By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 12 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-102163No exploit	Security Advisory 0195arista networks · wi-fi access points · CWE-787 pre-auth RCE Memory safety	High8.7	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-102165No exploit	Security Advisory 0198arista networks · wi-fi access points · CWE-121 pre-auth RCE Memory safety	High7.7	—	0.2%	Oct 6, 2026
36Monitor	CVE-2026-102167No exploit	Security Advisory 0197arista networks · wi-fi access points · CWE-121 pre-auth RCE Memory safety	Critical9.0	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-102168No exploit	Security Advisory 0194arista networks · wi-fi access points · CWE-191 pre-auth RCE Memory safety	High7.1	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-102169No exploit	Security Advisory 0194arista networks · wi-fi access points · CWE-476 pre-auth RCE Memory safety	High7.1	—	0.2%	Oct 6, 2026
35Monitor	CVE-2026-102406No exploit	Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interceptionelastic · kibana · CWE-639 Broken access control (IDOR)	High8.8	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-103007No exploit	Incorrect Authorization in Elasticsearch Leading to Privilege Escalationelastic · elasticsearch · CWE-863 Broken access control (IDOR)	High7.2	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-103009No exploit	Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosureelastic · elasticsearch · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 6, 2026
36Monitor	CVE-2026-103059No exploit	Gitea built-in SSH server authentication bypass through key case foldinggitea · gitea · CWE-305 Pre-auth Auth bypass	Critical9.1	—	0.3%	Oct 6, 2026
32Monitor	CVE-2026-103504No exploit	Gitea API team demotion not applied to unit permissionsgitea · gitea · CWE-272	High8.1	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-103670No exploit	Gitea trusted workflow cancellation by unapproved fork runsgitea · gitea · CWE-667 Pre-auth	High7.5	—	0.2%	Oct 6, 2026
32Monitor	CVE-2026-104048No exploit	Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluationfedoraproject · sssd · CWE-1025	High8.1	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-104626No exploit	Gitea fork workflow job revival through later approvalgitea · gitea · CWE-841	High8.8	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-104632No exploit	Gitea fork workflow approval bypass through cancel and rerungitea · gitea · CWE-285 Broken access control (IDOR)	High8.8	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-104636No exploit	Gitea SSRF through Git HTTP redirects in mirrors and fetchesgitea · gitea · CWE-918 Pre-auth SSRF	High7.5	—	0.2%	Oct 6, 2026
36Monitor	CVE-2026-106445Proof of concept	Handlebars: JavaScript Injection via Own Property Check Bypasshandlebars-lang · handlebars.js · CWE-184 Pre-auth	Critical9.2	—	0.5%	Oct 6, 2026
39Monitor	CVE-2026-106446No exploit	Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)handlebars-lang · handlebars.js · CWE-94 pre-auth RCE	Critical9.8	—	0.7%	Oct 6, 2026
34Monitor	CVE-2026-106447No exploit	StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tagsstablelib · stablelib · CWE-674 Pre-auth Denial of service	High8.7	—	0.4%	Oct 6, 2026
35Monitor	CVE-2026-106448No exploit	StableLib: Prototype poisoning via `__proto__` map keys in CBOR decodingstablelib · stablelib · CWE-1321 Pre-auth Prototype pollution	High8.9	—	0.4%	Oct 6, 2026
29Monitor	CVE-2026-106451Proof of concept	yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local useryawkat · lz4-java · CWE-367 Race condition	High7.3	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-70357No exploit	Gitea repository migration SSRF through DNS rebindinggitea · gitea · CWE-918 Pre-auth SSRF	High7.5	—	0.3%	Oct 6, 2026
39Monitor	CVE-2026-73278No exploit	Gitea WebAuthn bypass during OAuth and OIDC sign-ingitea · gitea · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 6, 2026
39Monitor	CVE-2026-76742No exploit	Authentication Bypass in the Web Management Interface of AOS-Shewlett packard enterprise (hpe) · aos-switch (aos-s) · CWE-269 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 6, 2026
