By publication date

Exploited and new serious CVEs: October 2026

5,308 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 54

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
27Monitor	CVE-2026-103532No exploit	immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorizationimmich-app · immich · CWE-266 Pre-auth	Medium6.9	—	0.3%	Oct 1, 2026
35Monitor	CVE-2026-13313No exploit	An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass sasus · router · CWE-489	High8.9	—	0.6%	Oct 1, 2026
37Monitor	CVE-2026-14157No exploit	Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands viaasus · router · CWE-134 RCE	Critical9.4	—	0.7%	Oct 1, 2026
28Monitor	CVE-2026-93495No exploit	Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a asus · motherboard(prime z390-a ) · CWE-665	High7.0	—	0.1%	Oct 1, 2026
30Monitor	CVE-2026-92245No exploit	Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recucroixhaug · simply schedule appointments · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Oct 1, 2026
28Monitor	CVE-2026-96561No exploit	AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injectiontigroumeow · ai engine – the chatbot, ai framework & mcp for wordpress · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 1, 2026
37Monitor	CVE-2026-76142No exploit	Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interfacegenians, inc · genian nac 5.0.75 lts release · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.3%	Oct 1, 2026
29Monitor	CVE-2026-76143No exploit	Genians, Inc Genian SSL PNS Multi Factor Authentication Bypassgenians, inc · genian ssl pns (frodo-core) · CWE-862 Auth bypass Broken access control (IDOR)	High7.3	—	0.3%	Oct 1, 2026
30Monitor	CVE-2026-76145No exploit	Genians, Inc Genian SSL PNS Improper Privilege Managementgenians, inc · genian ssl pns (frodo-core) · CWE-269	High7.5	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-76146No exploit	Genians, Inc Genian SSL PNS OS Command Injectiongenians, inc · genian ssl pns (xenics_auther) · CWE-78 pre-auth RCE Command injection	High8.4	—	1.9%	Oct 1, 2026
28Monitor	CVE-2026-78210No exploit	In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without octopus deploy · octopus server · CWE-863 RCE Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
37Monitor	CVE-2026-82824No exploit	Path traversal may allow arbitrary files to be viewed, created, modified, or deletedhitachi industrial equipment systems · hitachi coding software suite · CWE-35 Pre-auth Path traversal	Critical9.3	—	0.3%	Oct 1, 2026
37Monitor	CVE-2026-82825No exploit	Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performedhitachi industrial equipment systems · hitachi coding software suite · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-82826No exploit	Authentication information or sensitive data may be intercepted in transithitachi industrial equipment systems · hitachi coding software suite · CWE-319 Pre-auth Weak crypto	High8.7	—	0.1%	Oct 1, 2026
37Monitor	CVE-2026-82827No exploit	A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokenshitachi industrial equipment systems · hitachi coding software suite · CWE-321 Pre-auth Hard-coded credentials	Critical9.3	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-82828No exploit	Improper authorization may allow a general user to perform operations equivalent to those available with administrator privilegeshitachi industrial equipment systems · hitachi coding software suite · CWE-863 Broken access control (IDOR)	High8.7	—	0.2%	Oct 1, 2026
37Monitor	CVE-2026-82829No exploit	Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication processhitachi industrial equipment systems · hitachi coding software suite · CWE-912 Pre-auth Hard-coded credentials	Critical9.3	—	0.2%	Oct 1, 2026
36Monitor	CVE-2026-92966Proof of concept	Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Fieldlatepoint · appointment booking plugin – latepoint \| calendar & scheduling for wordpress · CWE-94 pre-auth RCE	Critical9.1	—	0.4%	Oct 1, 2026
35Monitor	CVE-2026-101147No exploit	Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRFunknown · featured image from url (fifu) · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 1, 2026
40Plan	CVE-2026-101148No exploit	BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Keyunknown · backupsheep wordpress backup plugin · CWE-73 Pre-auth Path traversal	Critical10.0	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-19253No exploit	Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_urlunknown · cache enabler · CWE-73 Pre-auth Path traversal	High8.7	—	0.2%	Oct 1, 2026
