By publication date

Exploited and new serious CVEs: October 2026

8,750 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 16 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-93034No exploit	SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper paylsglang · sglang · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.4%	Oct 8, 2026
37Monitor	CVE-2026-9209No exploit	mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspxmjob · mjobtime · CWE-250 pre-auth RCE	Critical9.3	—	0.6%	Oct 8, 2026
34Monitor	CVE-2026-104077No exploit	Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdownobsidian · obsidian desktop · CWE-79 RCE XSS	High8.5	—	0.2%	Oct 8, 2026
33Monitor	CVE-2026-104078No exploit	Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypassobsidian · obsidian desktop · CWE-79 RCE XSS	High8.4	—	0.1%	Oct 8, 2026
35Monitor	CVE-2026-105436No exploit	WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerabilitymainwp · mainwp child · CWE-502 Pre-auth Deserialization	High8.8	—	0.2%	Oct 8, 2026
30Monitor	CVE-2026-107295No exploit	`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool executionpydantic · pydantic ai · CWE-352 Pre-auth CSRF	High7.6	—	0.1%	Oct 8, 2026
30Monitor	CVE-2026-107300No exploit	msgpack5: Many buffered values can exhaust the streaming decoder stackmcollina · msgpack5 · CWE-674 Pre-auth Denial of service	High7.5	—	0.4%	Oct 8, 2026
31Monitor	CVE-2026-107709No exploit	Bower decompress-zip has a path traversal vulnerabilitybower decompress-zip · decompress-zip · CWE-22 RCE Path traversal	High7.8	—	0.2%	Oct 8, 2026
28Monitor	CVE-2026-50054No exploit	Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Rightzimbra · zimbra collaboration suite · CWE-269	High7.1	—	0.1%	Oct 8, 2026
26Monitor	CVE-2026-50055Proof of concept	Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansionzimbra · zimbra collaboration suite · CWE-863 Broken access control (IDOR)	Medium6.5	—	0.3%	Oct 8, 2026
30Monitor	CVE-2026-107302No exploit	msgpack5: Truncated map32 headers throw an unexpected errormcollina · msgpack5 · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Oct 8, 2026
30Monitor	CVE-2026-107303No exploit	JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blobjhipster · generator-jhipster · CWE-79 XSS	High7.6	—	0.3%	Oct 8, 2026
32Monitor	CVE-2026-107333No exploit	Incorrect Authorization in Malcolmcisa · malcolm · CWE-863 Broken access control (IDOR)	High8.1	—	1.2%	Oct 8, 2026
28Monitor	CVE-2026-107337No exploit	Cross-Site Request Forgery in Malcolmcisa · malcolm · CWE-352 RCE CSRF	High7.1	—	0.1%	Oct 8, 2026
28Monitor	CVE-2026-107362No exploit	Server-Side Request Forgery in Malcolmcisa · malcolm · CWE-918 SSRF	High7.1	—	0.4%	Oct 8, 2026
35Monitor	CVE-2026-107375No exploit	JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssortjhipster · generator-jhipster · CWE-89 SQL injection	High8.8	—	0.4%	Oct 8, 2026
32Monitor	CVE-2026-107376No exploit	webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested inputwebonyx · graphql-php · CWE-674 Pre-auth Denial of service	High8.2	—	0.4%	Oct 8, 2026
30Monitor	CVE-2026-107377No exploit	datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directorydatamodel-code-generator · datamodel-code-generator · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Oct 8, 2026
34Monitor	CVE-2026-107378No exploit	CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>kozea · cairosvg · CWE-407 Pre-auth	High8.7	—	0.3%	Oct 8, 2026
28Monitor	CVE-2026-107695No exploit	FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlistffmpeg · ffmpeg · CWE-835 Pre-auth Denial of service	High7.1	—	0.4%	Oct 8, 2026
28Monitor	CVE-2026-107696No exploit	FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.cffmpeg · ffmpeg · CWE-835 Pre-auth Denial of service	High7.1	—	0.3%	Oct 8, 2026
21Monitor	CVE-2026-107698No exploit	FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handlingffmpeg · ffmpeg · CWE-918 Pre-auth SSRF	Medium5.3	—	0.2%	Oct 8, 2026
34Monitor	CVE-2026-93858No exploit	In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommaopenstack · mistral · CWE-78 RCE Command injection	High8.7	—	0.4%	Oct 8, 2026
28Monitor	CVE-2026-93860No exploit	In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directlopenstack · mistral · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Oct 8, 2026