39Monitor	CVE-2026-76743No exploit	Authentication Bypass Vulnerability in the Management Interface of AOS-Shewlett packard enterprise (hpe) · aos-switch (aos-s) · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 6, 2026
39Monitor	CVE-2026-76744No exploit	Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-Shewlett packard enterprise (hpe) · aos-switch (aos-s) · CWE-120 pre-auth RCE Memory safety	Critical9.8	—	0.5%	Oct 6, 2026
38Monitor	CVE-2026-76745No exploit	Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-Shewlett packard enterprise (hpe) · aos-switch (aos-s) · CWE-119 pre-auth RCE Memory safety	Critical9.6	—	0.2%	Oct 6, 2026
37Monitor	CVE-2026-76746No exploit	Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-Shewlett packard enterprise (hpe) · aos-switch (aos-s) · CWE-120 Pre-auth Memory safety	Critical9.3	—	0.1%	Oct 6, 2026
36Monitor	CVE-2026-76747No exploit	Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-Shewlett packard enterprise (hpe) · aos-switch (aos-s) · CWE-120 Pre-auth Memory safety	Critical9.1	—	0.4%	Oct 6, 2026
35Monitor	CVE-2026-76748No exploit	Authenticated Privilege Escalation Vulnerability in the API of AOS-Shewlett packard enterprise (hpe) · aos-switch (aos-s) · CWE-269	High8.8	—	0.2%	Oct 6, 2026
39Monitor	CVE-2026-76750No exploit	Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Managerhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.5%	Oct 6, 2026
39Monitor	CVE-2026-76751No exploit	Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Executionhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-353 pre-auth RCE	Critical9.8	—	0.3%	Oct 6, 2026
39Monitor	CVE-2026-76752No exploit	Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Accesshewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 6, 2026
39Monitor	CVE-2026-76753No exploit	Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Managerhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-134 pre-auth RCE	Critical9.8	—	0.5%	Oct 6, 2026
39Monitor	CVE-2026-76754No exploit	Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Managerhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-77 pre-auth RCE SQL injection Command injection	Critical9.8	—	0.3%	Oct 6, 2026
36Monitor	CVE-2026-79794No exploit	Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interfacehewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-89 SQL injection	Critical9.1	—	0.2%	Oct 6, 2026
39Monitor	CVE-2026-79796No exploit	Authentication Bypass Vulnerabilities in ClearPass Policy Managerhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 6, 2026
35Monitor	CVE-2026-79797No exploit	Improper Access Control in HPE Networking ClearPass Android Client Applicationhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-284 Pre-auth Broken access control (IDOR)	High8.8	—	0.2%	Oct 6, 2026
39Monitor	CVE-2026-79798No exploit	Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interfacehewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-89 SQL injection	Critical9.9	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-79799No exploit	Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management Interfacehewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-79 pre-auth RCE XSS	High8.8	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-79800No exploit	Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Managerhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-22 RCE Path traversal	High8.8	—	0.6%	Oct 6, 2026
39Monitor	CVE-2026-79801No exploit	Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agenthewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-353 pre-auth RCE	Critical9.8	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-79802No exploit	Command Injection Vulnerability in the ClearPass Policy Manager Client Softwarehewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-77 pre-auth RCE Command injection	High8.8	—	1.1%	Oct 6, 2026
35Monitor	CVE-2026-79803No exploit	Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manager APIhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-77 RCE Command injection	High8.8	—	0.7%	Oct 6, 2026