35Monitor	CVE-2026-80275No exploit	Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpointcomelit group s.p.a. · 1456b multi-user gateway · CWE-425	High8.8	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-80276No exploit	Comelit 1456B gateway exposes remote configuration password via unauthenticated management interfacecomelit group s.p.a. · 1456b multi-user gateway · CWE-306 Pre-auth Auth bypass	High7.5	—	0.3%	Oct 1, 2026
30Monitor	CVE-2026-81739No exploit	Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callbackunknown · paytm payment gateway · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-81809No exploit	Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callbackunknown · paytm payment gateway · CWE-89 Pre-auth SQL injection	High7.5	—	0.1%	Oct 1, 2026
28Monitor	CVE-2026-85679No exploit	Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Keyextendify · extendify · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-89296No exploit	Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameterunknown · pro like button · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-92412No exploit	Five Star Restaurant Reviews < 2.3.14 - Reflected XSSunknown · five star restaurant reviews · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 1, 2026
30Monitor	CVE-2026-96255No exploit	Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Logunknown · payments for hubtel · CWE-200 Pre-auth Info leak	High7.5	—	0.2%	Oct 1, 2026
37Monitor	CVE-2025-41753No exploit	Path traversal in dynamically created BACnet File Objectswago · 0751-9x01 · CWE-22 Pre-auth Path traversal	Critical9.3	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-103651No exploit	MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypassmisp · misp · CWE-287 Auth bypass	High7.6	—	0.1%	Oct 1, 2026
39Monitor	CVE-2026-15989Proof of concept	Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameterwebrehab · super forms – drag & drop form builder · CWE-269 Pre-auth	Critical9.8	—	0.2%	Oct 1, 2026
35Monitor	CVE-2026-19807No exploit	ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Toolbytecorestack · bytecorestack – mcp connector for ai tools · CWE-269	High8.8	—	0.3%	Oct 1, 2026
39Monitor	CVE-2026-75957No exploit	Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parametersuperdav42 · ultimate multisite – wordpress multisite saas & waas platform · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-93882No exploit	LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameterthimpress · learnpress – wordpress lms plugin for create and sell online courses · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Oct 1, 2026
30Monitor	CVE-2026-103431No exploit	Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instancesCWE-150	High7.7	—	0.1%	Oct 1, 2026
37Monitor	CVE-2026-103655No exploit	MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Periodmisp · misp · CWE-294 Pre-auth Auth bypass	Critical9.3	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-103659No exploit	MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributesmisp · misp · CWE-285 Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-14995No exploit	Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Pathoptimizingmatters · autoptimize · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 1, 2026
32Monitor	CVE-2026-15983No exploit	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameterwebrehab · super forms – drag & drop form builder · CWE-73 Path traversal	High8.1	—	0.5%	Oct 1, 2026
28Monitor	CVE-2026-85235No exploit	Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Fieldwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-92244No exploit	PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fieldswpovernight · pdf invoices & packing slips for woocommerce · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 1, 2026
35Monitor	CVE-2026-95687No exploit	WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endwpclever · wpc shop as a customer for woocommerce · CWE-269	High8.8	—	0.4%	Oct 1, 2026
28Monitor	CVE-2026-96573No exploit	Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderecodepeople · appointment hour booking – booking calendar · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-96813No exploit	Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields10web · form maker by 10web – mobile-friendly drag & drop contact form builder · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-97661No exploit	Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Fieldscottpaterson · business essentials for contact form 7 · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103488No exploit	In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access rejetbrains · youtrack · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103490No exploit	In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksjetbrains · youtrack · CWE-862 Broken access control (IDOR)	High7.2	—	0.4%	Oct 1, 2026
