By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 80 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
29Monitor	CVE-2026-102099No exploit	Kiteworks Core arbitrary file writeaccellion · kiteworks · CWE-22 RCE Path traversal	High7.2	—	1.9%	Sep 30, 2026
34Monitor	CVE-2026-102100No exploit	Kiteworks Core stored XSSaccellion · kiteworks · CWE-79 XSS	High8.7	—	0.3%	Sep 30, 2026
32Monitor	CVE-2026-102101No exploit	Kiteworks Core deserialization of untrusted dataaccellion · kiteworks · CWE-502 RCE Deserialization	High8.1	—	0.9%	Sep 30, 2026
36Monitor	CVE-2026-102102No exploit	Kiteworks Email Protection Gateway server-side request forgeryaccellion · kiteworks · CWE-918 Pre-auth SSRF	Critical9.1	—	0.8%	Sep 30, 2026
36Monitor	CVE-2026-102103No exploit	Kiteworks Email Protection Gateway server-side request forgeryaccellion · kiteworks · CWE-918 Pre-auth SSRF	Critical9.1	—	0.7%	Sep 30, 2026
36Monitor	CVE-2026-102104No exploit	Kiteworks Email Protection Gateway server-side request forgeryaccellion · kiteworks · CWE-918 Pre-auth SSRF	Critical9.1	—	0.7%	Sep 30, 2026
36Monitor	CVE-2026-102105No exploit	Kiteworks Email Protection Gateway server-side request forgeryaccellion · kiteworks · CWE-918 Pre-auth SSRF	Critical9.1	—	0.5%	Sep 30, 2026
36Monitor	CVE-2026-102106No exploit	Kiteworks Email Protection Gateway improper authenticationaccellion · kiteworks · CWE-287 Pre-auth Auth bypass	Critical9.1	—	1.0%	Sep 30, 2026
28Monitor	CVE-2026-102108No exploit	Kiteworks Email Protection Gateway deserialization of untrusted dataaccellion · kiteworks · CWE-502 RCE Deserialization	High7.2	—	1.4%	Sep 30, 2026
28Monitor	CVE-2026-102109No exploit	Kiteworks Secure Data Forms SQL injectionaccellion · kiteworks · CWE-89 SQL injection	High7.1	—	0.3%	Sep 30, 2026
31Monitor	CVE-2026-102112No exploit	Kiteworks Core Local Privilege Escalationaccellion · kiteworks · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.3%	Sep 30, 2026
31Monitor	CVE-2026-102113No exploit	Kiteworks Core Local Privilege Escalationaccellion · kiteworks · CWE-59 Local privilege escalation	High7.8	—	0.3%	Sep 30, 2026
29Monitor	CVE-2026-102114No exploit	Kiteworks Core OS Command Injectionaccellion · kiteworks · CWE-78 RCE Command injection	High7.2	—	3.1%	Sep 30, 2026
39Monitor	CVE-2026-102115No exploit	Kiteworks Core Authentication Bypass in the Password Reset Workflowaccellion · kiteworks · CWE-640 Pre-auth Auth bypass	Critical9.8	—	1.0%	Sep 30, 2026
29Monitor	CVE-2026-102116No exploit	Kiteworks Email Protection Gateway Path Traversalaccellion · kiteworks · CWE-22 RCE Path traversal	High7.2	—	1.9%	Sep 30, 2026
28Monitor	CVE-2026-102117No exploit	Kiteworks Core Remote Code Executionaccellion · kiteworks · CWE-807 RCE	High7.2	—	1.2%	Sep 30, 2026
31Monitor	CVE-2026-102118No exploit	Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalationaccellion · kiteworks · CWE-59 Local privilege escalation	High7.8	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-102119No exploit	Kiteworks Email Protection Gateway Path Traversalaccellion · kiteworks · CWE-22 RCE Path traversal	High7.2	—	1.3%	Sep 30, 2026
35Monitor	CVE-2026-102120No exploit	Kiteworks Core OS Command Injectionaccellion · kiteworks · CWE-78 RCE Local privilege escalation Command injection	High8.8	—	0.4%	Sep 30, 2026
34Monitor	CVE-2026-102121No exploit	Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actoraccellion · kiteworks · CWE-200 Pre-auth Auth bypass Info leak	High8.6	—	0.4%	Sep 30, 2026
29Monitor	CVE-2026-102123No exploit	Kiteworks Core Path Traversalaccellion · kiteworks · CWE-22 Pre-auth Path traversal	High7.4	—	0.9%	Sep 30, 2026
35Monitor	CVE-2026-102125No exploit	Kiteworks Core Sandbox Escapeaccellion · kiteworks · CWE-653 Local privilege escalation	High8.8	—	0.3%	Sep 30, 2026
