CVE Vulnerabilities - 3 October 2026

The Foreman management system and its remote execution plugins for Red Hat Satellite can be tricked into executing unauthorized commands. This could let an attacker take control of the server or acces...

Versions of ConvertX before 0.19 allow special recipe files to be sent to Calibre's ebook-convert tool without checking them. If an attacker supplies a crafted .recipe or .downloaded_recipe file, it c...

The AIT-Core software that handles spacecraft command and telemetry traffic can be accessed without any password. If an attacker can reach the system’s network ports, they could inject false commands,...

The Java library Bouncy Castle (versions before 1.86) could accept a different X.509 certificate than the one that actually signed a message. This could let an attacker appear as another user, read en...

The FreeRDP packages for Red Hat Linux can be tricked into executing malicious code. This could let an attacker take control of the affected system or steal data. Update the FreeRDP packages to the la...

Anyone can place malicious shortcodes in a Beaver Builder page that uses the Sidebar widget, causing the site to run unwanted code. This works when the sidebar shows text that an attacker can control,...

The VikAppointments Services Booking Calendar add‑on for WordPress lets anyone on the internet remove files from your web server because it does not check the file name correctly. If a file such as th...

The Ultimate Member plugin for WordPress, up to version 2.13.1, does not properly check who is allowed to do certain actions. As a result, a regular user could trick the system into giving themselves ...