By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 14 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-20362No exploit	Cisco Finesse Server-Side Request Forgery Vulnerabilitycisco · cisco finesse · CWE-918 Pre-auth SSRF	High7.2	—	0.5%	Oct 7, 2026
36Monitor	CVE-2026-62176No exploit	PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generationmervinpraison · praisonai · CWE-94 RCE	Critical9.1	—	0.4%	Oct 7, 2026
32Monitor	CVE-2026-62251No exploit	Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/querysipcapture · homer · CWE-89 RCE SQL injection	High8.1	—	0.4%	Oct 7, 2026
39Monitor	CVE-2026-62252No exploit	Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Loginsipcapture · homer · CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	0.6%	Oct 7, 2026
39Monitor	CVE-2026-62253No exploit	Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)sipcapture · homer · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.5%	Oct 7, 2026
35Monitor	CVE-2026-76453No exploit	Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilitiescisco · cisco nx-os software · CWE-707	High8.8	—	0.3%	Oct 7, 2026
36Monitor	CVE-2026-76454No exploit	Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerabilitycisco · cisco license on-prem · CWE-23 Pre-auth Path traversal	Critical9.1	—	0.5%	Oct 7, 2026
40Plan	CVE-2026-76455No exploit	Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilitiescisco · cisco nx-os software · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	4.0%	Oct 7, 2026
34Monitor	CVE-2026-76456No exploit	Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilitiescisco · cisco nx-os software · CWE-20 Pre-auth Denial of service	High8.6	—	0.2%	Oct 7, 2026
34Monitor	CVE-2026-76457No exploit	Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilitiescisco · cisco nx-os software · CWE-125 Pre-auth Memory safety Denial of service	High8.6	—	0.2%	Oct 7, 2026
34Monitor	CVE-2026-76458No exploit	Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions Vulnerabilitiescisco · cisco nx-os software · CWE-703 Pre-auth Denial of service	High8.6	—	0.2%	Oct 7, 2026
39Monitor	CVE-2026-76459No exploit	Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilitiescisco · cisco nx-os software · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.3%	Oct 7, 2026
35Monitor	CVE-2026-76463No exploit	Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilitiescisco · cisco campus gateway software · CWE-284 Pre-auth Broken access control (IDOR)	High8.8	—	0.1%	Oct 7, 2026
38Monitor	CVE-2026-76464No exploit	Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilitiescisco · cisco campus gateway software · CWE-119 Pre-auth Memory safety	Critical9.6	—	0.2%	Oct 7, 2026
39Monitor	CVE-2026-76465No exploit	Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerabilitycisco · cisco nx-os software · CWE-590 pre-auth RCE	Critical9.8	—	0.4%	Oct 7, 2026
30Monitor	CVE-2026-76467No exploit	Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilitiescisco · cisco campus gateway software · CWE-664 Pre-auth Denial of service	High7.5	—	0.2%	Oct 7, 2026
32Monitor	CVE-2026-76468No exploit	Cisco Meraki Hardening Release - Input Validation Vulnerabilitiescisco · cisco campus gateway software · CWE-20 Pre-auth	High8.2	—	0.2%	Oct 7, 2026
29Monitor	CVE-2026-76469No exploit	Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management Vulnerabilitiescisco · cisco campus gateway software · CWE-691 Pre-auth Denial of service	High7.4	—	0.1%	Oct 7, 2026
35Monitor	CVE-2026-76470No exploit	Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilitiescisco · cisco campus gateway software · CWE-682 Pre-auth	High8.8	—	0.1%	Oct 7, 2026
39Monitor	CVE-2026-76471No exploit	Cisco NX-OS Software NX-API Remote Code Execution Vulnerabilitycisco · cisco nx-os software · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	0.4%	Oct 7, 2026
35Monitor	CVE-2026-76472No exploit	Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilitiescisco · cisco campus gateway software · CWE-74	High8.8	—	0.1%	Oct 7, 2026
39Monitor	CVE-2026-76480No exploit	Cisco License On-Prem Security Hardening Releasecisco · cisco license on-prem · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 7, 2026
40Plan	CVE-2026-76482No exploit	Cisco License On-Prem Security Hardening Releasecisco · cisco license on-prem · CWE-347 Pre-auth Weak crypto	Critical10.0	—	0.2%	Oct 7, 2026
