By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 76 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
33Monitor	CVE-2026-102301No exploit	Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potgoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-102302No exploit	Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-121 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-102304No exploit	Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-102306No exploit	Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-102308No exploit	Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrarygoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-102309No exploit	Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandboxgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-102316No exploit	Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrarygoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-102317No exploit	Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute google · chrome · CWE-269 RCE Local privilege escalation	High8.6	—	0.1%	Sep 29, 2026
35Monitor	CVE-2026-102321No exploit	Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-102323No exploit	Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Sep 29, 2026
33Monitor	CVE-2026-102324No exploit	Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer procesgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-102326No exploit	Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.3%	Sep 29, 2026
30Monitor	CVE-2026-102327No exploit	Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the rgoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High7.5	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-102328No exploit	Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-102331No exploit	Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary cogoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102875No exploit	VLC media player before 3.0.24 Path Traversal via skins2videolan · vlc · CWE-22 Path traversal Local privilege escalation	High8.5	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-102876No exploit	SurrealDB before 3.3.0 Cross-Tenant Access via Headerssurrealdb · surrealdb · CWE-639 Broken access control (IDOR)	High8.6	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-102878Proof of concept	mcp-chrome-bridge through 1.0.31 CORS Origin Bypasshangwin · mcp-chrome-bridge · CWE-346 Pre-auth	High8.6	—	0.7%	Sep 29, 2026
39Monitor	CVE-2026-39117No exploit	An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitraryCWE-94 pre-auth RCE	Critical9.8	—	0.7%	Sep 29, 2026
36Monitor	CVE-2026-53988No exploit	Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpointsfinsys · dockhand · CWE-306 Pre-auth Auth bypass	Critical9.2	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-61519No exploit	Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()liberu software · liberu crm · CWE-863 Broken access control (IDOR)	High8.7	—	0.3%	Sep 29, 2026
30Monitor	CVE-2026-67987No exploit	crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions iCWE-1333 Pre-auth Denial of service	High7.5	—	0.4%	Sep 29, 2026
35Monitor	CVE-2026-67993No exploit	basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentiCWE-352 Pre-auth CSRF	High8.8	—	0.1%	Sep 29, 2026
39Monitor	CVE-2026-76721No exploit	Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APshewlett packard enterprise (hpe) · instant on · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	0.5%	Sep 29, 2026
39Monitor	CVE-2026-76722No exploit	Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APshewlett packard enterprise (hpe) · instant on · CWE-134 pre-auth RCE	Critical9.8	—	0.5%	Sep 29, 2026
38Monitor	CVE-2026-76723No exploit	Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APShewlett packard enterprise (hpe) · instant on · CWE-120 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-76724No exploit	Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocolhewlett packard enterprise (hpe) · instant on · CWE-77 pre-auth RCE Command injection	Critical9.6	—	1.0%	Sep 29, 2026
38Monitor	CVE-2026-76725No exploit	Authentication Bypass in a Management Protocol of HPE Networking Instant ON APshewlett packard enterprise (hpe) · instant on · CWE-287 pre-auth RCE Auth bypass	Critical9.6	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-76726No exploit	Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpointhewlett packard enterprise (hpe) · instant on · CWE-287 Pre-auth Auth bypass	High8.1	—	0.3%	Sep 29, 2026
28Monitor	CVE-2026-76727No exploit	Authenticated Command Injection Vulnerabilities in HPE Networking Instant ONhewlett packard enterprise (hpe) · instant on · CWE-77 RCE Command injection	High7.2	—	0.9%	Sep 29, 2026
28Monitor	CVE-2026-76728No exploit	Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APshewlett packard enterprise (hpe) · instant on · CWE-918 RCE SSRF	High7.2	—	0.5%	Sep 29, 2026
26Monitor	CVE-2026-76731No exploit	Authentication Bypass in the Captive Portal of HPE Networking Instant Onhewlett packard enterprise (hpe) · instant on · CWE-269 Pre-auth Auth bypass	Medium6.5	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-79403No exploit	An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpointCWE-280 RCE	High8.4	—	0.1%	Sep 29, 2026