39Monitor	CVE-2026-79805No exploit	Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Managerhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-22 Pre-auth Path traversal	Critical9.8	—	0.4%	Oct 6, 2026
31Monitor	CVE-2026-79806No exploit	Authenticated Local Privilege Escalation in ClearPass Policy Manager OnGuard Linux Agenthewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-269 Local privilege escalation	High7.8	—	0.0%	Oct 6, 2026
31Monitor	CVE-2026-79807No exploit	Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in the ClearPass Policy Manager Windows Client Softwarehewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-347 Local privilege escalation Weak crypto	High7.8	—	0.0%	Oct 6, 2026
31Monitor	CVE-2026-79808No exploit	Local Authenticated Buffer Overflow Vulnerability in the ClearPass Policy Manager OnGuard Agenthewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-120 RCE Local privilege escalation Memory safety	High7.8	—	0.1%	Oct 6, 2026
29Monitor	CVE-2026-79809No exploit	Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypasshewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-22 Pre-auth Path traversal	High7.3	—	0.3%	Oct 6, 2026
28Monitor	CVE-2026-79810No exploit	Authenticated Remote Code Execution Vulnerabilities in HPE Networking ClearPass Policy Managerhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-94 RCE	High7.2	—	0.5%	Oct 6, 2026
28Monitor	CVE-2026-79811No exploit	Authenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager APIhewlett packard enterprise (hpe) · clearpass policy manager (cppm) · CWE-89 RCE SQL injection	High7.2	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-79960No exploit	Gitea deploy key pushes acting as the repository ownergitea · gitea · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Oct 6, 2026
32Monitor	CVE-2026-89430No exploit	Gitea push mirror SSRF and forced writes to internal Git hostsgitea · gitea · CWE-367 SSRF Race condition	High8.1	—	0.2%	Oct 6, 2026
32Monitor	CVE-2026-94114No exploit	Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoningapache software foundation · apache commons bcel · CWE-386 Pre-auth	High8.2	—	0.2%	Oct 6, 2026
39Monitor	CVE-2026-94205No exploit	Gitea fork workflow approval bypass through maintainer-triggered eventsgitea · gitea · CWE-441 Pre-auth	Critical9.8	—	0.6%	Oct 6, 2026
36Monitor	CVE-2026-95106No exploit	Gitea review and execution mismatch through duplicate tree entriesgitea · gitea · CWE-706 Pre-auth	Critical9.1	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-96399No exploit	Gitea denial of service through external issue tracker patternsgitea · gitea · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 6, 2026
32Monitor	CVE-2026-96404No exploit	Gitea installer authentication bypass for existing accountsgitea · gitea · CWE-287 Pre-auth Auth bypass	High8.1	—	0.5%	Oct 6, 2026
30Monitor	CVE-2026-96580No exploit	Gitea Actions memory exhaustion through large static matricesgitea · gitea · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 6, 2026
31Monitor	CVE-2026-101258No exploit	Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-freered hat · red hat enterprise linux 10 · CWE-787 RCE Memory safety	High7.8	—	0.1%	Oct 6, 2026
28Monitor	CVE-2026-105811No exploit	Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWSaws · qnabot-on-aws · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-105812No exploit	Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent importaws · bedrock-agentcore-starter-toolkit · CWE-94 RCE	High8.8	—	0.2%	Oct 6, 2026
31Monitor	CVE-2026-106062No exploit	Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface filered hat · red hat enterprise linux 10 · CWE-119 RCE Memory safety	High7.8	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-106455No exploit	Backstage: Improper validation of MkDocs plugin configuration in TechDocslinuxfoundation · backstage plugin-techdocs-node · CWE-918 SSRF	High7.7	—	0.4%	Oct 6, 2026
32Monitor	CVE-2026-106457No exploit	Backstage: Insufficient audience validation in the Cloudflare Access auth providerlinuxfoundation · backstage/plugin-auth-backend-module-cloudflare-access-provider · CWE-287 Auth bypass	High8.1	—	0.3%	Oct 6, 2026