36Monitor	CVE-2026-76483No exploit	Cisco License On-Prem Security Hardening Releasecisco · cisco license on-prem · CWE-522 Pre-auth Info leak	Critical9.1	—	0.2%	Oct 7, 2026
35Monitor	CVE-2026-76484No exploit	Cisco License On-Prem Security Hardening Releasecisco · cisco license on-prem · CWE-94 RCE	High8.8	—	0.3%	Oct 7, 2026
39Monitor	CVE-2026-76485No exploit	Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerabilitycisco · cisco nx-os software · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	0.5%	Oct 7, 2026
39Monitor	CVE-2026-76486No exploit	Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerabilitycisco · cisco nx-os software · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	0.5%	Oct 7, 2026
26Monitor	CVE-2026-76488No exploit	Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure Vulnerabilitycisco · cisco application policy infrastructure controller (apic) · CWE-264	Medium6.5	—	0.2%	Oct 7, 2026
39Monitor	CVE-2026-76498No exploit	Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilitiescisco · cisco application policy infrastructure controller (apic) · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Oct 7, 2026
39Monitor	CVE-2026-76499No exploit	Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilitiescisco · cisco application policy infrastructure controller (apic) · CWE-707 Pre-auth	Critical9.8	—	0.3%	Oct 7, 2026
39Monitor	CVE-2026-76500No exploit	Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilitiescisco · cisco application policy infrastructure controller (apic) · CWE-664 Pre-auth	Critical9.8	—	0.3%	Oct 7, 2026
39Monitor	CVE-2026-76501No exploit	Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerabilitycisco · cisco nx-os software · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	0.5%	Oct 7, 2026
30Monitor	CVE-2026-92543No exploit	Docker Engine insecure-registry fallback via malicious DNS responsesdocker · docker engine · CWE-295 Pre-auth Weak crypto	High7.6	—	0.0%	Oct 7, 2026
28Monitor	CVE-2026-94662No exploit	WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 7, 2026
28Monitor	CVE-2026-94670No exploit	WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerabilityeverest forms · everest forms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 7, 2026
35Monitor	CVE-2026-95534No exploit	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-502 Deserialization	High8.8	—	0.2%	Oct 7, 2026
28Monitor	CVE-2026-95595No exploit	WordPress Disable and Remove Google Fonts \| GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityfontsplugin · disable and remove google fonts \| gdpr & dsgvo friendly · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 7, 2026
37Monitor	CVE-2026-95605No exploit	WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerabilitypassionate programmer peter · wp data access · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 7, 2026
39Monitor	CVE-2026-95606No exploit	WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerabilityliquid web / stellarwp · the events calendar · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Oct 7, 2026
34Monitor	CVE-2026-107211No exploit	Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicexcelize · excelize · CWE-129 Pre-auth	High8.7	—	0.2%	Oct 7, 2026
30Monitor	CVE-2026-107212No exploit	Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysexcelize · excelize · CWE-770 Pre-auth Denial of service	High7.5	—	0.3%	Oct 7, 2026
34Monitor	CVE-2026-107213No exploit	Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementexcelize · excelize · CWE-476 Pre-auth Memory safety	High8.7	—	0.2%	Oct 7, 2026
30Monitor	CVE-2026-107214No exploit	Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksexcelize · excelize · CWE-248 Pre-auth Denial of service	High7.5	—	0.2%	Oct 7, 2026
30Monitor	CVE-2026-107215No exploit	Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSexcelize · excelize · CWE-789 Pre-auth Denial of service	High7.5	—	0.2%	Oct 7, 2026
30Monitor	CVE-2026-107216No exploit	Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowexcelize · excelize · CWE-674 Pre-auth Denial of service	High7.5	—	0.3%	Oct 7, 2026
30Monitor	CVE-2026-56851No exploit	Panic parsing crafted input in x/text/secure/precis in golang.org/x/textgolang.org/x/text · golang.org/x/text/secure/precis · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 7, 2026
