By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 10 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-106040No exploit	Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPCkvcache-ai · mooncake · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 6, 2026
36Monitor	CVE-2026-77178No exploit	Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cppCWE-787 Pre-auth Memory safety	Critical9.1	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-85523No exploit	OS Command Injection in Felisify Informatics' SambaBoxfelisify information technologies industry and trade inc. · sambabox · CWE-78 RCE Command injection	High8.8	—	0.9%	Oct 6, 2026
39Monitor	CVE-2026-91140No exploit	OS command injection in Progress Software Autonomous REST Connector GenAI Agentsprogress software · autonomous rest connector genai agents · CWE-78 pre-auth RCE Command injection	Critical9.6	—	2.0%	Oct 6, 2026
34Monitor	CVE-2026-104069No exploit	HortusFox < 6.2 Remote Code Execution via Theme Importdanielbrendel · hortusfox-web · CWE-434 RCE File upload	High8.6	—	0.5%	Oct 6, 2026
30Monitor	CVE-2026-105791No exploit	Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injectionmicrosoft · ufo · CWE-88 pre-auth RCE	High7.5	—	0.7%	Oct 6, 2026
36Monitor	CVE-2026-105793No exploit	Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`microsoft · ufo · CWE-78 RCE Command injection	Critical9.1	—	0.8%	Oct 6, 2026
36Monitor	CVE-2026-105794No exploit	MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLmicrosoft · msquic · CWE-295 Pre-auth Weak crypto	Critical9.1	—	1.0%	Oct 6, 2026
35Monitor	CVE-2026-105796No exploit	Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generatorsmicrosoft · kiota · CWE-94 pre-auth RCE	High8.8	—	0.8%	Oct 6, 2026
35Monitor	CVE-2026-105797No exploit	SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)microsoft · simplechat · CWE-78 RCE Command injection	High8.8	—	0.5%	Oct 6, 2026
34Monitor	CVE-2026-105798No exploit	SimpleChat: Stored XSS via group document filename in inline onclick handlermicrosoft · simplechat · CWE-79 XSS	High8.7	—	0.4%	Oct 6, 2026
33Monitor	CVE-2026-105801No exploit	openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generationopenapi-generators · openapi-python-client · CWE-94 RCE	High8.4	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-54472No exploit	Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs.dell · container storage modules · CWE-798 Pre-auth Hard-coded credentials	High7.5	—	0.3%	Oct 6, 2026
39Monitor	CVE-2026-61421No exploit	Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorizationdell · container storage modules · CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	0.3%	Oct 6, 2026
40Plan	CVE-2026-63688No exploit	Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in thdell · container storage modules · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.4%	Oct 6, 2026
40Plan	CVE-2026-63692No exploit	Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability.dell · container storage modules · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.4%	Oct 6, 2026
39Monitor	CVE-2026-67269No exploit	Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the Contadell · container storage modules · CWE-269	Critical9.9	—	0.3%	Oct 6, 2026
34Monitor	CVE-2026-105806No exploit	Payload: Improper access control for MCP API keyspayloadcms · payload · CWE-862 Broken access control (IDOR)	High8.6	—	0.2%	Oct 6, 2026
37Monitor	CVE-2026-105844Proof of concept	Payload: Prototype pollution in Payload Import Export pluginpayloadcms · payload · CWE-1321 pre-auth RCE Prototype pollution	Critical9.3	—	0.7%	Oct 6, 2026
39Monitor	CVE-2026-105845No exploit	Payload: SQL Injection in SQLite and Postgrespayloadcms · payload · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.3%	Oct 6, 2026
20Monitor	CVE-2026-105950Proof of concept	getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scriptinggetformwork · formwork · CWE-79 XSS	Medium5.1	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-26287No exploit	External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationexternal-secrets · external-secrets · CWE-696	High7.1	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-61411No exploit	Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability.dell · container storage modules · CWE-532 Info leak	High7.7	—	0.2%	Oct 6, 2026
29Monitor	CVE-2026-63690No exploit	Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csidell · container storage modules · CWE-306 Pre-auth Auth bypass	High7.4	—	0.1%	Oct 6, 2026
38Monitor	CVE-2026-63691No exploit	Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMdell · container storage modules · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.1%	Oct 6, 2026
29Monitor	CVE-2026-67270No exploit	Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-serverdell · container storage modules · CWE-295 Pre-auth Weak crypto	High7.4	—	0.0%	Oct 6, 2026