34Monitor	CVE-2026-106459No exploit	Backstage: Improper input validation in Sentry scaffolder actionslinuxfoundation · backstage/plugin-scaffolder-backend-module-sentry · CWE-200 Info leak	High8.5	—	0.2%	Oct 6, 2026
39Monitor	CVE-2026-106486No exploit	Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actionslinuxfoundation · backstage/plugin-scaffolder-backend-module-bitbucket-cloud · CWE-22 Path traversal	Critical9.9	—	0.3%	Oct 6, 2026
32Monitor	CVE-2026-106488No exploit	Backstage: Improper authentication in the OIDC providerlinuxfoundation · backstage/plugin-auth-backend-module-oidc-provider · CWE-287 Auth bypass	High8.1	—	0.2%	Oct 6, 2026
19Monitor	CVE-2026-106494No exploit	Backstage: Improper input validation in cloud storage URL readerslinuxfoundation · backstage/backend defaults · CWE-22 Path traversal	Medium4.9	—	0.3%	Oct 6, 2026
34Monitor	CVE-2026-106547No exploit	HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadatathe hdf group · hdf5 · CWE-122 RCE Memory safety	High8.5	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-106550No exploit	Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollutionmozilla · node-convict · CWE-400 Pre-auth Denial of service	High7.5	—	0.2%	Oct 6, 2026
30Monitor	CVE-2026-106553No exploit	In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.openbsd · openssh · CWE-669 Pre-auth	High7.5	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-106555No exploit	In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.openbsd · openssh · CWE-669 Pre-auth	High7.5	—	0.1%	Oct 6, 2026
30Monitor	CVE-2026-43598No exploit	Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent aamd · amd instinct™ mi210 · CWE-822 RCE	High7.7	—	0.3%	Oct 6, 2026
36Monitor	CVE-2026-101023No exploit	Gitea OAuth2 refresh token grant accepts access tokensgitea · gitea · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.3%	Oct 6, 2026
32Monitor	CVE-2026-105267No exploit	Gitea tag delete route deletes releases without release permissiongitea · gitea · CWE-732	High8.1	—	0.3%	Oct 6, 2026
30Monitor	CVE-2026-106498No exploit	Backstage: Improper URL validation in catalog entity placeholder resolutionlinuxfoundation · backstage plugin-catalog-backend · CWE-863 Broken access control (IDOR)	High7.7	—	0.3%	Oct 6, 2026
34Monitor	CVE-2026-106500No exploit	Backstage: Improper task state validation in Scaffolder backendlinuxfoundation · backstage/plugin-scaffolder-backend · CWE-59	High8.5	—	0.3%	Oct 6, 2026
38Monitor	CVE-2026-106501No exploit	Backstage: Sensitive information exposure in Scaffolderlinuxfoundation · backstage/plugin-scaffolder-backend · CWE-200 Info leak	Critical9.6	—	0.5%	Oct 6, 2026
32Monitor	CVE-2026-106503No exploit	Backstage: Scaffolder action input authorization bypasslinuxfoundation · backstage/plugin-scaffolder-backend · CWE-178	High8.1	—	0.4%	Oct 6, 2026
34Monitor	CVE-2026-106505No exploit	Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backendlinuxfoundation · backstage plugin-techdocs-node · CWE-426 RCE	High8.5	—	0.3%	Oct 6, 2026
35Monitor	CVE-2026-106509No exploit	Backstage: Improper validation of MkDocs theme configuration in TechDocslinuxfoundation · backstage plugin-techdocs-node · CWE-94 RCE	High8.8	—	0.5%	Oct 6, 2026
31Monitor	CVE-2026-65142No exploit	NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data.nvidia · model-optimizer · CWE-502 Deserialization	High7.8	—	0.2%	Oct 6, 2026
28Monitor	CVE-2026-86684No exploit	Gitea push mirror local path check uses the repository ownergitea · gitea · CWE-863 Broken access control (IDOR)	High7.1	—	0.1%	Oct 6, 2026
35Monitor	CVE-2026-104335Proof of concept	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-284 RCE Broken access control (IDOR)	High8.8	—	0.8%	Oct 7, 2026
31Monitor	CVE-2026-106583No exploit	In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.openbsd · openssh · CWE-99	High7.8	—	0.1%	Oct 7, 2026
39Monitor	CVE-2026-104334No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 pre-auth RCE	Critical9.8	—	0.7%	Oct 7, 2026
35Monitor	CVE-2026-88962No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.6%	Oct 7, 2026
