Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

October — Vulnerabilities & Security Advisories 42

All 42 CVE vulnerabilities found in October, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the October product, specifically focusing on software weaknesses tagged as critical security flaws. The collection encompasses a wide spectrum of issues including memory corruption, privilege escalation, and remote code execution vulnerabilities reported between January 2020 and the present. Visitors can utilize this resource to track the vendor's official security advisories, analyze the characteristics of specific weakness classes affecting this software, or review the complete historical record of security incidents associated with the October product line. By centralizing these disparate reports, the page serves as a technical reference for security professionals seeking to understand the evolution of threats targeting this specific application. The data presented is derived from public disclosures and vendor announcements, ensuring that the information remains factual and directly relevant to risk assessment activities. Users interested in defensive strategies will find detailed descriptions of affected versions and the nature of the exploited flaws without unnecessary commentary. This compilation aids in identifying patterns within the product's security posture over time, facilitating more informed decisions regarding patch management and system hardening. The scope includes both resolved and ongoing issues, providing a comprehensive view of the product's security landscape for the specified period.

Vendor: October CMS

CVE ID Title CVSS Severity Published
CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage CWE-502 3.3 Low 2026-09-14
CVE-2026-29179 October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations CWE-863 3.3 Low 2026-04-21
CVE-2026-27937 October: Reflected XSS via DataTable Form Widget CWE-79 3.1 Low 2026-04-21
CVE-2026-26274 October: Safe Mode Bypass via Twig Database Write Operations CWE-184 6.6 Medium 2026-04-21
CVE-2026-26067 October: Safe Mode Bypass via CSS Preprocessor Compilers CWE-863 4.9 Medium 2026-04-21
CVE-2026-25133 October CMS has Stored XSS via SVG Filter Bypass CWE-79 7.5 - 2026-04-14
CVE-2026-25125 October CMS: Environment Variable Exfiltration via INI Parser Interpolation CWE-200 4.9 Medium 2026-04-14
CVE-2026-24907 October CMS has Stored XSS via Event Log Mail Preview CWE-79 5.4 - 2026-04-14
CVE-2026-24906 October CMS has Stored XSS in its Backend Editor Markup Classes CWE-79 8.2 - 2026-04-14
CVE-2026-22692 October CMS: Twig Sandbox Bypass via Collection Methods CWE-693 4.9 Medium 2026-04-14
CVE-2025-61674 October CMS Vulnerable to Stored XSS via Editor and Branding Styles CWE-79 6.1 Medium 2026-01-10
CVE-2025-61676 October CMS Vulnerable to Stored XSS via Branding Styles CWE-79 6.1 Medium 2026-01-10
CVE-2024-51991 October CMS Allows Unprotected SVG Rename in Media Manager CWE-434 4.8AI Medium AI 2025-05-05
CVE-2024-25637 Reflected XSS via X-October-Request-Handler Header CWE-79 3.1 Low 2024-06-26
CVE-2024-24764 October Open Redirect for Administrator Accounts CWE-601 3.5 Low 2024-06-26
CVE-2023-44381 October CMS safe mode bypass using Page template injection CWE-94 4.9 Medium 2023-12-01
CVE-2023-44382 October CMS safe mode bypass using Twig sandbox escape CWE-94 9.1 Critical 2023-12-01
CVE-2023-44383 October CMS stored XSS by authenticated backend user with improper configuration CWE-79 5.4 Medium 2023-11-29
CVE-2022-35944 October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution) CWE-94 6.2 Medium 2022-10-13
CVE-2022-24800 Race Condition in October CMS upload process CWE-362 8.1 High 2022-07-12
CVE-2022-23655 Missing server signature validation in OctoberCMS CWE-347 4.8 Medium 2022-02-23
CVE-2022-21705 Authenticated remote code execution in octobercms CWE-74 7.2 High 2022-02-23
CVE-2021-32649 Authenticated file write leads to remote code execution in october/system CWE-74 8.8 High 2022-01-14
CVE-2021-32650 Arbitrary code execution in october/system CWE-74 8.8 High 2022-01-14
CVE-2021-41126 Deleted Admin Can Sign In to Admin Interface CWE-287 7.2 High 2021-10-06
CVE-2021-29487 Authentication bypass in Octobercms CWE-287 7.4 High 2021-08-26
CVE-2021-32648 Account Takeover in Octobercms CWE-287 8.2 High 2021-08-26
CVE-2021-21264 Bypass of fix for CVE-2020-26231, Twig sandbox escape CWE-862 5.2 Medium 2021-05-03
CVE-2021-21265 October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers CWE-644 6.8 Medium 2021-03-10
CVE-2020-26231 Bypass of fix for CVE-2020-15247, Twig sandbox escape CWE-862 5.2 Medium 2020-11-23

All 42 known CVE vulnerabilities affecting October with full Chinese analysis, references, and POCs where available.