32Monitor	CVE-2026-102126No exploit	Kiteworks Core Stored Cross-site Scripting (XSS)accellion · kiteworks · CWE-79 XSS	High8.1	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-102127No exploit	Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Referenceaccellion · kiteworks · CWE-611 Pre-auth XXE	High7.0	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-102128No exploit	Kiteworks Email Protection Gateway Improper Authenticationaccellion · kiteworks · CWE-287 Pre-auth Auth bypass	High7.5	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-102129No exploit	Kiteworks Core Incorrect Privilege Assignmentaccellion · kiteworks · CWE-266	High7.2	—	0.8%	Sep 30, 2026
28Monitor	CVE-2026-102130No exploit	Kiteworks Email Protection Gateway Remote Code Executionaccellion · kiteworks · CWE-94 RCE	High7.2	—	1.1%	Sep 30, 2026
28Monitor	CVE-2026-102131No exploit	Kiteworks Email Protection Gateway Improper Handling of Case Sensitivityaccellion · kiteworks · CWE-94 RCE	High7.2	—	1.1%	Sep 30, 2026
28Monitor	CVE-2026-102132No exploit	Kiteworks Core Privilege Escalation through Improper Access Controlaccellion · kiteworks · CWE-284 Broken access control (IDOR)	High7.2	—	1.0%	Sep 30, 2026
25Monitor	CVE-2026-102136No exploit	Kiteworks Core Command Execution through Configuration Injectionaccellion · kiteworks · CWE-93 RCE Local privilege escalation	Medium6.3	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-102142No exploit	Kiteworks Core Remote Code Execution through Server-Side Template Injectionaccellion · kiteworks · CWE-1336 RCE SSTI	High7.2	—	1.2%	Sep 30, 2026
30Monitor	CVE-2026-102143No exploit	Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Typeaccellion · kiteworks · CWE-306 Pre-auth Auth bypass File upload	High7.5	—	0.3%	Sep 30, 2026
37Monitor	CVE-2026-102147No exploit	Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)accellion · kiteworks · CWE-79 Pre-auth XSS	Critical9.3	—	0.4%	Sep 30, 2026
37Monitor	CVE-2026-102149No exploit	Kiteworks Email Protection Gateway Improper Access Controlaccellion · kiteworks · CWE-306 Pre-auth Auth bypass	Critical9.4	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-102150No exploit	Kiteworks Secure Data Forms Missing Authentication for Critical Functionaccellion · kiteworks · CWE-306 Pre-auth Auth bypass	High7.2	—	0.2%	Sep 30, 2026
34Monitor	CVE-2026-102995No exploit	pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)py-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102996No exploit	pypdf: Possible large memory usage when parsing font datapy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102997No exploit	pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)py-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102998No exploit	pypdf: Possible long runtimes when generating appearance streamspy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102999No exploit	pypdf: Possible long runtimes with large amount of embedded filespy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-103000No exploit	pypdf: Possible large memory usage when retrieving alphabetical page labelspy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
32Monitor	CVE-2026-51568No exploit	modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.CWE-22 Path traversal	High8.1	—	0.3%	Sep 30, 2026
32Monitor	CVE-2026-51570No exploit	modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.CWE-22 Path traversal	High8.1	—	0.3%	Sep 30, 2026
30Monitor	CVE-2026-51852No exploit	agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64.CWE-22 Pre-auth Path traversal	High7.5	—	0.7%	Sep 30, 2026
30Monitor	CVE-2026-51853No exploit	agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__.CWE-22 Pre-auth Path traversal	High7.5	—	0.7%	Sep 30, 2026
39Monitor	CVE-2026-51856No exploit	In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocketCWE-94 pre-auth RCE	Critical9.8	—	0.4%	Sep 30, 2026
39Monitor	CVE-2026-51857No exploit	In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter wCWE-94 pre-auth RCE	Critical9.8	—	0.5%	Sep 30, 2026
39Monitor	CVE-2026-51858No exploit	In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an apprCWE-94 pre-auth RCE	Critical9.8	—	0.6%	Sep 30, 2026