30Monitor	CVE-2026-96335No exploit	WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerabilitywpmu dev · forminator · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.1%	Oct 7, 2026
30Monitor	CVE-2026-103371No exploit	Apache Geode: Management REST API: Insertion of Sensitive Information into Log Fileapache software foundation · apache geode · CWE-532 Pre-auth Info leak	High7.5	—	0.2%	Oct 7, 2026
29Monitor	CVE-2026-106164No exploit	Infinite Loop in Telerik Document Processing XLS Importprogress software · telerik document processing libraries · CWE-835 Pre-auth Denial of service	High7.3	—	0.1%	Oct 7, 2026
30Monitor	CVE-2026-107217No exploit	Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsexcelize · excelize · CWE-129 Pre-auth Denial of service	High7.5	—	0.3%	Oct 7, 2026
30Monitor	CVE-2026-107219No exploit	Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileexcelize · excelize · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 7, 2026
28Monitor	CVE-2026-107223No exploit	Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the procesexcelize · excelize · CWE-789 Pre-auth	High7.1	—	0.3%	Oct 7, 2026
30Monitor	CVE-2026-107161No exploit	Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clientsred hat · red hat enterprise linux 10 · CWE-122 Pre-auth Memory safety	High7.5	—	0.3%	Oct 7, 2026
34Monitor	CVE-2026-34499No exploit	Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.johnson controls · advms · CWE-321 Hard-coded credentials	High8.5	—	0.0%	Oct 7, 2026
32Monitor	CVE-2026-97714No exploit	Denial of service vulnerability in Secure Accessabsolute security · secure access · CWE-400 Pre-auth Denial of service	High8.2	—	0.2%	Oct 7, 2026
28Monitor	CVE-2026-97715No exploit	Denial of Service in Absolute Secure Accessabsolute security · secure access · CWE-400 Denial of service	High7.1	—	0.2%	Oct 7, 2026
34Monitor	CVE-2026-97716No exploit	Denial of Service in Absolute Secure Accessabsolute security · secure access · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Oct 7, 2026
30Monitor	CVE-2026-107227No exploit	AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledasynchttpclient · async-http-client · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 7, 2026
26Monitor	CVE-2026-76265No exploit	Improper Access Control through REST API Endpoints in Splunk Secure Gatewaysplunk · splunk · CWE-284 Broken access control (IDOR)	Medium6.5	—	0.3%	Oct 7, 2026
30Monitor	CVE-2026-76266No exploit	Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprisesplunk · splunk · CWE-269 Local privilege escalation	High7.7	—	0.1%	Oct 7, 2026
41Plan	CVE-2026-76268Proof of concept	Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprisesplunk · splunk · CWE-306 Pre-auth Auth bypass	Critical9.8	—	5.7%	Oct 7, 2026
21Monitor	CVE-2026-76281No exploit	Improper Access Control in Splunk Enterprisesplunk · splunk · CWE-284 Pre-auth Broken access control (IDOR)	Medium5.3	—	0.1%	Oct 7, 2026
35Monitor	CVE-2026-76282No exploit	Improper Control of a Resource Through its Lifetime in Splunk Enterprisesplunk · splunk · CWE-664	High8.8	—	0.4%	Oct 7, 2026
30Monitor	CVE-2026-76283No exploit	Protection Mechanism Failure in Splunk Enterprisesplunk · splunk · CWE-693	High7.6	—	0.2%	Oct 7, 2026
39Monitor	CVE-2026-76284No exploit	Improper Neutralization in Splunk Enterprisesplunk · splunk · CWE-707 Pre-auth	Critical9.8	—	0.4%	Oct 7, 2026
39Monitor	CVE-2026-76285No exploit	Improper Adherence to Coding Standards in Splunk Enterprisesplunk · splunk · CWE-710 Pre-auth	Critical9.8	—	0.3%	Oct 7, 2026
32Monitor	CVE-2026-105816No exploit	Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshotshashicorp · vault · CWE-22 RCE Path traversal	High8.0	—	0.3%	Oct 7, 2026
29Monitor	CVE-2026-107230No exploit	AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsasynchttpclient · async-http-client · CWE-346 Pre-auth	High7.4	—	0.1%	Oct 7, 2026
34Monitor	CVE-2026-107231No exploit	AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextasynchttpclient · async-http-client · CWE-319 Pre-auth Weak crypto	High8.7	—	0.2%	Oct 7, 2026
30Monitor	CVE-2026-107232No exploit	AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECTasynchttpclient · async-http-client · CWE-319 Pre-auth Weak crypto	High7.5	—	0.2%	Oct 7, 2026