35Monitor	CVE-2026-93443No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.4%	Oct 7, 2026
35Monitor	CVE-2026-93445No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.4%	Oct 7, 2026
30Monitor	CVE-2026-93447No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-502 Deserialization	High7.5	—	0.2%	Oct 7, 2026
35Monitor	CVE-2026-93449No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.4%	Oct 7, 2026
60This week	CVE-2026-93674Weaponized	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 pre-auth RCE	Critical9.8	—	15.2%	Oct 7, 2026
39Monitor	CVE-2026-93675No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-440 pre-auth RCE	Critical9.8	—	0.6%	Oct 7, 2026
30Monitor	CVE-2026-93678No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-639 Broken access control (IDOR)	High7.6	—	0.2%	Oct 7, 2026
35Monitor	CVE-2026-97655No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.7%	Oct 7, 2026
35Monitor	CVE-2026-97673No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-693 RCE	High8.8	—	0.6%	Oct 7, 2026
32Monitor	CVE-2026-97674No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.1	—	0.3%	Oct 7, 2026
35Monitor	CVE-2026-97676No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.7%	Oct 7, 2026
35Monitor	CVE-2026-97678No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-693 RCE	High8.8	—	0.5%	Oct 7, 2026
35Monitor	CVE-2026-97679No exploit	Langflow OSS is affected by multiple vulnerabilitieslangflow · langflow · CWE-94 RCE	High8.8	—	0.6%	Oct 7, 2026

CVE-2026-102163
34Monitor
Security Advisory 0195
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Memory safety
arista networks · wi-fi access pointsOct 6, 2026
CVE-2026-102165
30Monitor
Security Advisory 0198
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Memory safety
arista networks · wi-fi access pointsOct 6, 2026
CVE-2026-102167
36Monitor
Security Advisory 0197
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
- Memory safety
arista networks · wi-fi access pointsOct 6, 2026
CVE-2026-102168
28Monitor
Security Advisory 0194
HighCVSS 7.1No exploitEPSS 0%
- pre-auth RCE
- Memory safety
arista networks · wi-fi access pointsOct 6, 2026
CVE-2026-102169
28Monitor
Security Advisory 0194
HighCVSS 7.1No exploitEPSS 0%
- pre-auth RCE
- Memory safety
arista networks · wi-fi access pointsOct 6, 2026
CVE-2026-102406
35Monitor
Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
elastic · kibanaOct 6, 2026
CVE-2026-103007
28Monitor
Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
elastic · elasticsearchOct 6, 2026
CVE-2026-103009
28Monitor
Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
elastic · elasticsearchOct 6, 2026
CVE-2026-103059
36Monitor
Gitea built-in SSH server authentication bypass through key case folding
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
gitea · giteaOct 6, 2026
CVE-2026-103504
32Monitor
Gitea API team demotion not applied to unit permissions
HighCVSS 8.1No exploitEPSS 0%
gitea · giteaOct 6, 2026
CVE-2026-103670
30Monitor
Gitea trusted workflow cancellation by unapproved fork runs
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
gitea · giteaOct 6, 2026
CVE-2026-104048
32Monitor
Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation
HighCVSS 8.1No exploitEPSS 0%
fedoraproject · sssdOct 6, 2026
CVE-2026-104626
35Monitor
Gitea fork workflow job revival through later approval
HighCVSS 8.8No exploitEPSS 0%
gitea · giteaOct 6, 2026
CVE-2026-104632
35Monitor
Gitea fork workflow approval bypass through cancel and rerun
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
gitea · giteaOct 6, 2026
CVE-2026-104636
30Monitor
Gitea SSRF through Git HTTP redirects in mirrors and fetches
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
gitea · giteaOct 6, 2026
CVE-2026-106445
36Monitor
Handlebars: JavaScript Injection via Own Property Check Bypass
CriticalCVSS 9.2Proof of conceptEPSS 0%
- Pre-auth
handlebars-lang · handlebars.jsOct 6, 2026
CVE-2026-106446
39Monitor
Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
handlebars-lang · handlebars.jsOct 6, 2026
CVE-2026-106447
34Monitor
StableLib: Stack exhaustion denial of service via deeply nested CBOR arrays, maps, or tags