36Monitor	CVE-2026-51859No exploit	bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:29CWE-22 Pre-auth Path traversal	Critical9.1	—	0.7%	Sep 30, 2026
30Monitor	CVE-2026-51860No exploit	bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.CWE-22 Pre-auth Path traversal	High7.5	—	0.7%	Sep 30, 2026
39Monitor	CVE-2026-51861No exploit	bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.CWE-94 pre-auth RCE	Critical9.8	—	0.4%	Sep 30, 2026
36Monitor	CVE-2026-51862No exploit	DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).CWE-22 Pre-auth Path traversal	Critical9.1	—	0.8%	Sep 30, 2026
36Monitor	CVE-2026-51864No exploit	DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_aCWE-22 Pre-auth Path traversal	Critical9.1	—	0.8%	Sep 30, 2026
39Monitor	CVE-2026-51866No exploit	In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chatCWE-94 pre-auth RCE	Critical9.8	—	0.4%	Sep 30, 2026
39Monitor	CVE-2026-51867No exploit	agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Sep 30, 2026
39Monitor	CVE-2026-51869No exploit	DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Sep 30, 2026
39Monitor	CVE-2026-51870No exploit	DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.1%	Sep 30, 2026
39Monitor	CVE-2026-51871No exploit	Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achievCWE-94 pre-auth RCE	Critical9.8	—	0.5%	Sep 30, 2026
39Monitor	CVE-2026-51872No exploit	Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.CWE-94 pre-auth RCE	Critical9.8	—	0.4%	Sep 30, 2026
35Monitor	CVE-2026-92172No exploit	Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horimeta platforms, inc · meta horizon os · CWE-923	High8.8	—	0.2%	Sep 30, 2026
36Monitor	CVE-2026-92173No exploit	Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculumeta platforms, inc · meta horizon os · CWE-923 Pre-auth	Critical9.1	—	0.2%	Sep 30, 2026
36Monitor	CVE-2026-101283No exploit	iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attaesnet · iperf3 · CWE-122 Pre-auth Memory safety	Critical9.2	—	0.3%	Sep 30, 2026
4Monitor	CVE-2026-103584Proof of concept	attacker-controlled javascript license URL via XSSthe wikimedia foundation · mediawiki commonsmetadata extension · CWE-80 XSS	Low1.1	—	0.2%	Sep 30, 2026
4Monitor	CVE-2026-103585Proof of concept	attacker-controlled javascript license URL via XSSthe wikimedia foundation · mediawiki mediasearch extension · CWE-80 XSS	Low1.2	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-103591No exploit	DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/fileasyncfuncai · deepwiki-open · CWE-73 Pre-auth Path traversal	High8.7	—	0.4%	Sep 30, 2026

CVE-2026-102099
29Monitor
Kiteworks Core arbitrary file write
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Path traversal
accellion · kiteworksSep 30, 2026
CVE-2026-102100
34Monitor
Kiteworks Core stored XSS
HighCVSS 8.7No exploitEPSS 0%
- XSS
accellion · kiteworksSep 30, 2026
CVE-2026-102101
32Monitor
Kiteworks Core deserialization of untrusted data
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Deserialization
accellion · kiteworksSep 30, 2026
CVE-2026-102102
36Monitor
Kiteworks Email Protection Gateway server-side request forgery
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
accellion · kiteworksSep 30, 2026
CVE-2026-102103
36Monitor
Kiteworks Email Protection Gateway server-side request forgery
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
accellion · kiteworksSep 30, 2026
CVE-2026-102104
36Monitor
Kiteworks Email Protection Gateway server-side request forgery
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
accellion · kiteworksSep 30, 2026
CVE-2026-102105
36Monitor
Kiteworks Email Protection Gateway server-side request forgery
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
accellion · kiteworksSep 30, 2026
CVE-2026-102106
36Monitor
Kiteworks Email Protection Gateway improper authentication
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Auth bypass
accellion · kiteworksSep 30, 2026
CVE-2026-102108
28Monitor
Kiteworks Email Protection Gateway deserialization of untrusted data