35Monitor	CVE-2026-107279No exploit	AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-intasynchttpclient · async-http-client · CWE-303 Pre-auth	High8.8	—	0.3%	Oct 7, 2026
30Monitor	CVE-2026-107281No exploit	AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identitiesasynchttpclient · async-http-client · CWE-346	High7.6	—	0.1%	Oct 7, 2026
37Monitor	CVE-2026-107282No exploit	AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostasynchttpclient · async-http-client · CWE-319 Pre-auth Weak crypto	Critical9.4	—	0.1%	Oct 7, 2026
28Monitor	CVE-2026-89322No exploit	Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictionshashicorp · vault · CWE-178	High7.2	—	0.2%	Oct 7, 2026
34Monitor	CVE-2026-87679No exploit	When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings inbroadcom · fabric operating system · CWE-122 RCE Memory safety	High8.5	—	0.3%	Oct 8, 2026
35Monitor	CVE-2026-87680No exploit	A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated ubroadcom · fabric operating system · CWE-78 RCE Command injection	High8.5	—	1.9%	Oct 8, 2026
28Monitor	CVE-2026-87681No exploit	An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions beforebroadcom · fabric operating system · CWE-269	High7.1	—	0.1%	Oct 8, 2026
34Monitor	CVE-2026-102488No exploit	In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtaoctopus deploy · octopus server · CWE-863 Broken access control (IDOR)	High8.7	—	0.2%	Oct 8, 2026
30Monitor	CVE-2026-82627No exploit	Uncanny Automator – AI + Automation for WordPress \| AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injectuncannyowl · uncanny automator – ai + automation for wordpress \| ai agent, ai page builder, free ai usage included · CWE-502 Deserialization	High7.5	—	0.2%	Oct 8, 2026
34Monitor	CVE-2026-87682No exploit	Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versionbroadcom · fabric operating system · CWE-78 RCE Command injection	High8.6	—	1.6%	Oct 8, 2026
34Monitor	CVE-2026-87683No exploit	Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.broadcom · fabric operating system · CWE-121 RCE Memory safety	High8.6	—	0.4%	Oct 8, 2026
28Monitor	CVE-2026-87659No exploit	A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1.broadcom · fabric operating system · CWE-306 Auth bypass	High7.1	—	0.2%	Oct 8, 2026
28Monitor	CVE-2026-87671No exploit	An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1.broadcom · fabric operating system · CWE-125 Pre-auth Memory safety	High7.1	—	0.3%	Oct 8, 2026
34Monitor	CVE-2026-87684No exploit	A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1.broadcom · fabric operating system · CWE-121 pre-auth RCE Memory safety	High8.7	—	0.5%	Oct 8, 2026
30Monitor	CVE-2026-94578No exploit	Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accountbroadcom · fabric operating system · CWE-269	High7.5	—	0.3%	Oct 8, 2026
28Monitor	CVE-2026-87660No exploit	An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS vebroadcom · fabric operating system · CWE-732	High7.0	—	0.1%	Oct 8, 2026
35Monitor	CVE-2026-87666No exploit	An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.broadcom · fabric operating system · CWE-78 RCE Command injection	High8.6	—	2.5%	Oct 8, 2026
33Monitor	CVE-2026-87667No exploit	An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d broadcom · fabric operating system · CWE-88	High8.4	—	0.1%	Oct 8, 2026
29Monitor	CVE-2026-87673No exploit	An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d anbroadcom · fabric operating system · CWE-78 RCE Local privilege escalation Command injection	High7.0	—	1.7%	Oct 8, 2026
34Monitor	CVE-2026-87674No exploit	A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 througbroadcom · fabric operating system · CWE-78 RCE Local privilege escalation Command injection	High8.5	—	0.1%	Oct 8, 2026
29Monitor	CVE-2026-87675No exploit	An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.broadcom · fabric operating system · CWE-78 RCE Command injection	High7.3	—	0.6%	Oct 8, 2026
33Monitor	CVE-2026-87685No exploit	An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.broadcom · fabric operating system · CWE-73 Path traversal	High8.4	—	0.1%	Oct 8, 2026
34Monitor	CVE-2026-87687No exploit	An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.broadcom · fabric operating system · CWE-88	High8.5	—	0.2%	Oct 8, 2026
