. Attackers could exploit this to execute arbitrary code on affected systems, potentially impacting data integrity and availability. It is important to determine if this theme is in use to assess potential exposure.

NVD modified: NVD date unavailable

A critical PHP Object Injection vulnerability exists in the Edge Decor WordPress theme, allowing unauthenticated attackers to execute arbitrary code remotely. This could potentially lead to a full compromise of affected web applications. Confirming its use within your organization is essential to assess potential expos

NVD modified: NVD date unavailable

A critical PHP Object Injection vulnerability exists in Coinpress, potentially allowing unauthenticated attackers to execute arbitrary code over the network. This could impact system data and sensitive information. Determining relevance and exposure within our environment is crucial.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Bonbon theme, allowing unauthenticated attackers to inject malicious PHP objects. This could lead to the execution of arbitrary code, potentially compromising system integrity and availability if the theme is used in a web application.

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability exists in the Avventure WordPress theme, potentially allowing attackers to execute arbitrary code. This could lead to unauthorized access and modification of systems if the theme is in use and reachable. Understanding if this theme is deployed is crucial for assessi

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability in Filmax could allow remote attackers to execute arbitrary code. This impacts web applications using the affected component, potentially leading to system compromise if reachable. Confirmation of use and exposure is advised.

NVD modified: NVD date unavailable

A critical vulnerability exists in Orpheus, allowing unauthenticated PHP Object Injection. This flaw, exploitable over the network, could lead to severe system compromise and data manipulation, making it relevant for internet-facing web applications.

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability exists in the Nuts WordPress theme, which could allow attackers to execute arbitrary code. This impacts the integrity of websites using the theme and may lead to unauthorized access and control of the affected system. The immediate concern is to identify if this the

NVD modified: NVD date unavailable

This critical vulnerability in the Muzicon WordPress theme allows unauthenticated attackers to inject PHP objects, potentially leading to unauthorized code execution or data manipulation. As the vulnerability is network-reachable and unauthenticated, it poses a significant risk to system integrity and data confidential

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability exists in the Motorix theme. If reachable, this could allow an attacker to execute arbitrary code on the server, potentially compromising the system and data. Identifying and assessing the exposure of this theme in our environment is crucial.

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability exists in the Mission theme, allowing attackers to execute arbitrary code on affected web applications. This critical issue, reachable over the network without authentication, poses a significant risk of system compromise. Confirming the presence and exposure of thi

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability exists in the Meals & Wheels software. If reachable, an attacker could exploit this to inject malicious PHP objects, potentially leading to unauthorized code execution and system compromise. Confirming usage and assessing exposure is crucial for security-aware leade

NVD modified: NVD date unavailable

A critical unauthenticated PHP Object Injection vulnerability exists in the Marcell WordPress theme. If reachable, this flaw could allow an attacker to inject malicious PHP objects, potentially leading to arbitrary code execution and system compromise. This issue warrants attention as it could impact application integr

NVD modified: NVD date unavailable

An unauthenticated PHP Object Injection vulnerability exists in the Le Truffe theme. If reachable, an attacker could exploit this to inject malicious PHP objects, potentially leading to arbitrary code execution and impacting system integrity and availability. Confirming its use and assessing exposure is advised.

NVD modified: NVD date unavailable

A critical PHP object injection vulnerability exists in the Legal Stone theme, allowing unauthenticated attackers to execute arbitrary code remotely. This threat is likely reachable from the internet, posing a risk to affected systems. Confirmation of Legal Stone's use and internet exposure is crucial for assessing imp

NVD modified: NVD date unavailable

A critical unauthenticated PHP object injection vulnerability exists in a WordPress plugin, potentially allowing attackers remote code execution and full website compromise. This issue impacts the integrity and availability of affected WordPress sites.

NVD modified: NVD date unavailable

A critical vulnerability in Ajax Load More Cache enables unauthenticated remote code execution, potentially allowing attackers to compromise affected systems over the network. This could impact the integrity and availability of online services using the plugin. Confirming relevance and exposure to this plugin is crucia

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability exists in the Ozisti theme, potentially allowing attackers to execute arbitrary code on affected systems. This could impact the integrity and availability of the web application if the theme is in use and reachable.

NVD modified: NVD date unavailable

A critical vulnerability in the Preservation theme allows unauthenticated attackers to inject malicious PHP objects, potentially leading to arbitrary code execution. This could compromise system and user data or disrupt application availability. It is important to identify if this technology is in use to assess potenti

NVD modified: NVD date unavailable

A critical unauthenticated PHP object injection vulnerability exists in the Printy theme. If reachable, an attacker could exploit this to execute arbitrary code, potentially leading to severe data compromise and system disruption. Confirming the presence and exposure of this theme in your environment is crucial for und

NVD modified: NVD date unavailable

An unauthenticated PHP object injection vulnerability exists in the Quirky theme, potentially allowing remote attackers to execute arbitrary code. This could lead to a compromise of affected systems and impact data and services. Confirming the use and exposure of this theme is crucial.

NVD modified: NVD date unavailable

A critical PHP Object Injection vulnerability exists in RexCoin, allowing unauthenticated attackers to inject malicious code and potentially gain unauthorized access. This threat is relevant for systems using RexCoin due to its network-accessible nature and the severe impact of successful exploitation.