32Monitor	CVE-2026-103493No exploit	In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possiblejetbrains · youtrack · CWE-79 Pre-auth XSS	High8.1	—	0.2%	Oct 1, 2026
22Monitor	CVE-2026-103497No exploit	In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationjetbrains · youtrack · CWE-918 SSRF	Medium5.5	—	0.1%	Oct 1, 2026
29Monitor	CVE-2026-64946No exploit	CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Managerpandora fms · pandora fms · CWE-79 Pre-auth XSS CSRF	High7.4	—	0.1%	Oct 1, 2026
30Monitor	CVE-2026-64947No exploit	CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Managerpandora fms · pandora fms · CWE-352 pre-auth RCE File upload CSRF	High7.5	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-64948No exploit	Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosurepandora fms · pandora fms · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-64949No exploit	Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Managerpandora fms · pandora fms · CWE-434 RCE File upload	High8.6	—	0.3%	Oct 1, 2026
33Monitor	CVE-2026-64950No exploit	Stored Cross-Site Scripting via Directory Name in File Manager Create Directorypandora fms · pandora fms · CWE-79 XSS	High8.4	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-75786No exploit	SQL Injection in Grafana Integration Endpoint (query.php)pandora fms · pandora fms · CWE-89 SQL injection	High7.2	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-92144No exploit	Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameterwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Pre-auth XSS	High7.2	—	0.5%	Oct 1, 2026
28Monitor	CVE-2026-96577No exploit	Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabledred hat · assisted installer for red hat openshift container platform 2 · CWE-306 Pre-auth Auth bypass	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103082No exploit	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerabilityla-studio · la-studio element kit for elementor · CWE-918 Pre-auth SSRF	High7.2	—	0.1%	Oct 1, 2026
37Monitor	CVE-2026-103244No exploit	ground-station before 0.8.0 Authentication Bypass via setup.restoresgoudelis · ground-station · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.5%	Oct 1, 2026
33Monitor	CVE-2026-103246No exploit	n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspectionn8n-io · n8n · CWE-639 Broken access control (IDOR)	High8.3	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103248No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabasen8n-io · n8n · CWE-89 Pre-auth SQL injection	High7.1	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-103250No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memoryn8n-io · n8n · CWE-943 Pre-auth SQL injection	High7.0	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-103251No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSubn8n-io · n8n · CWE-862 Auth bypass Broken access control (IDOR)	High7.5	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103252No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpointn8n-io · n8n · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103253No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Tablen8n-io · n8n · CWE-89 Pre-auth SQL injection	High7.0	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103254No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generationn8n-io · n8n · CWE-22 Path traversal	High7.0	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103255No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabasen8n-io · n8n · CWE-73 Pre-auth Path traversal	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103256No exploit	n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hookn8n-io · n8n · CWE-522 Info leak	High7.1	—	0.2%	Oct 1, 2026
32Monitor	CVE-2026-103257No exploit	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Noden8n-io · n8n · CWE-22 Pre-auth Path traversal	High8.1	—	0.4%	Oct 1, 2026
34Monitor	CVE-2026-103259No exploit	n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentialsn8n-io · n8n · CWE-863 Broken access control (IDOR)	High8.5	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-103262No exploit	Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClienttornadoweb · tornado · CWE-409 Pre-auth	High8.7	—	0.5%	Oct 1, 2026
32Monitor	CVE-2026-103263No exploit	Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlinktornadoweb · tornado · CWE-59 Pre-auth Path traversal	High8.2	—	0.5%	Oct 1, 2026