34Monitor	CVE-2026-87688No exploit	An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative managementbroadcom · fabric operating system · CWE-77 RCE Command injection	High8.5	—	0.1%	Oct 8, 2026
35Monitor	CVE-2026-17196No exploit	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attributewebrehab · super forms – drag & drop form builder · CWE-434 RCE File upload	High8.8	—	0.5%	Oct 8, 2026
36Monitor	CVE-2026-17609No exploit	Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameterwebrehab · super forms – drag & drop form builder · CWE-434 Pre-auth File upload	Critical9.1	—	0.3%	Oct 8, 2026
28Monitor	CVE-2026-87662No exploit	Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strbroadcom · fabric operating system · CWE-78 RCE Local privilege escalation Command injection	High7.0	—	0.2%	Oct 8, 2026
28Monitor	CVE-2026-87663No exploit	An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versiobroadcom · fabric operating system · CWE-290 RCE Auth bypass Local privilege escalation	High7.1	—	0.6%	Oct 8, 2026
34Monitor	CVE-2026-87664No exploit	A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1broadcom · fabric operating system · CWE-306 Auth bypass Local privilege escalation	High8.5	—	0.1%	Oct 8, 2026
29Monitor	CVE-2026-94577No exploit	A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric broadcom · fabric operating system · CWE-15 Local privilege escalation	High7.3	—	0.1%	Oct 8, 2026

CVE-2026-20362
28Monitor
Cisco Finesse Server-Side Request Forgery Vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- SSRF
cisco · cisco finesseOct 7, 2026
CVE-2026-62176
36Monitor
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
mervinpraison · praisonaiOct 7, 2026
CVE-2026-62251
32Monitor
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
HighCVSS 8.1No exploitEPSS 0%
- RCE
- SQL injection
sipcapture · homerOct 7, 2026
CVE-2026-62252
39Monitor
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
sipcapture · homerOct 7, 2026
CVE-2026-62253
39Monitor
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
sipcapture · homerOct 7, 2026
CVE-2026-76453
35Monitor
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76454
36Monitor
Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
cisco · cisco license on-premOct 7, 2026
CVE-2026-76455
40Plan
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
CriticalCVSS 9.8No exploitEPSS 4%
- Pre-auth
- Broken access control (IDOR)
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76456
34Monitor
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation Vulnerabilities
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76457
34Monitor
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76458
34Monitor
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions Vulnerabilities
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76459
39Monitor
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76463
35Monitor
Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
cisco · cisco campus gateway softwareOct 7, 2026
CVE-2026-76464
38Monitor
Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
cisco · cisco campus gateway softwareOct 7, 2026
CVE-2026-76465
39Monitor
Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76467
30Monitor
Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco campus gateway softwareOct 7, 2026
CVE-2026-76468
32Monitor
Cisco Meraki Hardening Release - Input Validation Vulnerabilities
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
cisco · cisco campus gateway softwareOct 7, 2026
CVE-2026-76469
29Monitor
Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management Vulnerabilities
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco campus gateway softwareOct 7, 2026
CVE-2026-76470
35Monitor
Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
cisco · cisco campus gateway softwareOct 7, 2026
CVE-2026-76471
39Monitor
Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76472
35Monitor
Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
cisco · cisco campus gateway softwareOct 7, 2026
CVE-2026-76480
39Monitor
Cisco License On-Prem Security Hardening Release
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
cisco · cisco license on-premOct 7, 2026
CVE-2026-76482
40Plan
Cisco License On-Prem Security Hardening Release