28Monitor	CVE-2026-97147No exploit	In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another projecopenstack · mistral · CWE-863 Broken access control (IDOR)	High7.2	—	0.3%	Oct 8, 2026
28Monitor	CVE-2026-106429No exploit	Application denial of service via malformed KMS endpoint in MongoDB libmongocryptmongodb · libmongocrypt · CWE-191 Memory safety	High7.1	—	0.2%	Oct 8, 2026
34Monitor	CVE-2026-106433No exploit	Heap corruption via duplicate masterKey fields in MongoDB libmongocryptmongodb · libmongocrypt · CWE-843	High8.7	—	0.2%	Oct 8, 2026
34Monitor	CVE-2026-107322No exploit	OS command injection in Amazon Agent Plugins for AWS databases-on-awsaws · databases-on-aws · CWE-184 RCE Command injection	High8.5	—	0.1%	Oct 8, 2026
32Monitor	CVE-2026-107324No exploit	Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Drivermongodb · go driver · CWE-190 Pre-auth Memory safety	High8.2	—	0.2%	Oct 8, 2026
32Monitor	CVE-2026-107325No exploit	Application denial of service via missing BSON array length validation in MongoDB Go Drivermongodb · go driver · CWE-129 Pre-auth	High8.2	—	0.2%	Oct 8, 2026
30Monitor	CVE-2026-107383No exploit	MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersmariadb-corporation · mariadb-connector-nodejs · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Oct 8, 2026
32Monitor	CVE-2026-107384No exploit	MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)mariadb-corporation · mariadb-connector-nodejs · CWE-89 Pre-auth SQL injection	High8.1	—	0.4%	Oct 8, 2026
29Monitor	CVE-2026-107385No exploit	MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESmariadb-corporation · mariadb-connector-nodejs · CWE-89 Pre-auth SQL injection	High7.4	—	0.4%	Oct 8, 2026
37Monitor	CVE-2026-107699No exploit	ppt2png through 0.0.6 OS Command Injection via input and output pathstzwm · ppt2png · CWE-78 pre-auth RCE Command injection	Critical9.3	—	1.4%	Oct 8, 2026
37Monitor	CVE-2026-107700No exploit	dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argumentntharim · dot-access · CWE-94 pre-auth RCE	Critical9.3	—	0.6%	Oct 8, 2026
35Monitor	CVE-2026-107701No exploit	dot-access through 1.0.0 Prototype Pollution via set() path argumentntharim · dot-access · CWE-1321 Pre-auth Prototype pollution	High8.8	—	0.3%	Oct 8, 2026
38Monitor	CVE-2026-107703No exploit	@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertToenmaso · @enmaso/node-convert · CWE-78 pre-auth RCE Command injection	Critical9.3	—	1.8%	Oct 8, 2026
38Monitor	CVE-2026-107704No exploit	image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_formatjtescher · image_optimizer · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.0%	Oct 8, 2026
28Monitor	CVE-2026-40804No exploit	WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerabilitykodezen llc · ablocks · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 8, 2026
30Monitor	CVE-2026-84276No exploit	IBM Guardium Data Protection Denial of Serviceibm · guardium data protection · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 8, 2026
29Monitor	CVE-2026-84278No exploit	IBM Guardium Data Protection Command Injectionibm · guardium data protection · CWE-78 RCE Command injection	High7.2	—	2.4%	Oct 8, 2026
37Monitor	CVE-2026-104075No exploit	TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Logintvu networks · tvu receiver / transceiver · CWE-288 Pre-auth Auth bypass	Critical9.3	—	0.5%	Oct 8, 2026
37Monitor	CVE-2026-104076No exploit	TVU Networks Receiver/Transceiver Missing Authentication via REST APItvu networks · tvu receiver / transceiver · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.3%	Oct 8, 2026
38Monitor	CVE-2026-106126No exploit	A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-ptenable, inc. · tenable identity exposure (saas) · CWE-78 RCE Command injection	Critical9.4	—	2.1%	Oct 8, 2026
30Monitor	CVE-2026-107390No exploit	music-metadata: MP4 parser allows memory exhaustion via oversized extended atom lengthborewit · music-metadata · CWE-789 Pre-auth Denial of service	High7.5	—	0.3%	Oct 8, 2026
30Monitor	CVE-2026-107391No exploit	music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masterborewit · music-metadata · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 8, 2026
30Monitor	CVE-2026-107392No exploit	music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)borewit · music-metadata · CWE-248 Pre-auth Denial of service	High7.5	—	0.3%	Oct 8, 2026
33Monitor	CVE-2026-107705No exploit	Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()freedesktop · poppler · CWE-121 Pre-auth Memory safety	High8.3	—	0.3%	Oct 8, 2026