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
stablelib · stablelibOct 6, 2026
CVE-2026-106448
35Monitor
StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Prototype pollution
stablelib · stablelibOct 6, 2026
CVE-2026-106451
29Monitor
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
HighCVSS 7.3Proof of conceptEPSS 0%
- Race condition
yawkat · lz4-javaOct 6, 2026
CVE-2026-70357
30Monitor
Gitea repository migration SSRF through DNS rebinding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
gitea · giteaOct 6, 2026
CVE-2026-73278
39Monitor
Gitea WebAuthn bypass during OAuth and OIDC sign-in
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
gitea · giteaOct 6, 2026
CVE-2026-76742
39Monitor
Authentication Bypass in the Web Management Interface of AOS-S
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
hewlett packard enterprise (hpe) · aos-switch (aos-s)Oct 6, 2026
CVE-2026-76743
39Monitor
Authentication Bypass Vulnerability in the Management Interface of AOS-S
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
hewlett packard enterprise (hpe) · aos-switch (aos-s)Oct 6, 2026
CVE-2026-76744
39Monitor
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
hewlett packard enterprise (hpe) · aos-switch (aos-s)Oct 6, 2026
CVE-2026-76745
38Monitor
Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
hewlett packard enterprise (hpe) · aos-switch (aos-s)Oct 6, 2026
CVE-2026-76746
37Monitor
Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
hewlett packard enterprise (hpe) · aos-switch (aos-s)Oct 6, 2026
CVE-2026-76747
36Monitor
Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
hewlett packard enterprise (hpe) · aos-switch (aos-s)Oct 6, 2026
CVE-2026-76748
35Monitor
Authenticated Privilege Escalation Vulnerability in the API of AOS-S
HighCVSS 8.8No exploitEPSS 0%
hewlett packard enterprise (hpe) · aos-switch (aos-s)Oct 6, 2026
CVE-2026-76750
39Monitor
Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-76751
39Monitor
Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-76752
39Monitor
Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-76753
39Monitor
Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-76754
39Monitor
Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- SQL injection
- Command injection
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79794
36Monitor
Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface
CriticalCVSS 9.1No exploitEPSS 0%
- SQL injection
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79796
39Monitor
Authentication Bypass Vulnerabilities in ClearPass Policy Manager
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79797
35Monitor
Improper Access Control in HPE Networking ClearPass Android Client Application
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79798
39Monitor
Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface
CriticalCVSS 9.9No exploitEPSS 0%
- SQL injection
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79799
35Monitor
Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management Interface
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- XSS
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79800
35Monitor
Authenticated Path Traversal Vulnerability Leads to Remote Code Execution in ClearPass Policy Manager
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79801
39Monitor
Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79802
35Monitor
Command Injection Vulnerability in the ClearPass Policy Manager Client Software
HighCVSS 8.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79803
35Monitor
Authenticated Command Injection Leading to Privilege Escalation in ClearPass Policy Manager API
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79805
39Monitor
Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79806
31Monitor
Authenticated Local Privilege Escalation in ClearPass Policy Manager OnGuard Linux Agent
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79807
31Monitor
Authenticated Local Missing Integrity Verification Vulnerability leads to Local Privilege Escalation in the ClearPass Policy Manager Windows Client Software
