By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 17 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-84198No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-120 pre-auth RCE Memory safety	Critical9.8	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-84209No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-84246No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-120 pre-auth RCE Memory safety	Critical9.8	—	0.3%	Oct 8, 2026
39Monitor	CVE-2026-84249No exploit	IBM Guardium Data Protection is affected by vulnerabilityibm · guardium data protection · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	0.4%	Oct 8, 2026
35Monitor	CVE-2026-84875No exploit	Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-119 RCE Memory safety	High8.8	—	0.4%	Oct 8, 2026
30Monitor	CVE-2026-84891No exploit	Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-798 Pre-auth Hard-coded credentials	High7.5	—	0.3%	Oct 8, 2026
22Monitor	CVE-2026-87980No exploit	Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protectionibm · guardium data protection · CWE-532 Info leak	Medium5.5	—	0.1%	Oct 8, 2026
35Monitor	CVE-2026-89091No exploit	Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionred hat · migration toolkit for applications 8 · CWE-59 Pre-auth	High8.8	—	0.4%	Oct 8, 2026
34Monitor	CVE-2026-105672No exploit	Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WBtp-link systems inc. · tapo c325wb v2 · CWE-287 Pre-auth Auth bypass	High8.7	—	0.3%	Oct 8, 2026
28Monitor	CVE-2026-105673No exploit	Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WBtp-link systems inc. · tapo c325wb v2 · CWE-121 Pre-auth Memory safety	High7.1	—	0.2%	Oct 8, 2026
34Monitor	CVE-2026-105674No exploit	Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WBtp-link systems inc. · tapo c325wb v2 · CWE-330 Pre-auth Weak crypto	High8.7	—	0.2%	Oct 8, 2026
30Monitor	CVE-2026-107728No exploit	Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthystrawberry-graphql · strawberry · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Oct 8, 2026
33Monitor	CVE-2026-107732No exploit	SumatraPDF: Markup/command-link injection into UI notification textsumatrapdfreader · sumatrapdf · CWE-94 RCE	High8.4	—	0.1%	Oct 8, 2026
28Monitor	CVE-2026-107734No exploit	SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editorssumatrapdfreader · sumatrapdf · CWE-20 RCE	High7.1	—	0.2%	Oct 8, 2026
28Monitor	CVE-2026-107802No exploit	SumatraPDF — Windows command-line argument injection in AI selection-translatesumatrapdfreader · sumatrapdf · CWE-88	High7.1	—	0.1%	Oct 8, 2026
39Monitor	CVE-2026-56857No exploit	Root.Mkdir(All) can follow junctions out of the root on Windows in osgo standard library · os · CWE-1386 Pre-auth	Critical9.8	—	0.5%	Oct 8, 2026
30Monitor	CVE-2026-56866No exploit	HTTP/1 client connection desynchronization after CONNECT rejection in net/httpgo standard library · net/http · CWE-444 Pre-auth	High7.5	—	0.6%	Oct 8, 2026
32Monitor	CVE-2026-69435No exploit	Azure SRE Agent Elevation of Privilege Vulnerabilitymicrosoft · azure sre agent · CWE-918 SSRF	High8.1	—	0.5%	Oct 8, 2026
39Monitor	CVE-2026-77900No exploit	Azure App Service Remote Code Execution Vulnerabilitymicrosoft · azure app service for linux · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	0.7%	Oct 8, 2026
30Monitor	CVE-2026-78659No exploit	HTTP/2 server memory exhaustion due to Trailer headers in net/httpgo standard library · net/http · CWE-405 Pre-auth Denial of service	High7.5	—	0.8%	Oct 8, 2026
30Monitor	CVE-2026-78660No exploit	HTTP/2 transport accepts malformed framing-related headers in net/httpgo standard library · net/http · CWE-444 Pre-auth	High7.5	—	0.5%	Oct 8, 2026
36Monitor	CVE-2026-78663No exploit	Double flow control refund on HTTP/2 server streams in net/httpgo standard library · net/http · CWE-675 Pre-auth	Critical9.1	—	0.8%	Oct 8, 2026
30Monitor	CVE-2026-78667No exploit	Lack of limit on size of parsed Range headers in net/httpgo standard library · net/http · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Oct 8, 2026
30Monitor	CVE-2026-78669No exploit	Excessive CPU consumption from repeated initial window changes in net/httpgo standard library · net/http · CWE-405 Pre-auth Denial of service	High7.5	—	0.8%	Oct 8, 2026
34Monitor	CVE-2026-83943No exploit	Azure API Center Information Disclosure Vulnerabilitymicrosoft · azure api center · CWE-200 Pre-auth Info leak	High8.7	—	0.5%	Oct 8, 2026
39Monitor	CVE-2026-88131No exploit	Microsoft Dataverse Remote Code Execution Vulnerabilitymicrosoft · dataverse · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	1.2%	Oct 8, 2026
30Monitor	CVE-2026-94439No exploit	HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpgo standard library · net/http · CWE-444 Pre-auth	High7.5	—	0.5%	Oct 8, 2026
30Monitor	CVE-2026-94440No exploit	Memory limit bypass when parsing MIME headers in net/textproto, mime/multipartgo standard library · net/textproto · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Oct 8, 2026