34Monitor	CVE-2026-107707No exploit	Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junctionintego · intego antivirus · CWE-59 Local privilege escalation	High8.5	—	0.1%	Oct 8, 2026
36Monitor	CVE-2026-82334No exploit	IBM Guardium Data Protection Out-of-bounds Readibm · guardium data protection · CWE-125 Pre-auth Memory safety	Critical9.1	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-82335No exploit	IBM Guardium Data Protection Buffer Overflowibm · guardium data protection · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-82344No exploit	IBM Guardium Data Protection Buffer Overflowibm · guardium data protection · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	0.4%	Oct 8, 2026
31Monitor	CVE-2026-84245No exploit	IBM Guardium Data Protection Privilege Escalationibm · guardium data protection · CWE-269 Local privilege escalation	High7.8	—	0.0%	Oct 8, 2026
31Monitor	CVE-2026-84250No exploit	IBM Guardium Data Protection Hard-coded Credentialsibm · guardium data protection · CWE-798 Local privilege escalation Hard-coded credentials	High7.8	—	0.0%	Oct 8, 2026
31Monitor	CVE-2026-84271No exploit	IBM Guardium Data Protection Signature Verification Bypassibm · guardium data protection · CWE-362 RCE Local privilege escalation Race condition	High7.8	—	0.0%	Oct 8, 2026
39Monitor	CVE-2026-84272No exploit	IBM Guardium Data Protection Missing Authenticationibm · guardium data protection · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	0.4%	Oct 8, 2026
30Monitor	CVE-2026-84275No exploit	IBM Guardium Data Protection Path Traversalibm · guardium data protection · CWE-22 Pre-auth Path traversal	High7.5	—	0.3%	Oct 8, 2026
34Monitor	CVE-2026-101024No exploit	Satel Netco Design Relative path traversalsatel · satel netco design · CWE-23 RCE Path traversal	High8.7	—	0.4%	Oct 8, 2026
29Monitor	CVE-2026-107318No exploit	@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports@fastify/reply-from · @fastify/reply-from · CWE-295 Pre-auth Weak crypto	High7.4	—	0.1%	Oct 8, 2026
28Monitor	CVE-2026-107778No exploit	MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()mit · krb5 · CWE-476 Memory safety	High7.1	—	0.4%	Oct 8, 2026
37Monitor	CVE-2026-107779No exploit	Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCEdromara · skyeye · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.5%	Oct 8, 2026
38Monitor	CVE-2026-107780No exploit	Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameterdromara · skyeye · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.0%	Oct 8, 2026
36Monitor	CVE-2026-107781No exploit	Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileByIddromara · skyeye · CWE-918 Pre-auth SSRF	Critical9.1	—	0.3%	Oct 8, 2026
34Monitor	CVE-2026-107782No exploit	System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Portwinsiderss · system informer · CWE-863 Local privilege escalation Broken access control (IDOR)	High8.5	—	0.1%	Oct 8, 2026
34Monitor	CVE-2026-11318Proof of concept	Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installerzuler technology · deskin · CWE-306 RCE Auth bypass Local privilege escalation	High8.5	—	0.1%	Oct 8, 2026
30Monitor	CVE-2026-11888No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-94 pre-auth RCE	High7.5	—	0.1%	Oct 8, 2026
30Monitor	CVE-2026-11930No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-285 Pre-auth Broken access control (IDOR)	High7.5	—	0.1%	Oct 8, 2026
28Monitor	CVE-2026-12109No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-787 RCE Memory safety	High7.2	—	0.2%	Oct 8, 2026
30Monitor	CVE-2026-16823No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-287 Pre-auth Auth bypass	High7.5	—	0.4%	Oct 8, 2026
35Monitor	CVE-2026-16916No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-693 RCE	High8.8	—	0.5%	Oct 8, 2026
35Monitor	CVE-2026-18740No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-88	High8.8	—	0.3%	Oct 8, 2026
35Monitor	CVE-2026-19482No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-88 RCE	High8.8	—	0.4%	Oct 8, 2026
30Monitor	CVE-2026-19491No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-287 Pre-auth Auth bypass	High7.5	—	0.4%	Oct 8, 2026
30Monitor	CVE-2026-19493No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-22 Pre-auth Path traversal	High7.5	—	0.3%	Oct 8, 2026