37Monitor	CVE-2026-103264No exploit	Fleet before 4.87.0 Authentication Bypass via Device Identifiersfleetdm · fleet · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-103266No exploit	Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modificationtryghost · ghost · CWE-863 Pre-auth Auth bypass Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-103268No exploit	Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Resettryghost · ghost · CWE-862 Auth bypass Broken access control (IDOR)	High8.7	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-103271No exploit	Ghost 4.0.0 before 6.63.0 Restricted Content Bypasstryghost · ghost · CWE-863 Pre-auth Auth bypass Broken access control (IDOR)	High8.7	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-103272No exploit	Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content APItryghost · ghost · CWE-203 Pre-auth Auth bypass	High8.7	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-103277No exploit	Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbedtryghost · ghost · CWE-79 Pre-auth XSS	High8.6	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-103278No exploit	Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframetryghost · ghost · CWE-23 Path traversal	High8.5	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-103279No exploit	Ghost 3.10.0 before 6.34.0 Session Invalidation Bypasstryghost · ghost · CWE-613	High7.6	—	0.1%	Oct 1, 2026
34Monitor	CVE-2026-103283No exploit	Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handlingtryghost · ghost · CWE-613 Auth bypass	High8.6	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-103286No exploit	Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notificationstryghost · ghost · CWE-266	High8.5	—	0.1%	Oct 1, 2026
28Monitor	CVE-2026-103288No exploit	Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Liketryghost · ghost · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-103289No exploit	Ghost 5.9.0 before 6.44.1 Authorization Bypass via Commentstryghost · ghost · CWE-943 SQL injection	High7.1	—	0.2%	Oct 1, 2026
20Monitor	CVE-2026-103290No exploit	Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSizetryghost · ghost · CWE-35 Path traversal	Medium5.1	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-103292No exploit	Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_headtryghost · ghost · CWE-79 XSS	High8.6	—	0.2%	Oct 1, 2026
33Monitor	CVE-2026-103757No exploit	Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generationbudibase · budibase · CWE-918 SSRF	High8.3	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-103758No exploit	Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Routeobot-platform · obot · CWE-863 Broken access control (IDOR)	High8.6	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-88789Proof of concept	Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardeningapache software foundation · apache camel quarkus · CWE-611 Pre-auth XXE	High8.6	—	0.5%	Oct 1, 2026
32Monitor	CVE-2026-103678No exploit	Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi valuetnef project · tnef · CWE-125 Pre-auth Memory safety	High8.1	—	0.2%	Oct 1, 2026
32Monitor	CVE-2026-94250No exploit	Apache APISIX: Batch response aggregation can exhaust worker memoryapache software foundation · apache apisix · CWE-770 Pre-auth Denial of service	High8.2	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-102379No exploit	WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerabilityvillatheme · buildkit – product builder for woocommerce – custom pc builder · CWE-89 SQL injection	High8.5	—	0.2%	Oct 1, 2026
26Monitor	CVE-2026-103063No exploit	WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerabilitywpmet · elementskit elementor addons lite · CWE-79 XSS	Medium6.5	—	0.1%	Oct 1, 2026
32Monitor	CVE-2026-103067No exploit	WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerabilitymemberful · memberful - membership plugin · CWE-352 CSRF	High8.0	—	0.1%	Oct 1, 2026
34Monitor	CVE-2026-103338No exploit	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-89 SQL injection	High8.5	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-62059Proof of concept	WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerabilityultimate member · ultimate member · CWE-89 SQL injection	High7.6	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-62060No exploit	WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerabilitycaptivateaudio · captivate sync · CWE-89 SQL injection	High7.6	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-102504No exploit	Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wioltonycoz · imager · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 1, 2026
35Monitor	CVE-2026-66246No exploit	HCL iControl is affected by multiple security vulnerabilitieshcl software · icontrol · CWE-250 Auth bypass Broken access control (IDOR)	High8.8	—	0.3%	Oct 1, 2026