31Monitor	CVE-2026-94444No exploit	Checksum bypass for golang.org/fips140 in cmd/gogo toolchain · cmd/go · CWE-354	High7.8	—	0.0%	Oct 8, 2026
31Monitor	CVE-2026-94447No exploit	Checksum database bypass for golang.org/toolchain in cmd/gogo toolchain · cmd/go · CWE-354	High7.8	—	0.1%	Oct 8, 2026
39Monitor	CVE-2026-94510No exploit	Microsoft Bookings Elevation of Privilege Vulnerabilitymicrosoft · microsoft bookings · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.9	—	0.5%	Oct 8, 2026
40Plan	CVE-2026-96207No exploit	Microsoft Partner Center Elevation of Privilege Vulnerabilitymicrosoft · partner center · CWE-295 Pre-auth Weak crypto	Critical10.0	—	0.6%	Oct 8, 2026
30Monitor	CVE-2026-97031No exploit	Reject malformed ECH outer extension references in crypto/tlsgo standard library · crypto/tls · CWE-405 Pre-auth Denial of service	High7.5	—	0.7%	Oct 8, 2026
30Monitor	CVE-2026-97032No exploit	HTTP/2 server crash due to HPACK encoder race in net/httpgo standard library · net/http · CWE-362 Pre-auth Race condition Denial of service	High7.5	—	0.6%	Oct 8, 2026
37Monitor	CVE-2026-5759No exploit	Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDBfalkordb · falkordb · CWE-415 pre-auth RCE Memory safety	Critical9.3	—	0.5%	Oct 9, 2026
35Monitor	CVE-2026-7826No exploit	Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDBfalkordb · falkordb · CWE-125 Pre-auth Memory safety	High8.8	—	0.4%	Oct 9, 2026
36Monitor	CVE-2026-7827No exploit	Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDBfalkordb · falkordb · CWE-121 pre-auth RCE Memory safety	Critical9.2	—	0.5%	Oct 9, 2026
37Monitor	CVE-2026-107908No exploit	Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET messagefalkordb · falkordb · CWE-787 pre-auth RCE Memory safety	Critical9.3	—	0.5%	Oct 9, 2026
35Monitor	CVE-2026-107909No exploit	Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload lengthfalkordb · falkordb · CWE-787 Pre-auth Memory safety	High8.8	—	0.4%	Oct 9, 2026
36Monitor	CVE-2026-107910No exploit	Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handlingfalkordb · falkordb · CWE-287 Pre-auth Auth bypass	Critical9.2	—	0.4%	Oct 9, 2026
30Monitor	CVE-2026-107911No exploit	Type confusion in FalkorDB GRAPH.QUERY via the --bolt argumentfalkordb · falkordb · CWE-843	High7.7	—	0.3%	Oct 9, 2026
31Monitor	CVE-2026-107914No exploit	Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archibackdropcms · backdrop · CWE-459	High7.8	—	0.1%	Oct 9, 2026
35Monitor	CVE-2025-15700No exploit	AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Importunknown · awp classifieds · CWE-434 RCE File upload	High8.8	—	0.3%	Oct 9, 2026
28Monitor	CVE-2026-81929No exploit	Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameteroceanwp · ocean pro demos · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 9, 2026
35Monitor	CVE-2026-93548No exploit	FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonationunknown · foosales · CWE-269	High8.8	—	0.2%	Oct 9, 2026
30Monitor	CVE-2026-97076No exploit	WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerabilitywp media · wp rocket · CWE-624 pre-auth RCE Denial of service	High7.5	—	0.2%	Oct 9, 2026
28Monitor	CVE-2026-106145No exploit	Privilege Escalation in Telerik Report Server Service-Agent Hubprogress software · telerik report server · CWE-266	High7.1	—	0.1%	Oct 9, 2026
35Monitor	CVE-2026-106155No exploit	Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewersprogress software · telerik report server · CWE-79 XSS	High8.9	—	0.1%	Oct 9, 2026
35Monitor	CVE-2026-19569No exploit	Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heapzephyrproject · zephyr · CWE-190 Memory safety	High8.8	—	0.1%	Oct 9, 2026
35Monitor	CVE-2026-19570No exploit	Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive statezephyrproject · zephyr · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Oct 9, 2026
28Monitor	CVE-2026-19574No exploit	ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolationzephyrproject · zephyr · CWE-284 Broken access control (IDOR)	High7.0	—	0.0%	Oct 9, 2026
31Monitor	CVE-2026-19575No exploit	Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel codezephyrproject · zephyr · CWE-843 RCE	High7.8	—	0.1%	Oct 9, 2026
31Monitor	CVE-2026-98376No exploit	bpf: Use array_map_meta_equal for percpu array inner map replacementlinux · linux	High7.8	—	0.1%	Oct 9, 2026
31Monitor	CVE-2026-98378No exploit	bpf: Skip unsettled links in link iteratorlinux · linux	High7.8	—	0.1%	Oct 9, 2026
31Monitor	CVE-2026-98381No exploit	veth: manage XDP program pointers during channel resizelinux · linux	High7.8	—	0.1%	Oct 9, 2026
31Monitor	CVE-2026-98382No exploit	bpf: Reject dev-bound-only programs on other deviceslinux · linux	High7.8	—	0.1%	Oct 9, 2026
31Monitor	CVE-2026-98383No exploit	bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCALlinux · linux	High7.8	—	0.1%	Oct 9, 2026