38Monitor	CVE-2026-67273No exploit	Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engindell · container storage modules · CWE-1336 RCE SSTI	Critical9.6	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-76105No exploit	Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability.dell · container storage modules · CWE-330 Weak crypto	High7.1	—	0.0%	Oct 6, 2026
39Monitor	CVE-2025-71383No exploit	Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/loCWE-20 Pre-auth	Critical9.8	—	0.4%	Oct 6, 2026
26Monitor	CVE-2025-71384Proof of concept	Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based bufferCWE-121 RCE Memory safety	Medium6.7	—	0.1%	Oct 6, 2026
37Monitor	CVE-2026-104070No exploit	SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCEspip · spip crayons plugin · CWE-862 pre-auth RCE Broken access control (IDOR)	Critical9.3	—	0.5%	Oct 6, 2026
30Monitor	CVE-2026-104850Proof of concept	MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP servermodelcontextprotocol · typescript-sdk · CWE-345 Pre-auth	High7.5	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-105847No exploit	Payload: Polymorphic join queries could disclose hidden fieldspayloadcms · payload · CWE-200 Info leak	High7.1	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-105849No exploit	Payload: API key disclosure through ordinary document readspayloadcms · payload · CWE-201	High7.7	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-105850No exploit	Payload: Order confirmation validation issue in Payload Ecommercepayloadcms · payload · CWE-837 Pre-auth	High8.8	—	0.3%	Oct 6, 2026
37Monitor	CVE-2026-105851No exploit	Payload: Field access control bypass on auth collectionspayloadcms · payload · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-105853No exploit	Payload: Token refresh and password reset responses may expose restricted user fieldspayloadcms · payload · CWE-200 Info leak	High7.1	—	0.2%	Oct 6, 2026
34Monitor	CVE-2026-105854No exploit	Payload: ReDoS in Multipart Content-Type Validationpayloadcms · payload · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-105855No exploit	Payload: Field-level password update restrictions were not enforcedpayloadcms · payload · CWE-284 Broken access control (IDOR)	High7.6	—	0.2%	Oct 6, 2026
34Monitor	CVE-2026-105856No exploit	Payload: SQL injection in SQLite/Postgrespayloadcms · payload · CWE-89 SQL injection	High8.6	—	0.2%	Oct 6, 2026
40Plan	CVE-2026-105857No exploit	Payload: RCE in Payload Form Builderpayloadcms · payload · CWE-94 pre-auth RCE	Critical10.0	—	0.4%	Oct 6, 2026
32Monitor	CVE-2026-105858No exploit	Payload: Remote Code Execution through first-registerpayloadcms · payload · CWE-94 pre-auth RCE	High8.1	—	0.4%	Oct 6, 2026
39Monitor	CVE-2026-105859No exploit	Payload: Unauthorized update to collection documentspayloadcms · payload · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-105860No exploit	Payload: Tenant authorization bypass in Multi-Tenant Pluginpayloadcms · payload · CWE-862 Broken access control (IDOR)	High7.1	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-105861No exploit	Payload external upload trust validation issuepayloadcms · payload · CWE-200 Info leak	High7.2	—	0.1%	Oct 6, 2026
34Monitor	CVE-2026-105862No exploit	Payload: Bypassed sanitization of user uploaded SVGspayloadcms · payload · CWE-79 XSS	High8.7	—	0.2%	Oct 6, 2026
36Monitor	CVE-2026-105863No exploit	Payload authentication token field handling issuepayloadcms · payload · CWE-290 Pre-auth Auth bypass	Critical9.2	—	0.5%	Oct 6, 2026
32Monitor	CVE-2026-105865No exploit	Payload: Incomplete validation during the upload file lifecyclepayloadcms · payload · CWE-22 Path traversal	High8.1	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-105867No exploit	Payload: Client uploads could overwrite S3 objectspayloadcms · payload · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 6, 2026
34Monitor	CVE-2026-105868No exploit	Payload: Uploaded XML files could execute same-origin JavaScriptpayloadcms · payload · CWE-434 File upload	High8.6	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-106100No exploit	Payload: Field-level write access bypass in Payload on MongoDBpayloadcms · payload · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 6, 2026
40Plan	CVE-2026-106102No exploit	Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()quasarframework · quasar · CWE-79 Pre-auth XSS	Critical10.0	—	0.2%	Oct 6, 2026
40Plan	CVE-2026-106218No exploit	In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possiblejetbrains · teamcity · CWE-184 pre-auth RCE	Critical10.0	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-106219No exploit	In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the serverjetbrains · teamcity · CWE-73 Pre-auth Path traversal	High7.5	—	0.7%	Oct 6, 2026
30Monitor	CVE-2026-95140No exploit	kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java.CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Oct 6, 2026
32Monitor	CVE-2025-45871No exploit	LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticatedCWE-89 SQL injection	High8.1	—	0.2%	Oct 6, 2026