CVE-2026-103532
27Monitor
immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
immich-app · immichOct 1, 2026
CVE-2026-13313
35Monitor
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass s
HighCVSS 8.9No exploitEPSS 0%
asus · routerOct 1, 2026
CVE-2026-14157
37Monitor
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
asus · routerOct 1, 2026
CVE-2026-93495
28Monitor
Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a
HighCVSS 7.0No exploitEPSS 0%
asus · motherboard(prime z390-a )Oct 1, 2026
CVE-2026-92245
30Monitor
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recu
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
croixhaug · simply schedule appointmentsOct 1, 2026
CVE-2026-96561
28Monitor
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpressOct 1, 2026
CVE-2026-76142
37Monitor
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
genians, inc · genian nac 5.0.75 lts releaseOct 1, 2026
CVE-2026-76143
29Monitor
Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
HighCVSS 7.3No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
genians, inc · genian ssl pns (frodo-core)Oct 1, 2026
CVE-2026-76145
30Monitor
Genians, Inc Genian SSL PNS Improper Privilege Management
HighCVSS 7.5No exploitEPSS 0%
genians, inc · genian ssl pns (frodo-core)Oct 1, 2026
CVE-2026-76146
34Monitor
Genians, Inc Genian SSL PNS OS Command Injection
HighCVSS 8.4No exploitEPSS 1%
- pre-auth RCE
- Command injection
genians, inc · genian ssl pns (xenics_auther)Oct 1, 2026
CVE-2026-78210
28Monitor
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
octopus deploy · octopus serverOct 1, 2026
CVE-2026-82824
37Monitor
Path traversal may allow arbitrary files to be viewed, created, modified, or deleted
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Path traversal
hitachi industrial equipment systems · hitachi coding software suiteOct 1, 2026
CVE-2026-82825
37Monitor
Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
hitachi industrial equipment systems · hitachi coding software suiteOct 1, 2026
CVE-2026-82826
34Monitor
Authentication information or sensitive data may be intercepted in transit
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
hitachi industrial equipment systems · hitachi coding software suiteOct 1, 2026
CVE-2026-82827
37Monitor
A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
hitachi industrial equipment systems · hitachi coding software suiteOct 1, 2026
CVE-2026-82828
34Monitor
Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
hitachi industrial equipment systems · hitachi coding software suiteOct 1, 2026
CVE-2026-82829
37Monitor
Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
hitachi industrial equipment systems · hitachi coding software suiteOct 1, 2026
CVE-2026-92966
36Monitor
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
CriticalCVSS 9.1Proof of conceptEPSS 0%
- pre-auth RCE
latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpressOct 1, 2026
CVE-2026-101147
35Monitor
Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
unknown · featured image from url (fifu)Oct 1, 2026
CVE-2026-101148
40Plan
BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Path traversal
unknown · backupsheep wordpress backup pluginOct 1, 2026
CVE-2026-19253
34Monitor
Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
unknown · cache enablerOct 1, 2026
CVE-2026-80275
35Monitor
Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
HighCVSS 8.8No exploitEPSS 0%
comelit group s.p.a. · 1456b multi-user gatewayOct 1, 2026
CVE-2026-80276
30Monitor
Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
comelit group s.p.a. · 1456b multi-user gatewayOct 1, 2026
CVE-2026-81739
30Monitor
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · paytm payment gatewayOct 1, 2026
CVE-2026-81809
30Monitor
Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · paytm payment gatewayOct 1, 2026
CVE-2026-85679
28Monitor
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
extendify · extendifyOct 1, 2026
CVE-2026-89296
34Monitor
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · pro like buttonOct 1, 2026
CVE-2026-92412
28Monitor
Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · five star restaurant reviewsOct 1, 2026
CVE-2026-96255
30Monitor
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
unknown · payments for hubtelOct 1, 2026
CVE-2025-41753
37Monitor
Path traversal in dynamically created BACnet File Objects
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Path traversal
wago · 0751-9x01Oct 1, 2026
CVE-2026-103651
30Monitor
MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