NVD modified: NVD date unavailable

A path traversal vulnerability in Frappe allows authenticated attackers to upload crafted files to unauthorized server locations, potentially leading to remote code execution due to inadequate destination path validation. This is a concern for Frappe, as it's often used for internet-facing business applications, making

NVD modified: NVD date unavailable

A vulnerability in ZITADEL's Login V2 UI permits unauthenticated attackers to bypass authentication and take over user accounts by forging a verification cookie. This could allow unauthorized control over accounts and identity management functions if the affected ZITADEL instances are reachable. The potential impact ne

NVD modified: NVD date unavailable

A vulnerability in OpenText Advanced Authentication Server allows improper handling of extraneous untrusted data, potentially enabling unauthorized access to restricted functionalities. This could lead to unauthorized access to sensitive system information or administrative controls if the server is reachable.

NVD modified: NVD date unavailable

A vulnerability exists in P-Net when a specific, non-default option is enabled, allowing a crafted request to cause an out-of-bounds write. This could lead to a denial-of-service or potentially arbitrary code execution. As the vulnerable option is disabled by default, exploitation is unlikely unless specifically config

NVD modified: NVD date unavailable

IBM Langflow OSS contains a critical vulnerability in its code generation process that could permit a remote attacker to execute arbitrary code. This could potentially affect systems that process or generate code, raising concerns about system integrity and availability. The relevance and exposure of AI systems utilizi

NVD modified: NVD date unavailable

IBM Langflow OSS has a critical vulnerability allowing authenticated remote attackers to execute arbitrary code due to improper control of code generation. This could compromise system integrity and data if exploited. Confirmation of its presence and reachability is needed.

NVD modified: NVD date unavailable

A vulnerability in IBM Langflow OSS allows an authenticated user to execute arbitrary code due to improper handling of code within its `eval/exec` functionality. This could lead to system compromise if the affected technology is deployed and reachable. Uncertainty exists regarding specific product versions affected bey

NVD modified: NVD date unavailable

A critical vulnerability in IBM Langflow OSS may allow authenticated users to execute arbitrary code due to missing authorization checks. This could impact the confidentiality, integrity, and availability of systems. The primary concern is confirming relevance and exposure of affected instances.

NVD modified: NVD date unavailable

An insecure permission vulnerability exists in the Bulk Share Location Sender Android application that could allow unauthorized access and control of data. While the application is not directly internet-facing, its components could be invoked to access and control data within the local device context. Confirming its pr

NVD modified: NVD date unavailable

A critical vulnerability exists in IBM Langflow OSS, which could enable remote attackers to execute arbitrary code. This occurs due to the improper handling of special elements in OS commands, potentially leading to system compromise. Confirmation of its use and reachability within the environment is necessary to asses

NVD modified: NVD date unavailable

Insecure permissions in Simple Contacts Pro could allow unauthorized access to read and write notes in another user's database, potentially exposing sensitive local data. Readers should confirm the relevance and exposure of this application.

NVD modified: NVD date unavailable

An unsafe reflection vulnerability exists in Agno's PandasTools, allowing attackers to execute arbitrary code or read local files by invoking unintended pandas functions via prompt injection. This could lead to system compromise by allowing unauthorized access to data or execution of malicious commands.

NVD modified: NVD date unavailable

A vulnerability in Yamaha wireless LAN routers allows for OS command injection via specially crafted requests, potentially enabling arbitrary command execution. The exact business impact or data affected is uncertain, but routers are critical network infrastructure. Confirming device deployment and network exposure is

NVD modified: NVD date unavailable

A critical SQL injection vulnerability in the StylemixThemes Motors plugin allows blind SQL injection. Attackers can potentially exploit this to access sensitive data in car dealership listings. This issue affects the Motors plugin.

NVD modified: NVD date unavailable

A vulnerability in the Radius Xenia M2M Platform's web management interface allows unauthenticated attackers to inject SQL queries through the password recovery function. This could lead to unauthorized access to sensitive information, database structure enumeration, or modification of database records. The platform's

NVD modified: NVD date unavailable

An arbitrary file upload vulnerability in the Chat AI with Dispatcher WordPress plugin allows unauthenticated attackers to upload and execute malicious files, potentially leading to remote code execution and server compromise.

NVD modified: NVD date unavailable

A vulnerability in the Automated Import Products to Cart WordPress plugin allows low-privilege users to read sensitive files, such as database credentials, and delete arbitrary files on the server due to improper sanitization of user-supplied file paths. This could lead to unauthorized data exposure and service disrupt

NVD modified: NVD date unavailable

A WordPress plugin's password reset function can be exploited by unauthenticated attackers. They can trick the plugin into sending a reset code to an attacker-controlled email instead of the user's, allowing account takeover, including administrator accounts. This necessitates checking for the plugin's use on internet-

NVD modified: NVD date unavailable

A critical vulnerability in WordPress plugins allows unauthenticated users to inject serialized PHP objects that can lead to arbitrary file writes and remote code execution when public profiles are viewed. This impacts the integrity of web servers and stored data, as an attacker could potentially overwrite server files

NVD modified: NVD date unavailable

A critical authorization bypass vulnerability in FUXA's /nodered functionality allows unauthenticated attackers to execute arbitrary code via a crafted HTTP request. As FUXA is a web-based SCADA/HMI platform often exposed externally, this could impact industrial process monitoring and control systems.

NVD modified: NVD date unavailable

A critical vulnerability in the Bot for Telegram on WooCommerce WordPress plugin allows unauthenticated attackers to bypass authentication and take over any user account, including administrators. This is achieved by sending forged Telegram updates to a vulnerable REST API endpoint. Attackers can exploit this to gain f

NVD modified: NVD date unavailable

In openEQUELLA, a vulnerability exists in the scripting engine's `system.execute()` function, which allows unvalidated operating system commands to be run. A user with script editing privileges could exploit this to execute arbitrary commands with the service account's permissions, potentially compromising the system.

NVD modified: NVD date unavailable