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Weak crypto
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79808
31Monitor
Local Authenticated Buffer Overflow Vulnerability in the ClearPass Policy Manager OnGuard Agent
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Memory safety
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79809
29Monitor
Unauthenticated Path Traversal in ClearPass Policy Manager API Endpoint Leads to Authorization Bypass
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Path traversal
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79810
28Monitor
Authenticated Remote Code Execution Vulnerabilities in HPE Networking ClearPass Policy Manager
HighCVSS 7.2No exploitEPSS 0%
- RCE
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79811
28Monitor
Authenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager API
HighCVSS 7.2No exploitEPSS 0%
- RCE
- SQL injection
hewlett packard enterprise (hpe) · clearpass policy manager (cppm)Oct 6, 2026
CVE-2026-79960
28Monitor
Gitea deploy key pushes acting as the repository owner
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
gitea · giteaOct 6, 2026
CVE-2026-89430
32Monitor
Gitea push mirror SSRF and forced writes to internal Git hosts
HighCVSS 8.1No exploitEPSS 0%
- SSRF
- Race condition
gitea · giteaOct 6, 2026
CVE-2026-94114
32Monitor
Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
apache software foundation · apache commons bcelOct 6, 2026
CVE-2026-94205
39Monitor
Gitea fork workflow approval bypass through maintainer-triggered events
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
gitea · giteaOct 6, 2026
CVE-2026-95106
36Monitor
Gitea review and execution mismatch through duplicate tree entries
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
gitea · giteaOct 6, 2026
CVE-2026-96399
30Monitor
Gitea denial of service through external issue tracker patterns
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
gitea · giteaOct 6, 2026
CVE-2026-96404
32Monitor
Gitea installer authentication bypass for existing accounts
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
gitea · giteaOct 6, 2026
CVE-2026-96580
30Monitor
Gitea Actions memory exhaustion through large static matrices
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
gitea · giteaOct 6, 2026
CVE-2026-101258
31Monitor
Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 10Oct 6, 2026
CVE-2026-105811
28Monitor
Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
aws · qnabot-on-awsOct 6, 2026
CVE-2026-105812
35Monitor
Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import
HighCVSS 8.8No exploitEPSS 0%
- RCE
aws · bedrock-agentcore-starter-toolkitOct 6, 2026
CVE-2026-106062
31Monitor
Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 10Oct 6, 2026
CVE-2026-106455
30Monitor
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
HighCVSS 7.7No exploitEPSS 0%
- SSRF
linuxfoundation · backstage plugin-techdocs-nodeOct 6, 2026
CVE-2026-106457
32Monitor
Backstage: Insufficient audience validation in the Cloudflare Access auth provider
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
linuxfoundation · backstage/plugin-auth-backend-module-cloudflare-access-providerOct 6, 2026
CVE-2026-106459
34Monitor
Backstage: Improper input validation in Sentry scaffolder actions
HighCVSS 8.5No exploitEPSS 0%
- Info leak
linuxfoundation · backstage/plugin-scaffolder-backend-module-sentryOct 6, 2026
CVE-2026-106486
39Monitor
Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
CriticalCVSS 9.9No exploitEPSS 0%
- Path traversal
linuxfoundation · backstage/plugin-scaffolder-backend-module-bitbucket-cloudOct 6, 2026
CVE-2026-106488
32Monitor
Backstage: Improper authentication in the OIDC provider
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
linuxfoundation · backstage/plugin-auth-backend-module-oidc-providerOct 6, 2026
CVE-2026-106494
19Monitor
Backstage: Improper input validation in cloud storage URL readers
MediumCVSS 4.9No exploitEPSS 0%
- Path traversal
linuxfoundation · backstage/backend defaultsOct 6, 2026
CVE-2026-106547
34Monitor
