Daily summary
Vulnerabilities of 23 October 2026: 99 new, 24 critical
99 vulnerabilities added on 23 October 2026, 24 critical and 32 high: GitLab (12), Arbitrary file upload in WordPress plugins, PHP object injection in WordPress themes and more.
- 24 critical
- 32 high
- 37 medium
- 5 low
- 1 unrated
GitLab
12 vulnerabilities · Servers and applications · most fixed in 19.3.6, 19.4.3, 19.5.1
- 10.0Integer Overflow or Wraparound in GitLab
- 8.2Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
- 7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab
- 7.1Incorrect Authorization in GitLab
- 6.8Incorrect Authorization in GitLab
Show 7 more
- 6.5Authorization Bypass Through User-Controlled Key in GitLab
- 6.5Insertion of Sensitive Information Into Sent Data in GitLab
- 4.3Use of Less Trusted Source in GitLab
- 3.5Use of Cache Containing Sensitive Information in GitLab
- 3.1Use of Incorrectly-Resolved Name or Reference in GitLab
- 3.1Improper Cleanup on Thrown Exception in GitLab
- 2.7Incorrect Authorization in GitLab
Arbitrary file upload in WordPress plugins
2 vulnerabilities
- 10.0WP Mailster
- 9.9Mang Board WP
PHP object injection in WordPress themes
10 vulnerabilities
- 9.8ZenSoul
- 9.8Holistic Center
- 9.8Save Life
- 9.8HotLock
- 9.8Hallelujah
Show 5 more
- 9.8Vagabonds
- 9.8Rhodos
- 9.8Little Birdies
- 9.8Redy
- 8.1Helion
File inclusion in WordPress plugins
3 vulnerabilities
PHP object injection in WordPress plugins
3 vulnerabilities
Authentication bypass in WordPress plugins
1 vulnerability
- 9.8SureCart
SQL injection in WordPress plugins
6 vulnerabilities
Next.js
4 vulnerabilities · npm packages · most fixed in 15.5.28, 16.4.1
- CriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
- CriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
- HighNext.js: Denial of Service in App Router using Server Actions
- Mediumnext.js cache leak across root param values in nested 'use cache' functions
Broken access control in npm packages
1 vulnerability
Cross-site request forgery in WordPress plugins
2 vulnerabilities
Arbitrary file access in WordPress plugins
4 vulnerabilities
Broken access control in WordPress plugins
20 vulnerabilities
Show 15 more
- 6.5BjornTech Swish for WooCommerce
- 5.4myCred
- 5.4MarketKing
- 5.3ЮKassa для WooCommerce
- 5.3Majestic Support
- 5.3Page Restriction WordPress (WP)
- 5.3Sunshine Photo Cart
- 5.3SureDash
- 5.3SureDash
- 5.3Falcon – WordPress Optimizations & Tweaks
- 5.3Metform
- 4.3PowerPack Addons for Elementor
- 4.3Strong Testimonials
- 4.3H5P
- 4.3eRoom
Cross-site scripting in WordPress plugins
19 vulnerabilities
- 7.2Anti-Spam by CleanTalkUnauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter
- 7.1Hostme v2
- 7.1VikRentCar
- 7.1VikRentCar
- 7.1ACF Extended
Show 14 more
- 7.1WP Mailster
- 7.1Contact Form Email
- 7.1ThemeHunk Customizer
- 7.1Paid Videochat Turnkey Site
- 7.1Geo Mashup
- 7.1SureCart
- 6.5Extensions for Leaflet Map
- 6.5ND Shortcodes For Visual Composer
- 6.5Waitlist Woocommerce ( Back in stock notifier )
- 6.5Restaurant Menu – Food Ordering System – Table Reservation
- 6.5Off-Canvas Sidebars & Menus (Slidebars)
- 6.5H5P
- 6.5Elementor Addon Elements
- 6.5Contest Gallery
Servers and applications
2 vulnerabilities
Other vulnerabilities in WordPress plugins
4 vulnerabilities
Other vulnerabilities in WordPress themes
2 vulnerabilities
Other vulnerabilities in npm packages
2 vulnerabilities
WordPress core
1 vulnerability
Elixir and Erlang packages
1 vulnerability
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.