30Monitor	CVE-2026-19498No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-674 Pre-auth Denial of service	High7.5	—	0.2%	Oct 8, 2026
35Monitor	CVE-2026-78388No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Oct 8, 2026
39Monitor	CVE-2026-78401No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.7%	Oct 8, 2026
39Monitor	CVE-2026-78406No exploit	Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Accessibm · security verify access · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.7%	Oct 8, 2026
36Monitor	CVE-2026-79842No exploit	An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713hewlett packard enterprise · hpe intelligent management center (imc) · CWE-862 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 8, 2026
30Monitor	CVE-2026-95116No exploit	An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Oct 8, 2026
28Monitor	CVE-2026-104628No exploit	Satel Netco Design Inefficient Regular Expression Complexitysatel · satel netco design · CWE-1333 Denial of service	High7.1	—	0.3%	Oct 8, 2026
34Monitor	CVE-2026-105269No exploit	Satel Netco Design Cross-site Scriptingsatel · satel netco design · CWE-79 XSS	High8.5	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-107406Proof of concept	Memory overflow vulnerability leading to Remote Code Execution or Denial of Servicenetscaler · adc · CWE-119 pre-auth RCE Memory safety	Critical9.5	—	1.8%	Oct 8, 2026
29Monitor	CVE-2026-107716No exploit	Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistrymasci · banks · CWE-22 Path traversal	High7.3	—	0.1%	Oct 8, 2026
29Monitor	CVE-2026-107720Proof of concept	fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setnearform · fast-jwt · CWE-20 Pre-auth	High7.4	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-107722No exploit	fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionnearform · fast-jwt · CWE-347 Pre-auth Weak crypto	Critical9.8	—	0.3%	Oct 8, 2026
32Monitor	CVE-2026-107723No exploit	fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arraynearform · fast-jwt · CWE-1287	High8.1	—	0.4%	Oct 8, 2026
29Monitor	CVE-2026-107724No exploit	fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgerynearform · fast-jwt · CWE-347 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 8, 2026
34Monitor	CVE-2026-107725No exploit	Hazelcast: Authorization bypass in IMap Predicates APIhazelcast · hazelcast · CWE-862 RCE Broken access control (IDOR)	High8.7	—	0.3%	Oct 8, 2026
37Monitor	CVE-2026-107726No exploit	Hazelcast: Arbitrary member memory access by low-privileged clienthazelcast · hazelcast · CWE-20 pre-auth RCE	Critical9.3	—	0.3%	Oct 8, 2026
32Monitor	CVE-2026-107829No exploit	Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSqlbanq · jivejdon · CWE-916 Pre-auth SQL injection	High8.2	—	0.1%	Oct 8, 2026
39Monitor	CVE-2026-75875No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	0.5%	Oct 8, 2026
39Monitor	CVE-2026-80381No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-81932No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.2%	Oct 8, 2026
39Monitor	CVE-2026-82895No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-120 pre-auth RCE Memory safety	Critical9.8	—	0.3%	Oct 8, 2026
36Monitor	CVE-2026-82900No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-22 Pre-auth Path traversal	Critical9.1	—	0.3%	Oct 8, 2026
32Monitor	CVE-2026-84032No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilitiesibm · guardium data protection · CWE-295 Pre-auth Weak crypto	High8.1	—	0.1%	Oct 8, 2026
39Monitor	CVE-2026-84035No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-84057No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-78 pre-auth RCE Command injection	Critical9.8	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-84058No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	0.3%	Oct 8, 2026

CVE-2026-93034
39Monitor
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payl
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
sglang · sglangOct 8, 2026
CVE-2026-9209
37Monitor
mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
mjob · mjobtimeOct 8, 2026
CVE-2026-104077
34Monitor
Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
HighCVSS 8.5No exploitEPSS 0%
- RCE
- XSS
obsidian · obsidian desktopOct 8, 2026
CVE-2026-104078
33Monitor
Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
HighCVSS 8.4No exploitEPSS 0%
- RCE
- XSS
obsidian · obsidian desktopOct 8, 2026
CVE-2026-105436
35Monitor
WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Deserialization
mainwp · mainwp childOct 8, 2026
CVE-2026-107295
30Monitor
`pydantic-ai-slim` web UI `/api/chat` accepts browser-simple cross-origin requests that can trigger agent tool execution
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- CSRF
pydantic · pydantic aiOct 8, 2026
CVE-2026-107300
30Monitor
msgpack5: Many buffered values can exhaust the streaming decoder stack
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
mcollina · msgpack5Oct 8, 2026
CVE-2026-107709
31Monitor
Bower decompress-zip has a path traversal vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Path traversal
bower decompress-zip · decompress-zipOct 8, 2026
CVE-2026-50054
28Monitor
Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right
HighCVSS 7.1No exploitEPSS 0%
zimbra · zimbra collaboration suiteOct 8, 2026
CVE-2026-50055
26Monitor
Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
MediumCVSS 6.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
zimbra · zimbra collaboration suiteOct 8, 2026
CVE-2026-107302
30Monitor
msgpack5: Truncated map32 headers throw an unexpected error
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
mcollina · msgpack5Oct 8, 2026
CVE-2026-107303
30Monitor
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
HighCVSS 7.6No exploitEPSS 0%
- XSS
jhipster · generator-jhipsterOct 8, 2026
CVE-2026-107333
32Monitor
Incorrect Authorization in Malcolm
HighCVSS 8.1No exploitEPSS 1%
- Broken access control (IDOR)
cisa · malcolmOct 8, 2026
CVE-2026-107337
28Monitor
Cross-Site Request Forgery in Malcolm
HighCVSS 7.1No exploitEPSS 0%
- RCE
- CSRF
cisa · malcolmOct 8, 2026
CVE-2026-107362
28Monitor
Server-Side Request Forgery in Malcolm
HighCVSS 7.1No exploitEPSS 0%
- SSRF
cisa · malcolmOct 8, 2026
CVE-2026-107375
35Monitor
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
jhipster · generator-jhipsterOct 8, 2026
CVE-2026-107376
32Monitor
webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
webonyx · graphql-phpOct 8, 2026
CVE-2026-107377
30Monitor
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
datamodel-code-generator · datamodel-code-generatorOct 8, 2026
CVE-2026-107378
34Monitor
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
kozea · cairosvgOct 8, 2026
CVE-2026-107695
28Monitor
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
ffmpeg · ffmpegOct 8, 2026
CVE-2026-107696
28Monitor
FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
ffmpeg · ffmpegOct 8, 2026
CVE-2026-107698
21Monitor
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- SSRF
ffmpeg · ffmpegOct 8, 2026
CVE-2026-93858
34Monitor
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyComma
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
openstack · mistralOct 8, 2026
CVE-2026-93860
28Monitor
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directl
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
openstack · mistralOct 8, 2026
CVE-2026-97147
28Monitor
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another projec
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
openstack · mistralOct 8, 2026
CVE-2026-106429
28Monitor
Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
mongodb · libmongocryptOct 8, 2026
CVE-2026-106433
34Monitor
Heap corruption via duplicate masterKey fields in MongoDB libmongocrypt
HighCVSS 8.7No exploitEPSS 0%
mongodb · libmongocryptOct 8, 2026
CVE-2026-107322
34Monitor
OS command injection in Amazon Agent Plugins for AWS databases-on-aws
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
aws · databases-on-awsOct 8, 2026
CVE-2026-107324
32Monitor
Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
mongodb · go driverOct 8, 2026
CVE-2026-107325
32Monitor
Application denial of service via missing BSON array length validation in MongoDB Go Driver
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
mongodb · go driverOct 8, 2026
CVE-2026-107383
30Monitor
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
mariadb-corporation · mariadb-connector-nodejsOct 8, 2026
CVE-2026-107384
32Monitor
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- SQL injection
mariadb-corporation · mariadb-connector-nodejsOct 8, 2026
CVE-2026-107385
29Monitor
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- SQL injection
mariadb-corporation · mariadb-connector-nodejsOct 8, 2026
CVE-2026-107699
37Monitor