HighCVSS 7.6No exploitEPSS 0%
- Auth bypass
misp · mispOct 1, 2026
CVE-2026-15989
39Monitor
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
webrehab · super forms – drag & drop form builderOct 1, 2026
CVE-2026-19807
35Monitor
ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
HighCVSS 8.8No exploitEPSS 0%
bytecorestack · bytecorestack – mcp connector for ai toolsOct 1, 2026
CVE-2026-75957
39Monitor
Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
superdav42 · ultimate multisite – wordpress multisite saas & waas platformOct 1, 2026
CVE-2026-93882
30Monitor
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
thimpress · learnpress – wordpress lms plugin for create and sell online coursesOct 1, 2026
CVE-2026-103431
30Monitor
Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances
HighCVSS 7.7No exploitEPSS 0%
Oct 1, 2026
CVE-2026-103655
37Monitor
MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
misp · mispOct 1, 2026
CVE-2026-103659
28Monitor
MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
misp · mispOct 1, 2026
CVE-2026-14995
28Monitor
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
optimizingmatters · autoptimizeOct 1, 2026
CVE-2026-15983
32Monitor
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
webrehab · super forms – drag & drop form builderOct 1, 2026
CVE-2026-85235
28Monitor
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builderOct 1, 2026
CVE-2026-92244
28Monitor
PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpovernight · pdf invoices & packing slips for woocommerceOct 1, 2026
CVE-2026-95687
35Monitor
WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX End
HighCVSS 8.8No exploitEPSS 0%
wpclever · wpc shop as a customer for woocommerceOct 1, 2026
CVE-2026-96573
28Monitor
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Rendere
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
codepeople · appointment hour booking – booking calendarOct 1, 2026
CVE-2026-96813
28Monitor
Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
10web · form maker by 10web – mobile-friendly drag & drop contact form builderOct 1, 2026
CVE-2026-97661
28Monitor
Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
scottpaterson · business essentials for contact form 7Oct 1, 2026
CVE-2026-103488
28Monitor
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jetbrains · youtrackOct 1, 2026
CVE-2026-103490
28Monitor
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
jetbrains · youtrackOct 1, 2026
CVE-2026-103493
32Monitor
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- XSS
jetbrains · youtrackOct 1, 2026
CVE-2026-103497
22Monitor
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
MediumCVSS 5.5No exploitEPSS 0%
- SSRF
jetbrains · youtrackOct 1, 2026
CVE-2026-64946
29Monitor
CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
pandora fms · pandora fmsOct 1, 2026
CVE-2026-64947
30Monitor
CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- File upload
- CSRF
pandora fms · pandora fmsOct 1, 2026
CVE-2026-64948
28Monitor
Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
pandora fms · pandora fmsOct 1, 2026
CVE-2026-64949
34Monitor
Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager
HighCVSS 8.6No exploitEPSS 0%
- RCE
- File upload
pandora fms · pandora fmsOct 1, 2026
CVE-2026-64950
33Monitor
Stored Cross-Site Scripting via Directory Name in File Manager Create Directory
HighCVSS 8.4No exploitEPSS 0%
- XSS
pandora fms · pandora fmsOct 1, 2026
CVE-2026-75786
28Monitor
SQL Injection in Grafana Integration Endpoint (query.php)
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
pandora fms · pandora fmsOct 1, 2026
CVE-2026-92144
28Monitor
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builderOct 1, 2026
CVE-2026-96577
28Monitor
Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
red hat · assisted installer for red hat openshift container platform 2Oct 1, 2026
CVE-2026-103082
28Monitor
WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- SSRF
la-studio · la-studio element kit for elementorOct 1, 2026
CVE-2026-103244
37Monitor
ground-station before 0.8.0 Authentication Bypass via setup.restore
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
sgoudelis · ground-stationOct 1, 2026
CVE-2026-103246
33Monitor
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
n8n-io · n8nOct 1, 2026
CVE-2026-103248
28Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SQL injection
n8n-io · n8nOct 1, 2026
CVE-2026-103250
28Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- SQL injection
n8n-io · n8nOct 1, 2026
CVE-2026-103251
30Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
HighCVSS 7.5No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