21Monitor	CVE-2026-79417Proof of concept	Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass CWE-284 Broken access control (IDOR) Denial of service	Medium5.3	—	0.2%	Sep 29, 2026
36Monitor	CVE-2026-79536No exploit	bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component.CWE-89 Pre-auth SQL injection	Critical9.1	—	0.2%	Sep 29, 2026
36Monitor	CVE-2026-79537No exploit	metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch.CWE-639 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.1	—	0.3%	Sep 29, 2026
39Monitor	CVE-2026-79538No exploit	metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/sCWE-94 pre-auth RCE	Critical9.8	—	0.4%	Sep 29, 2026
35Monitor	CVE-2026-94953No exploit	A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.CWE-121 Memory safety	High8.8	—	0.2%	Sep 29, 2026
33Monitor	CVE-2026-96274No exploit	Uncaught exception in Baicells Nova 430Hbaicells · nova 430h enodeb (model pbs3101sh) · CWE-248 Pre-auth	High8.3	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-102253Proof of concept	iperf3 < 3.22 UDP Receive Worker Infinite Loop DoSesnet · iperf3 · CWE-835 Pre-auth Denial of service	High8.7	—	0.4%	Sep 29, 2026
31Monitor	CVE-2026-102925No exploit	virtualenv bash and fish activation scripts execute commands embedded in pathsvirtualenv · virtualenv · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.1%	Sep 29, 2026
30Monitor	CVE-2026-102930No exploit	virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before usepypa · virtualenv · CWE-494 Pre-auth	High7.7	—	0.1%	Sep 29, 2026
29Monitor	CVE-2026-102937No exploit	virtualenv: Command injection via --prompt in activate.bat (batch activator)pypa · virtualenv · CWE-78 RCE Local privilege escalation Command injection	High7.3	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-93853No exploit	Barman snapshot backup deletion trusts unverified backup catalog metadataenterprisedb · barman · CWE-283	High7.2	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-94204No exploit	Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Applicationviidure · dashcam android application · CWE-732 Pre-auth	High8.7	—	0.3%	Sep 29, 2026
39Monitor	CVE-2026-94952No exploit	A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.CWE-121 Pre-auth Memory safety	Critical9.8	—	0.3%	Sep 29, 2026
40Plan	CVE-2026-96587No exploit	Use of Hard-coded Credentials in Viidure Dashcam Android Applicationviidure · dashcam android application · CWE-798 Pre-auth Hard-coded credentials	Critical10.0	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-63713No exploit	Toptech TMS7 and TopHAT SQL Injectiontoptech systems · tms7 · CWE-89 SQL injection	High8.5	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-68068No exploit	Toptech TMS7 and TopHAT SQL Injectiontoptech systems · tms7 · CWE-89 SQL injection	High8.5	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-68954No exploit	Toptech TMS7 and TopHAT SQL Injectiontoptech systems · tms7 · CWE-89 SQL injection	High8.5	—	0.2%	Sep 29, 2026
37Monitor	CVE-2026-70356No exploit	Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Typetoptech systems · tms7 · CWE-434 RCE File upload	Critical9.4	—	0.4%	Sep 29, 2026
30Monitor	CVE-2026-71302No exploit	Toptech TMS7 and TopHAT Session Fixationtoptech systems · tms7 · CWE-384 Pre-auth	High7.5	—	0.2%	Sep 29, 2026
40Plan	CVE-2026-71379No exploit	Toptech TMS7 and TopHAT Files or Directories Accessible to External Partiestoptech systems · tms7 · CWE-552 Pre-auth	Critical10.0	—	0.4%	Sep 29, 2026
35Monitor	CVE-2026-71971No exploit	U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassemblyu-boot · u-boot · CWE-787 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-72507No exploit	Toptech TMS7 and TopHAT SQL Injectiontoptech systems · tms7 · CWE-89 SQL injection	High8.5	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-72510No exploit	Toptech TMS7 and TopHAT SQL Injectiontoptech systems · tms7 · CWE-89 SQL injection	High8.5	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-74220No exploit	U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Replyu-boot · u-boot · CWE-195 Pre-auth	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-74221No exploit	U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINKu-boot · u-boot · CWE-195 Pre-auth	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-74222No exploit	U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callbacku-boot · u-boot · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-74225No exploit	U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6u-boot · u-boot · CWE-787 Pre-auth Memory safety	High7.1	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-84409No exploit	Lantronix G520 Series Cellular Gateway Cross-site Scriptinglantronix · g520 series · CWE-79 pre-auth RCE XSS	High7.7	—	0.4%	Sep 29, 2026
30Monitor	CVE-2026-91191No exploit	Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signaturelantronix · g520 series · CWE-347 Pre-auth Weak crypto	High7.7	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-102792No exploit	Ziroom ZHOME A0101 set_syslog command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	3.0%	Sep 29, 2026
