On this Halloween, I am humbled. I've just been accredited 57 brand new CVEs! Thank you to all my friends and lovers! CVE-2026-119146 proftpd/proftpd: ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap Affected: ProFTPD < 1.3.9e; >= 1.3.10rc1, < 1.3.10rc5 CVE-2026-119147 proftpd/proftpd: ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass Affected: ProFTPD < 1.3.9e; >= 1.3.10rc1, < 1.3.10rc5 CVE-2026-119364 proftpd/proftpd: ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass https://github.com/proftpd/proftpd/issues/2374 Affected: ProFTPD <= 1.3.9e; >= 1.3.10rc1, < 1.3.10rc5 CVE-2026-119371 sqlite/sqlite: SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander() Affected: SQLite < 3.54.0 CVE-2026-119372 sqlite/sqlite: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet() Affected: SQLite < 3.54.0 CVE-2026-119373 sqlite/sqlite: SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists() Affected: SQLite < 3.54.0 CVE-2026-119374 sqlite/sqlite: SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete() Affected: SQLite < 3.54.0 CVE-2026-119375 sqlite/sqlite: SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch Affected: SQLite < 3.54.0 CVE-2026-119376 sqlite/sqlite: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain Affected: SQLite < 3.54.0 CVE-2026-119377 sqlite/sqlite: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING Affected: SQLite < 3.54.0 CVE-2026-119378 sqlite/sqlite: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite() Affected: SQLite < 3.54.0 CVE-2026-119379 sqlite/sqlite: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind() Affected: SQLite < 3.54.0 CVE-2026-119591 sqlite/sqlite: SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause Affected: SQLite < 3.54.0 CVE-2026-119407 element-hq/element-web: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters Affected: Element Web < 1.12.32; Element Desktop < 1.12.32 CVE-2026-119408 n8n-io/n8n: n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes Affected: n8n < 2.42.6; >= 2.43.0, < 2.43.3; >= 3.0.0, < 3.0.1 CVE-2026-119409 opnsense/core: OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting Affected: OPNsense < 26.7.8 CVE-2026-119414 bitwarden/server: Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create Affected: Bitwarden Server < 2026.10.1 CVE-2026-119415 cakephp/cakephp: CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type Affected: CakePHP <= 5.4.3 CVE-2026-119416 cakephp/cakephp: CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching Affected: CakePHP <= 5.4.3 CVE-2026-119417 cakephp/cakephp: CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport Affected: CakePHP 4.5.12, 4.6.5, 5.1.8 to 5.1.10, 5.2.14 to 5.2.15, 5.3.7, 5.4.0 to 5.4.3 CVE-2026-119418 cakephp/cakephp: CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() Affected: CakePHP <= 5.4.3 CVE-2026-119419 cakephp/cakephp: CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation Affected: CakePHP <= 5.4.3 CVE-2026-119420 getlago/lago-api: Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation Affected: Lago <= 1.55.0 CVE-2026-119421 juspay/hyperswitch: Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation Affected: Hyperswitch <= 1.128.0; date-tagged builds < 2026.10.19.0 CVE-2026-119422 juspay/hyperswitch: Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector Affected: Hyperswitch < 1.128.0; date-tagged builds < 2026.10.01.0 CVE-2026-119423 opnsense/core: OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username Affected: OPNsense < 26.7.8 CVE-2026-119424 opnsense/core: OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity Affected: OPNsense < 26.7.8 CVE-2026-119425 opnsense/core: OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP Affected: OPNsense >= 26.1.6, <= 26.7.7 CVE-2026-119426 phpmyadmin/phpmyadmin: phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql Affected: phpMyAdmin <= 5.2.3 CVE-2026-119427 phpmyadmin/phpmyadmin: phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting Affected: phpMyAdmin <= 5.2.3 CVE-2026-119428 phpmyadmin/phpmyadmin: phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled Affected: phpMyAdmin <= 5.2.3 CVE-2026-119429 phpmyadmin/phpmyadmin: phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set Affected: phpMyAdmin <= 5.2.3 CVE-2026-119545 forgejo/forgejo: Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery Affected: Forgejo <= 15.0.11; >= 16.0.0, <= 16.0.7; >= 17.0.0, <= 17.0.1 CVE-2026-119546 forgejo/forgejo: Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo Affected: Forgejo <= 15.0.11; >= 16.0.0, <= 16.0.7; >= 17.0.0, <= 17.0.1 CVE-2026-119547 forgejo/forgejo: Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id} Affected: Forgejo <= 15.0.11; >= 16.0.0, <= 16.0.7; >= 17.0.0, <= 17.0.1 CVE-2026-119548 getlago/lago-api: Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook Affected: Lago <= 1.55.0 CVE-2026-119549 jellyfin/jellyfin: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images Affected: Jellyfin <= 12.4 CVE-2026-119550 jellyfin/jellyfin: Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId} Affected: Jellyfin <= 12.4 CVE-2026-119551 jellyfin/jellyfin: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions Affected: Jellyfin <= 12.4 CVE-2026-119552 louislam/uptime-kuma: Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler Affected: Uptime Kuma <= 2.5.8 CVE-2026-119553 moodle/moodle: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal Affected: Moodle 5.3.0; >= 5.2.0, <= 5.2.4; >= 5.1.0, <= 5.1.8; >= 5.0.0, <= 5.0.11; <= 4.5.15 CVE-2026-119554 moodle/moodle: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber Affected: Moodle 5.3.0; >= 5.2.0, <= 5.2.4; >= 5.1.0, <= 5.1.8; >= 5.0.0, <= 5.0.11; <= 4.5.15 CVE-2026-119555 moodle/moodle: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback Affected: Moodle 5.3.0; >= 5.2.0, <= 5.2.4; >= 5.1.0, <= 5.1.8; >= 5.0.0, <= 5.0.11; >= 4.2.0, <= 4.5.15 CVE-2026-119556 moodle/moodle: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems Affected: Moodle 5.3.0; >= 5.2.0, <= 5.2.4; >= 5.1.0, <= 5.1.8; >= 5.0.0, <= 5.0.11; >= 4.2.0, <= 4.5.15 CVE-2026-119557 n8n-io/n8n: n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node Affected: n8n >= 2.14.0, <= 2.46.3 CVE-2026-119558 opencart/opencart: OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points Affected: OpenCart <= 4.1.0.4 CVE-2026-119559 litespeedtech/openlitespeed: OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch Affected: OpenLiteSpeed <= 1.9.4 CVE-2026-119560 opnsense/core: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields Affected: OPNsense <= 26.7.8 CVE-2026-119561 phpmyadmin/phpmyadmin: phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer Affected: phpMyAdmin <= 5.2.3 CVE-2026-119562 phpmyadmin/phpmyadmin: phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute Affected: phpMyAdmin <= 5.2.3 CVE-2026-119563 phpmyadmin/phpmyadmin: phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name Affected: phpMyAdmin <= 5.2.3 CVE-2026-119564 plausible/analytics: Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs Affected: Plausible Analytics <= 3.2.1 CVE-2026-119565 plausible/analytics: Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update Affected: Plausible Analytics <= 3.2.1 CVE-2026-119566 prometheus/prometheus: Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects Affected: Prometheus <= 3.15.1 CVE-2026-119567 vsftpd: vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases Affected: vsftpd <= 3.0.5 CVE-2026-119568 vsftpd: vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking Affected: vsftpd <= 3.0.5 CVE-2026-119586 sqlite/sqlite: SQLite CLI through 3.54.1 Command Injection via .recover Output Affected: SQLite <= 3.54.1