35Monitor	CVE-2026-101207No exploit	Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Eledell · openmanage integration · CWE-78 RCE Command injection	High8.8	—	0.9%	Oct 6, 2026
28Monitor	CVE-2026-106103No exploit	Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profilequasarframework · quasar · CWE-22 Path traversal	High7.1	—	0.2%	Oct 6, 2026
34Monitor	CVE-2026-106104No exploit	Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR serverquasarframework · quasar · CWE-1333 Pre-auth Denial of service	High8.7	—	0.3%	Oct 6, 2026
33Monitor	CVE-2026-106105No exploit	Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsquasarframework · quasar · CWE-732	High8.4	—	0.0%	Oct 6, 2026
28Monitor	CVE-2026-106106No exploit	Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassablequasarframework · quasar · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 6, 2026
33Monitor	CVE-2026-106107No exploit	Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedquasarframework · quasar · CWE-79 Pre-auth XSS	High8.3	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-106110No exploit	ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffersixlabors · imagesharp · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-106112No exploit	ImageSharp: ICC LUT16 output channel count can write beyond Vector4sixlabors · imagesharp · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-106113No exploit	ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexsixlabors · imagesharp · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-106115No exploit	ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffersixlabors · imagesharp · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-106117No exploit	ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharpsixlabors · imagesharp · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 6, 2026
27Monitor	CVE-2026-66666No exploit	WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerabilityautomattic · wordpress · CWE-201 Pre-auth	Medium6.9	—	0.4%	Oct 6, 2026
38Monitor	CVE-2026-102322No exploit	Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a cgoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical9.6	—	0.4%	Oct 6, 2026
28Monitor	CVE-2026-104944Proof of concept	Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500tp-link systems inc. · tapo c500 v2.0 · CWE-823 Pre-auth	High7.1	—	0.2%	Oct 6, 2026
27Monitor	CVE-2026-104945Proof of concept	Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500tp-link systems inc. · tapo c500 v2.0 · CWE-121 Memory safety	Medium6.8	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-105488No exploit	Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vaudevolutions · server · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-106118No exploit	ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB writesixlabors · imagesharp · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 6, 2026
30Monitor	CVE-2026-106121No exploit	RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoSvmware · rabbitmq java client · CWE-835 Pre-auth Denial of service	High7.5	—	0.5%	Oct 6, 2026
34Monitor	CVE-2026-106186No exploit	Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potgoogle · chrome · CWE-427 RCE	High8.6	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-106188No exploit	Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictiogoogle · chrome · CWE-441 Pre-auth	High7.1	—	0.2%	Oct 6, 2026
29Monitor	CVE-2026-106189No exploit	Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bygoogle · chrome · CWE-94 pre-auth RCE	High7.3	—	0.2%	Oct 6, 2026
35Monitor	CVE-2026-106190No exploit	Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 6, 2026
33Monitor	CVE-2026-106191No exploit	Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-862 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-106193No exploit	Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 6, 2026
33Monitor	CVE-2026-106194No exploit	Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer pgoogle · chrome · CWE-862 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.3%	Oct 6, 2026
36Monitor	CVE-2026-106195No exploit	Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access regoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-106196No exploit	Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High7.6	—	0.2%	Oct 6, 2026
38Monitor	CVE-2026-106197No exploit	Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Oct 6, 2026
32Monitor	CVE-2026-106198No exploit	Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.2%	Oct 6, 2026
32Monitor	CVE-2026-106199No exploit	Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the rengoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.2	—	0.2%	Oct 6, 2026
35Monitor	CVE-2026-106200No exploit	Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-106201No exploit	Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-362 pre-auth RCE Race condition	High8.8	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-106203No exploit	Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to google · chrome · CWE-459 Pre-auth	High8.8	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-106204No exploit	Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Oct 6, 2026