37Monitor	CVE-2026-103040No exploit	LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Servicemodeltc · lightllm · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	1.0%	Sep 29, 2026
37Monitor	CVE-2026-103041No exploit	LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Servicemodeltc · lightllm · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	0.7%	Sep 29, 2026
34Monitor	CVE-2026-103042No exploit	LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_valuemodeltc · lightllm · CWE-770 Pre-auth Denial of service	High8.7	—	0.6%	Sep 29, 2026
34Monitor	CVE-2026-103043No exploit	anchorme through 3.0.8 Regular Expression Denial of Servicealexcorvi · anchorme · CWE-1333 Pre-auth Denial of service	High8.7	—	0.5%	Sep 29, 2026
39Monitor	CVE-2026-103044No exploit	EasyTimeline should not serve image maps as application/xmlthe wikimedia foundation · mediawiki - easytimeline extension · CWE-91 Pre-auth	Critical9.8	—	0.4%	Sep 29, 2026
35Monitor	CVE-2026-102793No exploit	Ziroom ZHOME A0101 set_time_zone command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	2.4%	Sep 30, 2026
35Monitor	CVE-2026-102794No exploit	Ziroom ZHOME A0101 ping command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	2.3%	Sep 30, 2026
30Monitor	CVE-2026-13046No exploit	Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Executionwatchguard · fireware · CWE-502 RCE Deserialization	High7.5	—	0.3%	Sep 30, 2026
32Monitor	CVE-2026-13224No exploit	Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Readwatchguard · fireware · CWE-22 Path traversal	High8.2	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-18105No exploit	Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Servicewatchguard · fireware · CWE-400 Denial of service	High7.1	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-18145No exploit	Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Executionwatchguard · fireware · CWE-121 RCE Memory safety	High8.6	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-81433No exploit	Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Executionwatchguard · fireware os · CWE-120 pre-auth RCE Memory safety	High8.7	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-86101No exploit	Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Accesswatchguard · fireware · CWE-285 Broken access control (IDOR)	High7.2	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-86104No exploit	Fireware OS Resource Exhaustion in Login Process Allows Denial of Servicewatchguard · fireware · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
32Monitor	CVE-2026-86128No exploit	Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Servicewatchguard · fireware · CWE-476 Pre-auth Memory safety	High8.2	—	0.3%	Sep 30, 2026
36Monitor	CVE-2026-86131No exploit	Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Executionwatchguard · fireware · CWE-94 pre-auth RCE	Critical9.2	—	0.4%	Sep 30, 2026
32Monitor	CVE-2026-86132No exploit	Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Servicewatchguard · fireware · CWE-191 Pre-auth Memory safety	High8.2	—	0.3%	Sep 30, 2026
32Monitor	CVE-2026-86133No exploit	Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Servicewatchguard · fireware · CWE-191 Pre-auth Memory safety	High8.2	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-86136No exploit	Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant Awatchguard · fireware · CWE-22 Path traversal	High7.1	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-90441No exploit	Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant Bwatchguard · fireware · CWE-200 Info leak	High7.1	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-103054No exploit	AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSPbeenuar · aisoc · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-103055No exploit	AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secretbeenuar · aisoc · CWE-321 Pre-auth Auth bypass Hard-coded credentials	High8.7	—	0.5%	Sep 30, 2026
38Monitor	CVE-2026-103056Proof of concept	AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTRbeenuar · aisoc · CWE-78 RCE Command injection	Critical9.4	—	1.8%	Sep 30, 2026
28Monitor	CVE-2026-103087No exploit	Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cgosub-io · gosub-engine · CWE-674 Pre-auth Denial of service	High7.1	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-103088No exploit	Handlebars.java before 4.5.5 allows directory traversal.jknack · handlebars.java · CWE-24 Pre-auth Path traversal	High7.5	—	0.6%	Sep 30, 2026
30Monitor	CVE-2026-103099No exploit	Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a spexip · pexip infinity · CWE-617 Pre-auth Denial of service	High7.5	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-103100No exploit	Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigpexip · pexip infinity · CWE-617 Pre-auth Denial of service	High7.5	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-103101No exploit	Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to pexip · pexip infinity · CWE-770 Pre-auth Denial of service	High7.5	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-103102No exploit	Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to triggepexip · pexip infinity · CWE-770 Pre-auth Denial of service	High8.6	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-103104No exploit	Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a repexip · pexip infinity · CWE-617 Pre-auth Denial of service	High7.5	—	0.3%	Sep 30, 2026