HDF5 heap buffer overflow in H5VM_array_fill via crafted fill-value metadata
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Memory safety
the hdf group · hdf5Oct 6, 2026
CVE-2026-106550
30Monitor
Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
mozilla · node-convictOct 6, 2026
CVE-2026-106553
30Monitor
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
openbsd · opensshOct 6, 2026
CVE-2026-106555
30Monitor
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
openbsd · opensshOct 6, 2026
CVE-2026-43598
30Monitor
Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent a
HighCVSS 7.7No exploitEPSS 0%
- RCE
amd · amd instinct™ mi210Oct 6, 2026
CVE-2026-101023
36Monitor
Gitea OAuth2 refresh token grant accepts access tokens
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
gitea · giteaOct 6, 2026
CVE-2026-105267
32Monitor
Gitea tag delete route deletes releases without release permission
HighCVSS 8.1No exploitEPSS 0%
gitea · giteaOct 6, 2026
CVE-2026-106498
30Monitor
Backstage: Improper URL validation in catalog entity placeholder resolution
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
linuxfoundation · backstage plugin-catalog-backendOct 6, 2026
CVE-2026-106500
34Monitor
Backstage: Improper task state validation in Scaffolder backend
HighCVSS 8.5No exploitEPSS 0%
linuxfoundation · backstage/plugin-scaffolder-backendOct 6, 2026
CVE-2026-106501
38Monitor
Backstage: Sensitive information exposure in Scaffolder
CriticalCVSS 9.6No exploitEPSS 0%
- Info leak
linuxfoundation · backstage/plugin-scaffolder-backendOct 6, 2026
CVE-2026-106503
32Monitor
Backstage: Scaffolder action input authorization bypass
HighCVSS 8.1No exploitEPSS 0%
linuxfoundation · backstage/plugin-scaffolder-backendOct 6, 2026
CVE-2026-106505
34Monitor
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
HighCVSS 8.5No exploitEPSS 0%
- RCE
linuxfoundation · backstage plugin-techdocs-nodeOct 6, 2026
CVE-2026-106509
35Monitor
Backstage: Improper validation of MkDocs theme configuration in TechDocs
HighCVSS 8.8No exploitEPSS 0%
- RCE
linuxfoundation · backstage plugin-techdocs-nodeOct 6, 2026
CVE-2026-65142
31Monitor
NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data.
HighCVSS 7.8No exploitEPSS 0%
- Deserialization
nvidia · model-optimizerOct 6, 2026
CVE-2026-86684
28Monitor
Gitea push mirror local path check uses the repository owner
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
gitea · giteaOct 6, 2026
CVE-2026-104335
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8Proof of conceptEPSS 0%
- RCE
- Broken access control (IDOR)
langflow · langflowOct 7, 2026
CVE-2026-106583
31Monitor
In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.
HighCVSS 7.8No exploitEPSS 0%
openbsd · opensshOct 7, 2026
CVE-2026-104334
39Monitor
Langflow OSS is affected by multiple vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
langflow · langflowOct 7, 2026
CVE-2026-88962
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-93443
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-93445
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-93447
30Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Deserialization
langflow · langflowOct 7, 2026
CVE-2026-93449
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-93674
60This week
Langflow OSS is affected by multiple vulnerabilities
CriticalCVSS 9.8WeaponizedEPSS 15%
- pre-auth RCE
langflow · langflowOct 7, 2026
CVE-2026-93675
39Monitor
Langflow OSS is affected by multiple vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
langflow · langflowOct 7, 2026
CVE-2026-93678
30Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
langflow · langflowOct 7, 2026
CVE-2026-97655
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-97673
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-97674
32Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.1No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-97676
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-97678
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026
CVE-2026-97679
35Monitor
Langflow OSS is affected by multiple vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowOct 7, 2026