32Monitor	CVE-2026-106205No exploit	Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the rgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.1	—	0.2%	Oct 6, 2026
35Monitor	CVE-2026-106207No exploit	Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-367 pre-auth RCE Race condition	High8.8	—	0.3%	Oct 6, 2026
38Monitor	CVE-2026-106211No exploit	Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially exgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Oct 6, 2026
35Monitor	CVE-2026-106212No exploit	Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtaigoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-106220No exploit	Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a craftegoogle · chrome · CWE-200 Pre-auth Info leak	High8.8	—	0.3%	Oct 6, 2026
33Monitor	CVE-2026-106221No exploit	Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to google · chrome · CWE-441 Pre-auth	High8.3	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-106225No exploit	Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain google · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 6, 2026
38Monitor	CVE-2026-106227No exploit	Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Oct 6, 2026
33Monitor	CVE-2026-106228No exploit	Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-441 pre-auth RCE	High8.3	—	0.3%	Oct 6, 2026
33Monitor	CVE-2026-106233No exploit	Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.3%	Oct 6, 2026

CVE-2026-106040
35Monitor
Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
kvcache-ai · mooncakeOct 6, 2026
CVE-2026-77178
36Monitor
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
Oct 6, 2026
CVE-2026-85523
35Monitor
OS Command Injection in Felisify Informatics' SambaBox
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
felisify information technologies industry and trade inc. · sambaboxOct 6, 2026
CVE-2026-91140
39Monitor
OS command injection in Progress Software Autonomous REST Connector GenAI Agents
CriticalCVSS 9.6No exploitEPSS 2%
- pre-auth RCE
- Command injection
progress software · autonomous rest connector genai agentsOct 6, 2026
CVE-2026-104069
34Monitor
HortusFox < 6.2 Remote Code Execution via Theme Import
HighCVSS 8.6No exploitEPSS 0%
- RCE
- File upload
danielbrendel · hortusfox-webOct 6, 2026
CVE-2026-105791
30Monitor
Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
microsoft · ufoOct 6, 2026
CVE-2026-105793
36Monitor
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Command injection
microsoft · ufoOct 6, 2026
CVE-2026-105794
36Monitor
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Weak crypto
microsoft · msquicOct 6, 2026
CVE-2026-105796
35Monitor
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
microsoft · kiotaOct 6, 2026
CVE-2026-105797
35Monitor
SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
microsoft · simplechatOct 6, 2026
CVE-2026-105798
34Monitor
SimpleChat: Stored XSS via group document filename in inline onclick handler
HighCVSS 8.7No exploitEPSS 0%
- XSS
microsoft · simplechatOct 6, 2026
CVE-2026-105801
33Monitor
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
HighCVSS 8.4No exploitEPSS 0%
- RCE
openapi-generators · openapi-python-clientOct 6, 2026
CVE-2026-54472
30Monitor
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
dell · container storage modulesOct 6, 2026
CVE-2026-61421
39Monitor
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
dell · container storage modulesOct 6, 2026
CVE-2026-63688
40Plan
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in th
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · container storage modulesOct 6, 2026
CVE-2026-63692
40Plan
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability.
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · container storage modulesOct 6, 2026
CVE-2026-67269
39Monitor
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the Conta
CriticalCVSS 9.9No exploitEPSS 0%
dell · container storage modulesOct 6, 2026
CVE-2026-105806
34Monitor
Payload: Improper access control for MCP API keys
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
payloadcms · payloadOct 6, 2026
CVE-2026-105844
37Monitor
Payload: Prototype pollution in Payload Import Export plugin
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- Prototype pollution
payloadcms · payloadOct 6, 2026
CVE-2026-105845
39Monitor
Payload: SQL Injection in SQLite and Postgres
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
payloadcms · payloadOct 6, 2026
CVE-2026-105950
20Monitor
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
MediumCVSS 5.1Proof of conceptEPSS 0%
- XSS
getformwork · formworkOct 6, 2026
CVE-2026-26287
28Monitor
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
HighCVSS 7.1No exploitEPSS 0%
external-secrets · external-secretsOct 6, 2026
CVE-2026-61411
30Monitor
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability.