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Deserialization
accellion · kiteworksSep 30, 2026
CVE-2026-102109
28Monitor
Kiteworks Secure Data Forms SQL injection
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
accellion · kiteworksSep 30, 2026
CVE-2026-102112
31Monitor
Kiteworks Core Local Privilege Escalation
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
accellion · kiteworksSep 30, 2026
CVE-2026-102113
31Monitor
Kiteworks Core Local Privilege Escalation
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
accellion · kiteworksSep 30, 2026
CVE-2026-102114
29Monitor
Kiteworks Core OS Command Injection
HighCVSS 7.2No exploitEPSS 3%
- RCE
- Command injection
accellion · kiteworksSep 30, 2026
CVE-2026-102115
39Monitor
Kiteworks Core Authentication Bypass in the Password Reset Workflow
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
accellion · kiteworksSep 30, 2026
CVE-2026-102116
29Monitor
Kiteworks Email Protection Gateway Path Traversal
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Path traversal
accellion · kiteworksSep 30, 2026
CVE-2026-102117
28Monitor
Kiteworks Core Remote Code Execution
HighCVSS 7.2No exploitEPSS 1%
- RCE
accellion · kiteworksSep 30, 2026
CVE-2026-102118
31Monitor
Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
accellion · kiteworksSep 30, 2026
CVE-2026-102119
28Monitor
Kiteworks Email Protection Gateway Path Traversal
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Path traversal
accellion · kiteworksSep 30, 2026
CVE-2026-102120
35Monitor
Kiteworks Core OS Command Injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
accellion · kiteworksSep 30, 2026
CVE-2026-102121
34Monitor
Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Info leak
accellion · kiteworksSep 30, 2026
CVE-2026-102123
29Monitor
Kiteworks Core Path Traversal
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Path traversal
accellion · kiteworksSep 30, 2026
CVE-2026-102125
35Monitor
Kiteworks Core Sandbox Escape
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
accellion · kiteworksSep 30, 2026
CVE-2026-102126
32Monitor
Kiteworks Core Stored Cross-site Scripting (XSS)
HighCVSS 8.1No exploitEPSS 0%
- XSS
accellion · kiteworksSep 30, 2026
CVE-2026-102127
28Monitor
Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- XXE
accellion · kiteworksSep 30, 2026
CVE-2026-102128
30Monitor
Kiteworks Email Protection Gateway Improper Authentication
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
accellion · kiteworksSep 30, 2026
CVE-2026-102129
28Monitor
Kiteworks Core Incorrect Privilege Assignment
HighCVSS 7.2No exploitEPSS 0%
accellion · kiteworksSep 30, 2026
CVE-2026-102130
28Monitor
Kiteworks Email Protection Gateway Remote Code Execution
HighCVSS 7.2No exploitEPSS 1%
- RCE
accellion · kiteworksSep 30, 2026
CVE-2026-102131
28Monitor
Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity
HighCVSS 7.2No exploitEPSS 1%
- RCE
accellion · kiteworksSep 30, 2026
CVE-2026-102132
28Monitor
Kiteworks Core Privilege Escalation through Improper Access Control
HighCVSS 7.2No exploitEPSS 1%
- Broken access control (IDOR)
accellion · kiteworksSep 30, 2026
CVE-2026-102136
25Monitor
Kiteworks Core Command Execution through Configuration Injection
MediumCVSS 6.3No exploitEPSS 0%
- RCE
- Local privilege escalation
accellion · kiteworksSep 30, 2026
CVE-2026-102142
28Monitor
Kiteworks Core Remote Code Execution through Server-Side Template Injection
HighCVSS 7.2No exploitEPSS 1%
- RCE
- SSTI
accellion · kiteworksSep 30, 2026
CVE-2026-102143
30Monitor
Kiteworks Email Protection Gateway Unrestricted Upload of File with Dangerous Type
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- File upload
accellion · kiteworksSep 30, 2026
CVE-2026-102147
37Monitor
Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
accellion · kiteworksSep 30, 2026
CVE-2026-102149
37Monitor
Kiteworks Email Protection Gateway Improper Access Control
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
accellion · kiteworksSep 30, 2026
CVE-2026-102150