32Monitor	CVE-2026-104635No exploit	Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messageselixir-protobuf · protobuf · CWE-674 Pre-auth Denial of service	High8.2	—	0.5%	Oct 9, 2026
35Monitor	CVE-2026-76769No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability.dell · policy manager for secure connect gateway · CWE-862 Broken access control (IDOR)	High8.8	—	0.1%	Oct 9, 2026
39Monitor	CVE-2026-76779No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authenticationdell · policy manager for secure connect gateway · CWE-307 Pre-auth	Critical9.8	—	0.2%	Oct 9, 2026
28Monitor	CVE-2026-78018No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Dedell · policy manager for secure connect gateway · CWE-1188 Local privilege escalation	High7.1	—	0.0%	Oct 9, 2026
35Monitor	CVE-2026-78019No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Controdell · policy manager for secure connect gateway · CWE-829	High8.8	—	0.3%	Oct 9, 2026
35Monitor	CVE-2026-78020No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability.dell · policy manager for secure connect gateway · CWE-295 Pre-auth Weak crypto	High8.8	—	0.1%	Oct 9, 2026
32Monitor	CVE-2026-78022No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerabilidell · policy manager for secure connect gateway · CWE-636	High8.1	—	0.1%	Oct 9, 2026
37Monitor	CVE-2026-107935No exploit	Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /exposered hat · red hat build of podman desktop · CWE-22 Pre-auth Path traversal	Critical9.3	—	0.2%	Oct 9, 2026
32Monitor	CVE-2026-71884No exploit	Packet CTR reports a full success length after the counter is exhaustedlegion of the bouncy castle inc. · bc-lts-java · CWE-323 Pre-auth	High8.2	—	0.2%	Oct 9, 2026
35Monitor	CVE-2026-78023No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Keydell · policy manager for secure connect gateway · CWE-639 Broken access control (IDOR)	High8.8	—	0.1%	Oct 9, 2026
34Monitor	CVE-2026-78024No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability.dell · policy manager for secure connect gateway · CWE-918 SSRF	High8.7	—	0.1%	Oct 9, 2026
30Monitor	CVE-2026-78025No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulndell · policy manager for secure connect gateway · CWE-306 Pre-auth Auth bypass	High7.5	—	0.2%	Oct 9, 2026
35Monitor	CVE-2026-78026No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Keydell · policy manager for secure connect gateway · CWE-639 Broken access control (IDOR)	High8.8	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-78339No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resdell · policy manager for secure connect gateway · CWE-732 Local privilege escalation	High7.1	—	0.0%	Oct 9, 2026
28Monitor	CVE-2026-78341No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability.dell · policy manager for secure connect gateway · CWE-863 Broken access control (IDOR)	High7.2	—	0.2%	Oct 9, 2026
37Monitor	CVE-2026-93947No exploit	WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerabilityshinetheme · traveler · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 9, 2026
28Monitor	CVE-2026-94158No exploit	WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitybkninja · gloria admin panel · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-94159No exploit	WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilityklbtheme · total donations · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-94161No exploit	WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilitythemegoods · grand restaurant · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-94166No exploit	WordPress UpSolution Core plugin < 9.4.1 - Cross Site Scripting (XSS) vulnerabilityupsolution · upsolution core · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-94167No exploit	WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerabilityextend themes · kubio ai page builder · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-94170No exploit	WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerabilityheateor support · sassy social share · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-94415No exploit	WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerabilitymuffingroup · betheme · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
40Plan	CVE-2026-94503Proof of concept	WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerabilitypx-lab · zombify · CWE-434 Pre-auth File upload	Critical10.0	—	0.3%	Oct 9, 2026
28Monitor	CVE-2026-94568No exploit	WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerabilitywp hosting as · pay with vipps for woocommerce · CWE-502 Deserialization	High7.2	—	0.3%	Oct 9, 2026
28Monitor	CVE-2026-94632No exploit	WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerabilitystiofan · blockstrap page builder - bootstrap blocks · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-94641Proof of concept	WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerabilitystiofan · userswp · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Oct 9, 2026