HighCVSS 7.7No exploitEPSS 0%
- Info leak
dell · container storage modulesOct 6, 2026
CVE-2026-63690
29Monitor
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · container storage modulesOct 6, 2026
CVE-2026-63691
38Monitor
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerM
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
dell · container storage modulesOct 6, 2026
CVE-2026-67270
29Monitor
Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
dell · container storage modulesOct 6, 2026
CVE-2026-67273
38Monitor
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engin
CriticalCVSS 9.6No exploitEPSS 0%
- RCE
- SSTI
dell · container storage modulesOct 6, 2026
CVE-2026-76105
28Monitor
Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability.
HighCVSS 7.1No exploitEPSS 0%
- Weak crypto
dell · container storage modulesOct 6, 2026
CVE-2025-71383
39Monitor
Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/lo
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
Oct 6, 2026
CVE-2025-71384
26Monitor
Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer
MediumCVSS 6.7Proof of conceptEPSS 0%
- RCE
- Memory safety
Oct 6, 2026
CVE-2026-104070
37Monitor
SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
spip · spip crayons pluginOct 6, 2026
CVE-2026-104850
30Monitor
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
modelcontextprotocol · typescript-sdkOct 6, 2026
CVE-2026-105847
28Monitor
Payload: Polymorphic join queries could disclose hidden fields
HighCVSS 7.1No exploitEPSS 0%
- Info leak
payloadcms · payloadOct 6, 2026
CVE-2026-105849
30Monitor
Payload: API key disclosure through ordinary document reads
HighCVSS 7.7No exploitEPSS 0%
payloadcms · payloadOct 6, 2026
CVE-2026-105850
35Monitor
Payload: Order confirmation validation issue in Payload Ecommerce
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
payloadcms · payloadOct 6, 2026
CVE-2026-105851
37Monitor
Payload: Field access control bypass on auth collections
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
payloadcms · payloadOct 6, 2026
CVE-2026-105853
28Monitor
Payload: Token refresh and password reset responses may expose restricted user fields
HighCVSS 7.1No exploitEPSS 0%
- Info leak
payloadcms · payloadOct 6, 2026
CVE-2026-105854
34Monitor
Payload: ReDoS in Multipart Content-Type Validation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
payloadcms · payloadOct 6, 2026
CVE-2026-105855
30Monitor
Payload: Field-level password update restrictions were not enforced
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
payloadcms · payloadOct 6, 2026
CVE-2026-105856
34Monitor
Payload: SQL injection in SQLite/Postgres
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
payloadcms · payloadOct 6, 2026
CVE-2026-105857
40Plan
Payload: RCE in Payload Form Builder
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
payloadcms · payloadOct 6, 2026
CVE-2026-105858
32Monitor
Payload: Remote Code Execution through first-register
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
payloadcms · payloadOct 6, 2026
CVE-2026-105859
39Monitor
Payload: Unauthorized update to collection documents
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
payloadcms · payloadOct 6, 2026
CVE-2026-105860
28Monitor
Payload: Tenant authorization bypass in Multi-Tenant Plugin
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
payloadcms · payloadOct 6, 2026
CVE-2026-105861
28Monitor
Payload external upload trust validation issue
HighCVSS 7.2No exploitEPSS 0%
- Info leak
payloadcms · payloadOct 6, 2026
CVE-2026-105862
34Monitor
Payload: Bypassed sanitization of user uploaded SVGs
HighCVSS 8.7No exploitEPSS 0%
- XSS
payloadcms · payloadOct 6, 2026
CVE-2026-105863
36Monitor
Payload authentication token field handling issue
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
payloadcms · payloadOct 6, 2026
CVE-2026-105865
32Monitor
Payload: Incomplete validation during the upload file lifecycle
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
payloadcms · payloadOct 6, 2026
CVE-2026-105867
28Monitor
Payload: Client uploads could overwrite S3 objects
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
payloadcms · payloadOct 6, 2026
CVE-2026-105868
34Monitor
Payload: Uploaded XML files could execute same-origin JavaScript
HighCVSS 8.6No exploitEPSS 0%
- File upload
payloadcms · payloadOct 6, 2026
CVE-2026-106100
28Monitor
Payload: Field-level write access bypass in Payload on MongoDB
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
payloadcms · payloadOct 6, 2026
CVE-2026-106102
40Plan
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- XSS
quasarframework · quasarOct 6, 2026
CVE-2026-106218
40Plan
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
jetbrains · teamcityOct 6, 2026
CVE-2026-106219
30Monitor
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
jetbrains · teamcityOct 6, 2026
CVE-2026-95140
30Monitor
kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Oct 6, 2026
CVE-2025-45871
32Monitor
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated
HighCVSS 8.1No exploitEPSS 0%
- SQL injection
Oct 6, 2026
CVE-2026-101207
35Monitor
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Ele