n8n-io · n8nOct 1, 2026
CVE-2026-103252
28Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
n8n-io · n8nOct 1, 2026
CVE-2026-103253
28Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- SQL injection
n8n-io · n8nOct 1, 2026
CVE-2026-103254
28Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
n8n-io · n8nOct 1, 2026
CVE-2026-103255
28Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
n8n-io · n8nOct 1, 2026
CVE-2026-103256
28Monitor
n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
HighCVSS 7.1No exploitEPSS 0%
- Info leak
n8n-io · n8nOct 1, 2026
CVE-2026-103257
32Monitor
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Path traversal
n8n-io · n8nOct 1, 2026
CVE-2026-103259
34Monitor
n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
n8n-io · n8nOct 1, 2026
CVE-2026-103262
34Monitor
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
tornadoweb · tornadoOct 1, 2026
CVE-2026-103263
32Monitor
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
tornadoweb · tornadoOct 1, 2026
CVE-2026-103264
37Monitor
Fleet before 4.87.0 Authentication Bypass via Device Identifiers
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
fleetdm · fleetOct 1, 2026
CVE-2026-103266
28Monitor
Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
tryghost · ghostOct 1, 2026
CVE-2026-103268
34Monitor
Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
tryghost · ghostOct 1, 2026
CVE-2026-103271
34Monitor
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
tryghost · ghostOct 1, 2026
CVE-2026-103272
34Monitor
Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
tryghost · ghostOct 1, 2026
CVE-2026-103277
34Monitor
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
tryghost · ghostOct 1, 2026
CVE-2026-103278
34Monitor
Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
tryghost · ghostOct 1, 2026
CVE-2026-103279
30Monitor
Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
HighCVSS 7.6No exploitEPSS 0%
tryghost · ghostOct 1, 2026
CVE-2026-103283
34Monitor
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
tryghost · ghostOct 1, 2026
CVE-2026-103286
34Monitor
Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
HighCVSS 8.5No exploitEPSS 0%
tryghost · ghostOct 1, 2026
CVE-2026-103288
28Monitor
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
tryghost · ghostOct 1, 2026
CVE-2026-103289
28Monitor
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
tryghost · ghostOct 1, 2026
CVE-2026-103290
20Monitor
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
MediumCVSS 5.1No exploitEPSS 0%
- Path traversal
tryghost · ghostOct 1, 2026
CVE-2026-103292
34Monitor
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
HighCVSS 8.6No exploitEPSS 0%
- XSS
tryghost · ghostOct 1, 2026
CVE-2026-103757
33Monitor
Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
HighCVSS 8.3No exploitEPSS 0%
- SSRF
budibase · budibaseOct 1, 2026
CVE-2026-103758
34Monitor
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
obot-platform · obotOct 1, 2026
CVE-2026-88789
34Monitor
Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
- XXE
apache software foundation · apache camel quarkusOct 1, 2026
CVE-2026-103678
32Monitor
Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
tnef project · tnefOct 1, 2026
CVE-2026-94250
32Monitor
Apache APISIX: Batch response aggregation can exhaust worker memory
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache apisixOct 1, 2026
CVE-2026-102379
34Monitor
WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
villatheme · buildkit – product builder for woocommerce – custom pc builderOct 1, 2026
CVE-2026-103063
26Monitor
WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
MediumCVSS 6.5No exploitEPSS 0%
- XSS
wpmet · elementskit elementor addons liteOct 1, 2026
CVE-2026-103067
32Monitor
WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.0No exploitEPSS 0%
- CSRF
memberful · memberful - membership pluginOct 1, 2026
CVE-2026-103338
34Monitor
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
unlimited elements · unlimited elements for elementor (free widgets, addons, templates)Oct 1, 2026
CVE-2026-62059
30Monitor
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
HighCVSS 7.6Proof of conceptEPSS 0%
- SQL injection
ultimate member · ultimate memberOct 1, 2026
CVE-2026-62060
30Monitor
WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
captivateaudio · captivate syncOct 1, 2026
CVE-2026-102504
30Monitor
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
tonycoz · imagerOct 1, 2026
CVE-2026-66246
35Monitor
HCL iControl is affected by multiple security vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
hcl software · icontrolOct 1, 2026