ppt2png through 0.0.6 OS Command Injection via input and output paths
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
tzwm · ppt2pngOct 8, 2026
CVE-2026-107700
37Monitor
dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
ntharim · dot-accessOct 8, 2026
CVE-2026-107701
35Monitor
dot-access through 1.0.0 Prototype Pollution via set() path argument
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Prototype pollution
ntharim · dot-accessOct 8, 2026
CVE-2026-107703
38Monitor
@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
enmaso · @enmaso/node-convertOct 8, 2026
CVE-2026-107704
38Monitor
image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
jtescher · image_optimizerOct 8, 2026
CVE-2026-40804
28Monitor
WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kodezen llc · ablocksOct 8, 2026
CVE-2026-84276
30Monitor
IBM Guardium Data Protection Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · guardium data protectionOct 8, 2026
CVE-2026-84278
29Monitor
IBM Guardium Data Protection Command Injection
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
ibm · guardium data protectionOct 8, 2026
CVE-2026-104075
37Monitor
TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
tvu networks · tvu receiver / transceiverOct 8, 2026
CVE-2026-104076
37Monitor
TVU Networks Receiver/Transceiver Missing Authentication via REST API
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
tvu networks · tvu receiver / transceiverOct 8, 2026
CVE-2026-106126
38Monitor
A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-p
CriticalCVSS 9.4No exploitEPSS 2%
- RCE
- Command injection
tenable, inc. · tenable identity exposure (saas)Oct 8, 2026
CVE-2026-107390
30Monitor
music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
borewit · music-metadataOct 8, 2026
CVE-2026-107391
30Monitor
music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
borewit · music-metadataOct 8, 2026
CVE-2026-107392
30Monitor
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
borewit · music-metadataOct 8, 2026
CVE-2026-107705
33Monitor
Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash()
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
freedesktop · popplerOct 8, 2026
CVE-2026-107707
34Monitor
Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
intego · intego antivirusOct 8, 2026
CVE-2026-82334
36Monitor
IBM Guardium Data Protection Out-of-bounds Read
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-82335
39Monitor
IBM Guardium Data Protection Buffer Overflow
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-82344
39Monitor
IBM Guardium Data Protection Buffer Overflow
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-84245
31Monitor
IBM Guardium Data Protection Privilege Escalation
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
ibm · guardium data protectionOct 8, 2026
CVE-2026-84250
31Monitor
IBM Guardium Data Protection Hard-coded Credentials
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Hard-coded credentials
ibm · guardium data protectionOct 8, 2026
CVE-2026-84271
31Monitor
IBM Guardium Data Protection Signature Verification Bypass
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Race condition
ibm · guardium data protectionOct 8, 2026
CVE-2026-84272
39Monitor
IBM Guardium Data Protection Missing Authentication
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
ibm · guardium data protectionOct 8, 2026
CVE-2026-84275
30Monitor
IBM Guardium Data Protection Path Traversal
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · guardium data protectionOct 8, 2026
CVE-2026-101024
34Monitor
Satel Netco Design Relative path traversal
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
satel · satel netco designOct 8, 2026
CVE-2026-107318
29Monitor
@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
@fastify/reply-from · @fastify/reply-fromOct 8, 2026
CVE-2026-107778
28Monitor
MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
mit · krb5Oct 8, 2026
CVE-2026-107779
37Monitor
Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
dromara · skyeyeOct 8, 2026
CVE-2026-107780
38Monitor
Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
dromara · skyeyeOct 8, 2026
CVE-2026-107781
36Monitor
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
dromara · skyeyeOct 8, 2026
CVE-2026-107782
34Monitor
System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
winsiderss · system informerOct 8, 2026
