CVE Vulnerabilities - 5 October 2026

Totolink A3002MU allows remote code execution via QoS rule

CVE-2026-105285

The router’s QoS rule handling can be tricked with crafted input, causing a memory overflow that lets an attacker run code from anywhere on the network. This could give the attacker control over the d...

9.3

Totolink A3002MU can grant unauthorized access

CVE-2026-105284

The Totolink A3002MU router has a flaw in its login check that could let someone bypass authentication. An attacker could exploit this from anywhere on the internet to gain access without proper crede...

9.3

Perforce P4 Search lets anyone gain admin access

CVE-2026-100103

Old Perforce P4 Search containers use a default password that anyone on the network can discover. This lets an outsider log in with the highest rights and potentially run any code on your P4 server. U...

10.0

Langflow lets logged-in users run any command on server

CVE-2026-105740

Versions of Langflow before 1.9.0 allow anyone with a valid account to add a special MCP connection that runs whatever text they enter as a system command. This can give the user full control over the...

9.9

Penpot lets attackers run commands via SVG export

CVE-2026-105691 GHSA-4f36-m4hj-cv86

If a user can edit a design in Penpot, they can insert special text into a color setting that causes the system to run unintended commands when the file is exported as SVG. This can be triggered even ...

9.9

Plane allows internal data exposure via webhook redirect

CVE-2026-105636 GHSA-mq87-52pf-hm3h

The Plane project‑management app lets users set up webhooks. Because the system follows redirects without checking the final address, a malicious webhook can be made to pull information from internal ...

9.9

Advanced Post Manager plugin lets attackers run code

CVE-2026-97283

The Advanced Post Manager plugin for WordPress can be tricked into processing specially crafted data, which may let an attacker execute unwanted code on your site. This could allow the attacker to tak...

9.8

FineAdmin 1.0 can let attackers read database data

CVE-2026-88424

The version 1.0 of FineAdmin lets a malicious user send specially crafted requests that cause the system to run unintended commands and reveal sensitive information stored in its database. This could ...

9.8

Plane community deployments use default secret keys

CVE-2026-105641 GHSA-cmwv-pjmw-8483

The open‑source Plane tool (versions before 1.4.0) includes deployment files that contain fixed secret keys. If these defaults are not changed, anyone who knows the keys can create forged user session...

9.8

Plane lets attackers join workspaces as other users

CVE-2026-105639 GHSA-4vj8-p63v-8p24

The open‑source project management tool Plane (versions before 1.4.0) creates a user record for any email address without confirming ownership. Because the invitation details, including a secret token...

9.8

Apache Struts legacy REST mapper allows remote code execution

CVE-2026-104711

Versions of Apache Struts that use the old RESTful action mapper can be tricked by a specially crafted web request to run arbitrary code on the server. This risk exists in many older Struts releases u...

9.8

GouGuOA message page can expose data

CVE-2026-88395

Versions of GouGuOA up to 6.0.5 let a user enter specially crafted text in the message page’s keywords field, causing the system to run unintended database commands. This could let an attacker view, c...

9.8

WookTeam ≤1.6.6 allows attackers to run code remotely

CVE-2026-88393

The export function in WookTeam versions up to 1.6.6 processes a data input that can be crafted to make the server execute arbitrary code. An attacker who can call this API could take control of the s...

9.8

dormakaba evolo Service lets remote attacker run code as SYSTEM

CVE-2026-37719

The dormakaba evolo Service can be tricked by a remote attacker to run any program with the highest system privileges. This could let an attacker take full control of the affected computer. Apply the ...

9.8

TF Content for Joomla lets anyone edit or publish records

CVE-2026-102780

The TF Content extension for Joomla allows anyone, even without logging in, to change or publish content items. A visitor can use a public form token to modify any record, including changing its publi...

6.9

OrdaSoft Joomla CCK lets attackers run database commands

CVE-2026-102428

The OrdaSoft Joomla CCK extension (versions before 8.3.16) accepts a user‑provided order value without checking it. This lets a remote attacker add their own instructions to the website’s database, po...

9.3

Northstar platform lets anyone access database console and run code

CVE-2026-88391

Versions of the Northstar quantitative trading platform up to 9.1.1 expose the built‑in H2 database console without requiring a login, and the database uses its default empty password. Because of this...

9.8

HAPI FHIR libraries may let health data be tampered

GHSA-4cf2-cxp3-rjr7 CVE-2024-51132 ROOT-APP-MAVEN-CVE-2024-51132

The HAPI FHIR Java libraries used for converting and handling FHIR data (including the convertors, DSTU2, DSTU2016May, DSTU3 and R4 packages) have a flaw that could allow an attacker to alter health i...

8.8

expr-eval could let attackers run unauthorized code

CVE-2026-12866 GHSA-q9v2-7m5w-4693 ROOT-APP-NPM-CVE-2026-12866

The expr-eval library used in several JavaScript projects can be tricked into executing code that an attacker supplies. This could give a malicious user control over your application or server. Update...

9.2

log4j can let attackers execute code

GHSA-2qrg-x229-3v8q CVE-2019-17571 ROOT-APP-MAVEN-CVE-2019-17571 DEBIAN-CVE-2019-17571

The log4j logging library used in several Java applications has a flaw that could let a malicious user run code on your server. This affects the log4j package and related components listed. Apply the ...

9.8

Plane allows guests to hijack files from other projects

CVE-2026-105637 GHSA-r2hw-fff3-pjwp

In versions of Plane before 1.4.0, a user with Guest access could supply identifiers of files that belong to a different project in the same workspace and trick the system into treating those files as...

9.6

P4 Search grants admin rights with empty token

CVE-2026-103510

Versions of P4 Search before the 2026.4.2 update accept a blank authentication token, so anyone on the network can log in with the highest level of access. This can lead to full control of P4 Search a...

9.5

Perforce P4 Search enables remote code execution

CVE-2026-100102

Container images of Perforce P4 Search released before version 2026.4.2 expose a Java debugging interface that anyone on the network can reach without authentication. An attacker could use this to run...

9.5

BuildKit may execute attacker code from a fake image

CVE-2026-93318 GHSA-f2v9-hprr-32q3 UBUNTU-CVE-2026-93318

Docker BuildKit (used by Docker and related services) can trust layer identifiers that don’t match the actual image data. A crafted image can trick BuildKit into using malicious contents as part of la...

9.4

openSIS Classic lets teacher reset any staff password

CVE-2026-91107

In openSIS Classic version 9.3, a teacher who logs in can change the staff_id value in a request and cause the system to reset the password of any staff member. This means an unauthorized person could...

9.3