35Monitor	CVE-2026-103105No exploit	Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacpexip · pexip infinity · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-103106No exploit	Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service thpexip · pexip infinity · CWE-669 RCE Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-103108No exploit	Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a repexip · pexip infinity · CWE-617 Pre-auth Denial of service	High7.5	—	0.3%	Sep 30, 2026
37Monitor	CVE-2026-103109No exploit	Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a rempexip · pexip infinity · CWE-787 Pre-auth Memory safety	Critical9.4	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-96649No exploit	Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)wpshuffle · frontend post submission manager lite – guest post and frontend submission forms · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Sep 30, 2026
35Monitor	CVE-2026-102911No exploit	zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injectionzosmaai · pi-llm-wiki · CWE-77 RCE Command injection	High8.6	—	1.7%	Sep 30, 2026
39Monitor	CVE-2026-103110No exploit	Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute codepexip · pexip infinity · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.6%	Sep 30, 2026

CVE-2026-102301
33Monitor
Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to pot
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102302
35Monitor
Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102304
38Monitor
Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102306
38Monitor
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102308
38Monitor
Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102309
38Monitor
Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102316
38Monitor
Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102317
34Monitor
Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Local privilege escalation
google · chromeSep 29, 2026
CVE-2026-102321
35Monitor
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-102323
35Monitor
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-102324
33Monitor
Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer proces
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102326
35Monitor
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-102327
30Monitor
Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the r
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 29, 2026
CVE-2026-102328
35Monitor
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-102331
38Monitor
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary co
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-102875
34Monitor
VLC media player before 3.0.24 Path Traversal via skins2
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
- Local privilege escalation
videolan · vlcSep 29, 2026
CVE-2026-102876
34Monitor
SurrealDB before 3.3.0 Cross-Tenant Access via Headers
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
surrealdb · surrealdbSep 29, 2026
CVE-2026-102878
34Monitor
mcp-chrome-bridge through 1.0.31 CORS Origin Bypass
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
hangwin · mcp-chrome-bridgeSep 29, 2026
CVE-2026-39117
39Monitor
An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 29, 2026
CVE-2026-53988
36Monitor
Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
finsys · dockhandSep 29, 2026
CVE-2026-61519
34Monitor
Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
liberu software · liberu crmSep 29, 2026
CVE-2026-67987
30Monitor
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions i
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 29, 2026
CVE-2026-67993
35Monitor
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credenti
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
Sep 29, 2026
CVE-2026-76721
39Monitor
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76722
39Monitor
Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76723
38Monitor
Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76724
38Monitor
Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol
CriticalCVSS 9.6No exploitEPSS 1%
- pre-auth RCE
- Command injection
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76725
38Monitor
Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76726
32Monitor
Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76727
28Monitor
Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Command injection
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76728
28Monitor
Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs
HighCVSS 7.2No exploitEPSS 0%
- RCE
- SSRF
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-76731
26Monitor
Authentication Bypass in the Captive Portal of HPE Networking Instant On
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