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
cisco · cisco license on-premOct 7, 2026
CVE-2026-76483
36Monitor
Cisco License On-Prem Security Hardening Release
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Info leak
cisco · cisco license on-premOct 7, 2026
CVE-2026-76484
35Monitor
Cisco License On-Prem Security Hardening Release
HighCVSS 8.8No exploitEPSS 0%
- RCE
cisco · cisco license on-premOct 7, 2026
CVE-2026-76485
39Monitor
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76486
39Monitor
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-76488
26Monitor
Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure Vulnerability
MediumCVSS 6.5No exploitEPSS 0%
cisco · cisco application policy infrastructure controller (apic)Oct 7, 2026
CVE-2026-76498
39Monitor
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
cisco · cisco application policy infrastructure controller (apic)Oct 7, 2026
CVE-2026-76499
39Monitor
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cisco · cisco application policy infrastructure controller (apic)Oct 7, 2026
CVE-2026-76500
39Monitor
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cisco · cisco application policy infrastructure controller (apic)Oct 7, 2026
CVE-2026-76501
39Monitor
Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
cisco · cisco nx-os softwareOct 7, 2026
CVE-2026-92543
30Monitor
Docker Engine insecure-registry fallback via malicious DNS responses
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Weak crypto
docker · docker engineOct 7, 2026
CVE-2026-94662
28Monitor
WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unlimited elements · unlimited elements for elementor (free widgets, addons, templates)Oct 7, 2026
CVE-2026-94670
28Monitor
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
everest forms · everest formsOct 7, 2026
CVE-2026-95534
35Monitor
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
unlimited elements · unlimited elements for elementor (free widgets, addons, templates)Oct 7, 2026
CVE-2026-95595
28Monitor
WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
fontsplugin · disable and remove google fonts | gdpr & dsgvo friendlyOct 7, 2026
CVE-2026-95605
37Monitor
WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
passionate programmer peter · wp data accessOct 7, 2026
CVE-2026-95606
39Monitor
WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
liquid web / stellarwp · the events calendarOct 7, 2026
CVE-2026-107211
34Monitor
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
excelize · excelizeOct 7, 2026
CVE-2026-107212
30Monitor
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
excelize · excelizeOct 7, 2026
CVE-2026-107213
34Monitor
Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
excelize · excelizeOct 7, 2026
CVE-2026-107214
30Monitor
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
excelize · excelizeOct 7, 2026
CVE-2026-107215
30Monitor
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
excelize · excelizeOct 7, 2026
CVE-2026-107216
30Monitor
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
excelize · excelizeOct 7, 2026
CVE-2026-56851
30Monitor
Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
golang.org/x/text · golang.org/x/text/secure/precisOct 7, 2026
CVE-2026-96335
30Monitor
WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wpmu dev · forminatorOct 7, 2026
CVE-2026-103371
30Monitor
Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache geodeOct 7, 2026
CVE-2026-106164
29Monitor
Infinite Loop in Telerik Document Processing XLS Import
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Denial of service
progress software · telerik document processing librariesOct 7, 2026
CVE-2026-107217
30Monitor
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
excelize · excelizeOct 7, 2026
CVE-2026-107219
30Monitor
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
excelize · excelizeOct 7, 2026
CVE-2026-107223
28Monitor
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the proces
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
excelize · excelizeOct 7, 2026
CVE-2026-107161
30Monitor
Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
red hat · red hat enterprise linux 10Oct 7, 2026
CVE-2026-34499
34Monitor
Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.
