Vulnfeed

Archives
Log in
Subscribe
October 2, 2026

[vulnfeed] 7 critical CVEs — 2026-10-02 12:00 UTC

vulnfeed Critical alert — 2026-10-02 14:54 UTC
7 new critical CVEs in the last 5 hours — 7 CVSS ≥ 9.0
New vulnerabilities
CVE-2026-94541CRITICAL
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in a
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying t
CVSS 9.8
CVE-2026-19652CRITICAL
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and includin
The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new use
CVSS 9.8
CVE-2026-86325CRITICAL
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vul
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter whe
CVSS 9.4
CVE-2026-104610CRITICAL
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the func
A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such man
CVSS 9.3
CVE-2026-91135CRITICAL
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the comp
CVSS 9.2
CVE-2026-104467CRITICAL
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. A
CVSS 9.2
CVE-2026-83632CRITICAL
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overfl
Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0.
CVSS 9.2

Live feed →  ·  Notification settings

vulnfeed critical alerts — vulnfeed.it. Unsubscribe

Don't miss what's next. Subscribe to Vulnfeed:
← Newer [vulnfeed] 7 critical CVEs — 2026-10-02 20:00 UTC Older → [vulnfeed] 2 critical CVEs — 2026-10-02 04:00 UTC
Powered by Buttondown, the easiest way to start and grow your newsletter.