CVE-2026-11318
34Monitor
Deskin 3.3.4.3 XPC Service Privilege Escalation via Unauthenticated Installer
HighCVSS 8.5Proof of conceptEPSS 0%
- RCE
- Auth bypass
- Local privilege escalation
zuler technology · deskinOct 8, 2026
CVE-2026-11888
30Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
ibm · security verify accessOct 8, 2026
CVE-2026-11930
30Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ibm · security verify accessOct 8, 2026
CVE-2026-12109
28Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · security verify accessOct 8, 2026
CVE-2026-16823
30Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · security verify accessOct 8, 2026
CVE-2026-16916
35Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 8.8No exploitEPSS 0%
- RCE
ibm · security verify accessOct 8, 2026
CVE-2026-18740
35Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 8.8No exploitEPSS 0%
ibm · security verify accessOct 8, 2026
CVE-2026-19482
35Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 8.8No exploitEPSS 0%
- RCE
ibm · security verify accessOct 8, 2026
CVE-2026-19491
30Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · security verify accessOct 8, 2026
CVE-2026-19493
30Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · security verify accessOct 8, 2026
CVE-2026-19498
30Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · security verify accessOct 8, 2026
CVE-2026-78388
35Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
ibm · security verify accessOct 8, 2026
CVE-2026-78401
39Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
ibm · security verify accessOct 8, 2026
CVE-2026-78406
39Monitor
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
ibm · security verify accessOct 8, 2026
CVE-2026-79842
36Monitor
An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
hewlett packard enterprise · hpe intelligent management center (imc)Oct 8, 2026
CVE-2026-95116
30Monitor
An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Oct 8, 2026
CVE-2026-104628
28Monitor
Satel Netco Design Inefficient Regular Expression Complexity
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
satel · satel netco designOct 8, 2026
CVE-2026-105269
34Monitor
Satel Netco Design Cross-site Scripting
HighCVSS 8.5No exploitEPSS 0%
- XSS
satel · satel netco designOct 8, 2026
CVE-2026-107406
39Monitor
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
CriticalCVSS 9.5Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
netscaler · adcOct 8, 2026
CVE-2026-107716
29Monitor
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
masci · banksOct 8, 2026
CVE-2026-107720
29Monitor
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
nearform · fast-jwtOct 8, 2026
CVE-2026-107722
39Monitor
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
nearform · fast-jwtOct 8, 2026
CVE-2026-107723
32Monitor
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
HighCVSS 8.1No exploitEPSS 0%
nearform · fast-jwtOct 8, 2026
CVE-2026-107724
29Monitor
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
nearform · fast-jwtOct 8, 2026
CVE-2026-107725
34Monitor
Hazelcast: Authorization bypass in IMap Predicates API
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
hazelcast · hazelcastOct 8, 2026
CVE-2026-107726
37Monitor
Hazelcast: Arbitrary member memory access by low-privileged client
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
hazelcast · hazelcastOct 8, 2026
CVE-2026-107829
32Monitor
Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SQL injection
banq · jivejdonOct 8, 2026
CVE-2026-75875
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Path traversal
ibm · guardium data protectionOct 8, 2026
CVE-2026-80381
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
ibm · guardium data protectionOct 8, 2026
CVE-2026-81932
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
ibm · guardium data protectionOct 8, 2026
CVE-2026-82895
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-82900
36Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · guardium data protectionOct 8, 2026
CVE-2026-84032
32Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
ibm · guardium data protectionOct 8, 2026
CVE-2026-84035
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-84057
39Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
ibm · guardium data protectionOct 8, 2026
CVE-2026-84058
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026