28Monitor
Kiteworks Secure Data Forms Missing Authentication for Critical Function
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
accellion · kiteworksSep 30, 2026
CVE-2026-102995
34Monitor
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-102996
34Monitor
pypdf: Possible large memory usage when parsing font data
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-102997
34Monitor
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-102998
34Monitor
pypdf: Possible long runtimes when generating appearance streams
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-102999
34Monitor
pypdf: Possible long runtimes with large amount of embedded files
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-103000
34Monitor
pypdf: Possible large memory usage when retrieving alphabetical page labels
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-51568
32Monitor
modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
Sep 30, 2026
CVE-2026-51570
32Monitor
modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
Sep 30, 2026
CVE-2026-51852
30Monitor
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_file_b64.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Sep 30, 2026
CVE-2026-51853
30Monitor
agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__init__.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Sep 30, 2026
CVE-2026-51856
39Monitor
In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 30, 2026
CVE-2026-51857
39Monitor
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter w
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 30, 2026
CVE-2026-51858
39Monitor
In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an appr
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 30, 2026
CVE-2026-51859
36Monitor
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:29
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
Sep 30, 2026
CVE-2026-51860
30Monitor
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_exec.py.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Sep 30, 2026
CVE-2026-51861
39Monitor
bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 30, 2026
CVE-2026-51862
36Monitor
DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
Sep 30, 2026
CVE-2026-51864
36Monitor
DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_a
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
Sep 30, 2026
CVE-2026-51866
39Monitor
In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 30, 2026
CVE-2026-51867
39Monitor
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 30, 2026
CVE-2026-51869
39Monitor
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 30, 2026
CVE-2026-51870
39Monitor
DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
Sep 30, 2026
CVE-2026-51871
39Monitor
Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achiev
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 30, 2026
CVE-2026-51872
39Monitor
Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 30, 2026
CVE-2026-92172
35Monitor
Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.hori
HighCVSS 8.8No exploitEPSS 0%
meta platforms, inc · meta horizon osSep 30, 2026
CVE-2026-92173
36Monitor
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculu
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
meta platforms, inc · meta horizon osSep 30, 2026
CVE-2026-101283
36Monitor
iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the atta
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Memory safety
esnet · iperf3Sep 30, 2026
CVE-2026-103584
4Monitor
attacker-controlled javascript license URL via XSS
LowCVSS 1.1Proof of conceptEPSS 0%
- XSS
the wikimedia foundation · mediawiki commonsmetadata extensionSep 30, 2026
CVE-2026-103585
4Monitor
attacker-controlled javascript license URL via XSS
LowCVSS 1.2Proof of conceptEPSS 0%
- XSS
the wikimedia foundation · mediawiki mediasearch extensionSep 30, 2026
CVE-2026-103591
34Monitor
DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
asyncfuncai · deepwiki-openSep 30, 2026