CVE Vulnerabilities - 3 October 2026

The OpenAM login system (versions older than 16.1.3) can be tricked into sending users to any website after they log out. An attacker could craft a logout request that redirects a user to a phishing p...

The Xreader document viewer in Linux Mint (versions up to 4.6.5) can be made to open files outside its intended folder when handling EPUB files. This could let someone who sends a specially crafted EP...

The Pie Register WordPress plugin, in versions before 3.8.4.14, lets anyone who knows a valid invitation code view the usernames and email addresses of all users who registered with that code. This ca...

The MetForm plugin for WordPress creates a debug file in the website’s public folder each time a form is submitted when the HubSpot integration is turned on. Because the file is not protected, anyone ...

The WP Ultimate CSV Importer plugin (versions before 9.2) saves import logs in the website’s upload folder without protecting them. Because the logs are not hidden, anyone on the internet can view per...

The WP Ultimate CSV Importer plugin for WordPress, versions before 9.2, lets administrators upload files that can contain hidden code. That code is saved to a publicly reachable location and can run i...