HighCVSS 8.5No exploitEPSS 0%
- Hard-coded credentials
johnson controls · advmsOct 7, 2026
CVE-2026-97714
32Monitor
Denial of service vulnerability in Secure Access
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
absolute security · secure accessOct 7, 2026
CVE-2026-97715
28Monitor
Denial of Service in Absolute Secure Access
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
absolute security · secure accessOct 7, 2026
CVE-2026-97716
34Monitor
Denial of Service in Absolute Secure Access
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
absolute security · secure accessOct 7, 2026
CVE-2026-107227
30Monitor
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
asynchttpclient · async-http-clientOct 7, 2026
CVE-2026-76265
26Monitor
Improper Access Control through REST API Endpoints in Splunk Secure Gateway
MediumCVSS 6.5No exploitEPSS 0%
- Broken access control (IDOR)
splunk · splunkOct 7, 2026
CVE-2026-76266
30Monitor
Local Privilege Escalation through Linux Package Upgrades in Splunk Enterprise
HighCVSS 7.7No exploitEPSS 0%
- Local privilege escalation
splunk · splunkOct 7, 2026
CVE-2026-76268
41Plan
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
CriticalCVSS 9.8Proof of conceptEPSS 5%
- Pre-auth
- Auth bypass
splunk · splunkOct 7, 2026
CVE-2026-76281
21Monitor
Improper Access Control in Splunk Enterprise
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
splunk · splunkOct 7, 2026
CVE-2026-76282
35Monitor
Improper Control of a Resource Through its Lifetime in Splunk Enterprise
HighCVSS 8.8No exploitEPSS 0%
splunk · splunkOct 7, 2026
CVE-2026-76283
30Monitor
Protection Mechanism Failure in Splunk Enterprise
HighCVSS 7.6No exploitEPSS 0%
splunk · splunkOct 7, 2026
CVE-2026-76284
39Monitor
Improper Neutralization in Splunk Enterprise
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
splunk · splunkOct 7, 2026
CVE-2026-76285
39Monitor
Improper Adherence to Coding Standards in Splunk Enterprise
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
splunk · splunkOct 7, 2026
CVE-2026-105816
32Monitor
Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
HighCVSS 8.0No exploitEPSS 0%
- RCE
- Path traversal
hashicorp · vaultOct 7, 2026
CVE-2026-107230
29Monitor
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
asynchttpclient · async-http-clientOct 7, 2026
CVE-2026-107231
34Monitor
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
asynchttpclient · async-http-clientOct 7, 2026
CVE-2026-107232
30Monitor
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
asynchttpclient · async-http-clientOct 7, 2026
CVE-2026-107279
35Monitor
AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
asynchttpclient · async-http-clientOct 7, 2026
CVE-2026-107281
30Monitor
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
HighCVSS 7.6No exploitEPSS 0%
asynchttpclient · async-http-clientOct 7, 2026
CVE-2026-107282
37Monitor
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
asynchttpclient · async-http-clientOct 7, 2026
CVE-2026-89322
28Monitor
Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
HighCVSS 7.2No exploitEPSS 0%
hashicorp · vaultOct 7, 2026
CVE-2026-87679
34Monitor
When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings in
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Memory safety
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87680
35Monitor
A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated u
HighCVSS 8.5No exploitEPSS 1%
- RCE
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87681
28Monitor
An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before
HighCVSS 7.1No exploitEPSS 0%
broadcom · fabric operating systemOct 8, 2026
CVE-2026-102488
34Monitor
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obta
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
octopus deploy · octopus serverOct 8, 2026
CVE-2026-82627
30Monitor
Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Inject
HighCVSS 7.5No exploitEPSS 0%
- Deserialization
uncannyowl · uncanny automator – ai + automation for wordpress | ai agent, ai page builder, free ai usage includedOct 8, 2026
CVE-2026-87682
34Monitor
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS version
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87683
34Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Memory safety
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87659
28Monitor
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1.
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87671
28Monitor
An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1.
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87684
34Monitor
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1.
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Memory safety
broadcom · fabric operating systemOct 8, 2026
CVE-2026-94578
30Monitor
Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Account
HighCVSS 7.5No exploitEPSS 0%
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87660
28Monitor
An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS ve
HighCVSS 7.0No exploitEPSS 0%
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87666
35Monitor
An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87667
33Monitor
An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d
HighCVSS 8.4No exploitEPSS 0%
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87673
29Monitor
An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d an
HighCVSS 7.0No exploitEPSS 1%
- RCE
- Local privilege escalation
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87674
34Monitor
A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 throug
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87675
29Monitor
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87685
33Monitor
An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.
HighCVSS 8.4No exploitEPSS 0%
- Path traversal
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87687
34Monitor
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.
HighCVSS 8.5No exploitEPSS 0%
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87688
34Monitor
An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-17196
35Monitor
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
webrehab · super forms – drag & drop form builderOct 8, 2026
CVE-2026-17609
36Monitor
Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- File upload
webrehab · super forms – drag & drop form builderOct 8, 2026
CVE-2026-87662
28Monitor
Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter str
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87663
28Monitor
An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versio
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Auth bypass
- Local privilege escalation
broadcom · fabric operating systemOct 8, 2026
CVE-2026-87664
34Monitor
A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
- Local privilege escalation
broadcom · fabric operating systemOct 8, 2026
CVE-2026-94577
29Monitor
A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
broadcom · fabric operating systemOct 8, 2026