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
dell · openmanage integrationOct 6, 2026
CVE-2026-106103
28Monitor
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
quasarframework · quasarOct 6, 2026
CVE-2026-106104
34Monitor
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
quasarframework · quasarOct 6, 2026
CVE-2026-106105
33Monitor
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
HighCVSS 8.4No exploitEPSS 0%
quasarframework · quasarOct 6, 2026
CVE-2026-106106
28Monitor
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
quasarframework · quasarOct 6, 2026
CVE-2026-106107
33Monitor
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- XSS
quasarframework · quasarOct 6, 2026
CVE-2026-106110
30Monitor
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sixlabors · imagesharpOct 6, 2026
CVE-2026-106112
30Monitor
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sixlabors · imagesharpOct 6, 2026
CVE-2026-106113
30Monitor
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sixlabors · imagesharpOct 6, 2026
CVE-2026-106115
30Monitor
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sixlabors · imagesharpOct 6, 2026
CVE-2026-106117
30Monitor
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sixlabors · imagesharpOct 6, 2026
CVE-2026-66666
27Monitor
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
automattic · wordpressOct 6, 2026
CVE-2026-102322
38Monitor
Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a c
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-104944
28Monitor
Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
tp-link systems inc. · tapo c500 v2.0Oct 6, 2026
CVE-2026-104945
27Monitor
Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500
MediumCVSS 6.8Proof of conceptEPSS 0%
- Memory safety
tp-link systems inc. · tapo c500 v2.0Oct 6, 2026
CVE-2026-105488
28Monitor
Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vau
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
devolutions · serverOct 6, 2026
CVE-2026-106118
30Monitor
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sixlabors · imagesharpOct 6, 2026
CVE-2026-106121
30Monitor
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
vmware · rabbitmq java clientOct 6, 2026
CVE-2026-106186
34Monitor
Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to pot
HighCVSS 8.6No exploitEPSS 0%
- RCE
google · chromeOct 6, 2026
CVE-2026-106188
28Monitor
Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictio
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
google · chromeOct 6, 2026
CVE-2026-106189
29Monitor
Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to by
HighCVSS 7.3No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 6, 2026
CVE-2026-106190
35Monitor
Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026
CVE-2026-106191
33Monitor
Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106193
35Monitor
Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026
CVE-2026-106194
33Monitor
Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer p
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106195
36Monitor
Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access re
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106196
30Monitor
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106197
38Monitor
Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox vi
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026
CVE-2026-106198
32Monitor
Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106199
32Monitor
Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the ren
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106200
35Monitor
Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026
CVE-2026-106201
35Monitor
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 6, 2026
CVE-2026-106203
35Monitor
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
google · chromeOct 6, 2026
CVE-2026-106204
35Monitor
Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026
CVE-2026-106205
32Monitor
Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the r
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106207
35Monitor
Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeOct 6, 2026
CVE-2026-106211
38Monitor
Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially ex
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026
CVE-2026-106212
35Monitor
Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtai
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106220
35Monitor
Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafte
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Info leak
google · chromeOct 6, 2026
CVE-2026-106221
33Monitor
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
google · chromeOct 6, 2026
CVE-2026-106225
35Monitor
Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeOct 6, 2026
CVE-2026-106227
38Monitor
Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026
CVE-2026-106228
33Monitor
Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeOct 6, 2026
CVE-2026-106233
33Monitor
Use after free in Metrics in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to exec
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeOct 6, 2026