hewlett packard enterprise (hpe) · instant onSep 29, 2026
CVE-2026-79403
33Monitor
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint
HighCVSS 8.4No exploitEPSS 0%
- RCE
Sep 29, 2026
CVE-2026-79417
21Monitor
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass
MediumCVSS 5.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
- Denial of service
Sep 29, 2026
CVE-2026-79536
36Monitor
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
Sep 29, 2026
CVE-2026-79537
36Monitor
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
Sep 29, 2026
CVE-2026-79538
39Monitor
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/s
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 29, 2026
CVE-2026-94953
35Monitor
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
Sep 29, 2026
CVE-2026-96274
33Monitor
Uncaught exception in Baicells Nova 430H
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
baicells · nova 430h enodeb (model pbs3101sh)Sep 29, 2026
CVE-2026-102253
34Monitor
iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Denial of service
esnet · iperf3Sep 29, 2026
CVE-2026-102925
31Monitor
virtualenv bash and fish activation scripts execute commands embedded in paths
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
virtualenv · virtualenvSep 29, 2026
CVE-2026-102930
30Monitor
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
pypa · virtualenvSep 29, 2026
CVE-2026-102937
29Monitor
virtualenv: Command injection via --prompt in activate.bat (batch activator)
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
pypa · virtualenvSep 29, 2026
CVE-2026-93853
28Monitor
Barman snapshot backup deletion trusts unverified backup catalog metadata
HighCVSS 7.2No exploitEPSS 0%
enterprisedb · barmanSep 29, 2026
CVE-2026-94204
34Monitor
Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
viidure · dashcam android applicationSep 29, 2026
CVE-2026-94952
39Monitor
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
Sep 29, 2026
CVE-2026-96587
40Plan
Use of Hard-coded Credentials in Viidure Dashcam Android Application
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
viidure · dashcam android applicationSep 29, 2026
CVE-2026-63713
34Monitor
Toptech TMS7 and TopHAT SQL Injection
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
toptech systems · tms7Sep 29, 2026
CVE-2026-68068
34Monitor
Toptech TMS7 and TopHAT SQL Injection
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
toptech systems · tms7Sep 29, 2026
CVE-2026-68954
34Monitor
Toptech TMS7 and TopHAT SQL Injection
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
toptech systems · tms7Sep 29, 2026
CVE-2026-70356
37Monitor
Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- File upload
toptech systems · tms7Sep 29, 2026
CVE-2026-71302
30Monitor
Toptech TMS7 and TopHAT Session Fixation
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
toptech systems · tms7Sep 29, 2026
CVE-2026-71379
40Plan
Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
toptech systems · tms7Sep 29, 2026
CVE-2026-71971
35Monitor
U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
u-boot · u-bootSep 29, 2026
CVE-2026-72507
34Monitor
Toptech TMS7 and TopHAT SQL Injection
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
toptech systems · tms7Sep 29, 2026
CVE-2026-72510
34Monitor
Toptech TMS7 and TopHAT SQL Injection
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
toptech systems · tms7Sep 29, 2026
CVE-2026-74220
35Monitor
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READ Reply
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
u-boot · u-bootSep 29, 2026
CVE-2026-74221
35Monitor
U-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINK
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
u-boot · u-bootSep 29, 2026
CVE-2026-74222
35Monitor
U-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive Callback
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
u-boot · u-bootSep 29, 2026
CVE-2026-74225
28Monitor
U-Boot before 2026.10-rc5 Out-of-Bounds Write via DHCPv6
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
u-boot · u-bootSep 29, 2026
CVE-2026-84409
30Monitor
Lantronix G520 Series Cellular Gateway Cross-site Scripting
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- XSS
lantronix · g520 seriesSep 29, 2026
CVE-2026-91191
30Monitor
Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
lantronix · g520 seriesSep 29, 2026
CVE-2026-102792
35Monitor
Ziroom ZHOME A0101 set_syslog command injection
HighCVSS 8.5No exploitEPSS 3%
- RCE
- Command injection
ziroom · zhome a0101Sep 29, 2026
CVE-2026-103040
37Monitor
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Deserialization
modeltc · lightllmSep 29, 2026
CVE-2026-103041
37Monitor
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Deserialization
modeltc · lightllmSep 29, 2026
CVE-2026-103042
34Monitor
LightLLM through 1.2.0 Unauthenticated Memory Exhaustion via NCCL Control Channel set_value
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
modeltc · lightllmSep 29, 2026
CVE-2026-103043
34Monitor
anchorme through 3.0.8 Regular Expression Denial of Service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
alexcorvi · anchormeSep 29, 2026
CVE-2026-103044
39Monitor
EasyTimeline should not serve image maps as application/xml
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
the wikimedia foundation · mediawiki - easytimeline extensionSep 29, 2026
CVE-2026-102793
35Monitor
Ziroom ZHOME A0101 set_time_zone command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
ziroom · zhome a0101Sep 30, 2026
CVE-2026-102794
35Monitor
Ziroom ZHOME A0101 ping command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
ziroom · zhome a0101Sep 30, 2026
CVE-2026-13046
30Monitor
Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Deserialization
watchguard · firewareSep 30, 2026
CVE-2026-13224
32Monitor
Fireware OS Path Traversal in WebUI Management Agent Allows Arbitrary Local File Read
HighCVSS 8.2No exploitEPSS 0%
- Path traversal
watchguard · firewareSep 30, 2026
CVE-2026-18105
28Monitor
Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
watchguard · firewareSep 30, 2026
CVE-2026-18145
34Monitor
Fireware OS Stack-based Buffer Overflow in spamd Allows Remote Code Execution
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Memory safety
watchguard · firewareSep 30, 2026
CVE-2026-81433
34Monitor
Fireware OS Pre-Authentication Stack Buffer Overflow in fingerd Allows Remote Code Execution
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Memory safety
watchguard · fireware osSep 30, 2026
CVE-2026-86101
28Monitor
Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
watchguard · firewareSep 30, 2026
CVE-2026-86104
34Monitor
Fireware OS Resource Exhaustion in Login Process Allows Denial of Service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
watchguard · firewareSep 30, 2026
CVE-2026-86128
32Monitor
Fireware OS NULL Pointer Dereference in NetFlow IPv6 Traffic Processing Allows Remote Denial of Service
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
watchguard · firewareSep 30, 2026
CVE-2026-86131
36Monitor
Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
watchguard · firewareSep 30, 2026
CVE-2026-86132
32Monitor
Fireware OS Pre-Authentication Integer Underflow in iked Allows Denial of Service
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
watchguard · firewareSep 30, 2026
CVE-2026-86133
32Monitor
Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
watchguard · firewareSep 30, 2026
CVE-2026-86136
28Monitor
Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
watchguard · firewareSep 30, 2026
CVE-2026-90441
28Monitor
Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B
HighCVSS 7.1No exploitEPSS 0%
- Info leak
watchguard · firewareSep 30, 2026
CVE-2026-103054
28Monitor
AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
beenuar · aisocSep 30, 2026
CVE-2026-103055
34Monitor
AiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
beenuar · aisocSep 30, 2026
CVE-2026-103056
38Monitor
AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR
CriticalCVSS 9.4Proof of conceptEPSS 1%
- RCE
- Command injection
beenuar · aisocSep 30, 2026
CVE-2026-103087
28Monitor
Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to c
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
gosub-io · gosub-engineSep 30, 2026
CVE-2026-103088
30Monitor
Handlebars.java before 4.5.5 allows directory traversal.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
jknack · handlebars.javaSep 30, 2026
CVE-2026-103099
30Monitor
Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a s
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pexip · pexip infinitySep 30, 2026
CVE-2026-103100
30Monitor
Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trig
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pexip · pexip infinitySep 30, 2026
CVE-2026-103101
30Monitor
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pexip · pexip infinitySep 30, 2026
CVE-2026-103102
34Monitor
Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigge
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
pexip · pexip infinitySep 30, 2026
CVE-2026-103104
30Monitor
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a re
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pexip · pexip infinitySep 30, 2026
CVE-2026-103105
35Monitor
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attac
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
pexip · pexip infinitySep 30, 2026
CVE-2026-103106
31Monitor
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service th
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
pexip · pexip infinitySep 30, 2026
CVE-2026-103108
30Monitor
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a re
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
pexip · pexip infinitySep 30, 2026
CVE-2026-103109
37Monitor
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a rem
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
pexip · pexip infinitySep 30, 2026
CVE-2026-96649
28Monitor
Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpshuffle · frontend post submission manager lite – guest post and frontend submission formsSep 30, 2026
CVE-2026-102911
35Monitor
zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
zosmaai · pi-llm-wikiSep 30, 2026
CVE-2026-103110
39Monitor
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
pexip · pexip infinitySep 30, 2026