28Monitor	CVE-2026-94661No exploit	WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerabilitycrocoblock · jetblog · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
34Monitor	CVE-2026-94663No exploit	WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerabilitymetagauss · profilegrid · CWE-89 SQL injection	High8.5	—	0.2%	Oct 9, 2026
30Monitor	CVE-2026-94664No exploit	WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerabilityadd-ons.org · pdf for contact form 7 · CWE-22 Pre-auth Path traversal	High7.5	—	0.3%	Oct 9, 2026
30Monitor	CVE-2026-94666No exploit	WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerabilityzealousweb · generate pdf using contact form 7 · CWE-22 Pre-auth Path traversal	High7.5	—	0.3%	Oct 9, 2026
28Monitor	CVE-2026-94668No exploit	WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerabilitydimitri grassi · salon booking system · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-95591No exploit	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikbooking hotel booking engine & pms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-95596No exploit	WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerabilitymamunur rashid · shopbuilder – elementor woocommerce builder addons · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
26Monitor	CVE-2026-95597Proof of concept	WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerabilitycodemstory · 워드프레스 결제 심플페이 · CWE-862 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.2%	Oct 9, 2026
28Monitor	CVE-2026-95598No exploit	WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilitycodepeople · search in place · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
34Monitor	CVE-2026-95599No exploit	WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerabilitytaskbuilder · taskbuilder · CWE-89 SQL injection	High8.5	—	0.2%	Oct 9, 2026
34Monitor	CVE-2026-95607No exploit	WordPress WPLMS theme <= 4.973 - SQL Injection vulnerabilityvibethemes · wplms · CWE-89 SQL injection	High8.5	—	0.2%	Oct 9, 2026
28Monitor	CVE-2026-95608No exploit	WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerabilitypluginus.net · husky · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
28Monitor	CVE-2026-95609No exploit	WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilitydavid lingren · media library assistant · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 9, 2026
34Monitor	CVE-2026-95610No exploit	WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerabilityupsolution · upsolution core · CWE-89 SQL injection	High8.5	—	0.2%	Oct 9, 2026
37Monitor	CVE-2026-96327No exploit	WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerabilityvibethemes · wplms · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 9, 2026
37Monitor	CVE-2026-96328No exploit	WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerabilityjegtheme · jnews - pay writer · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 9, 2026

CVE-2026-84198
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-84209
39Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- SQL injection
ibm · guardium data protectionOct 8, 2026
CVE-2026-84246
39Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-84249
39Monitor
IBM Guardium Data Protection is affected by vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
ibm · guardium data protectionOct 8, 2026
CVE-2026-84875
35Monitor
Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Memory safety
ibm · guardium data protectionOct 8, 2026
CVE-2026-84891
30Monitor
Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
ibm · guardium data protectionOct 8, 2026
CVE-2026-87980
22Monitor
Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection
MediumCVSS 5.5No exploitEPSS 0%
- Info leak
ibm · guardium data protectionOct 8, 2026
CVE-2026-89091
35Monitor
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
red hat · migration toolkit for applications 8Oct 8, 2026
CVE-2026-105672
34Monitor
Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
tp-link systems inc. · tapo c325wb v2Oct 8, 2026
CVE-2026-105673
28Monitor
Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
tp-link systems inc. · tapo c325wb v2Oct 8, 2026
CVE-2026-105674
34Monitor
Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
tp-link systems inc. · tapo c325wb v2Oct 8, 2026
CVE-2026-107728
30Monitor
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
strawberry-graphql · strawberryOct 8, 2026
CVE-2026-107732
33Monitor
SumatraPDF: Markup/command-link injection into UI notification text
HighCVSS 8.4No exploitEPSS 0%
- RCE
sumatrapdfreader · sumatrapdfOct 8, 2026
CVE-2026-107734
28Monitor
SumatraPDF: SyncTeX Argument Injection in Inverse Search Enables Arbitrary Command Execution via External Editors
HighCVSS 7.1No exploitEPSS 0%
- RCE
sumatrapdfreader · sumatrapdfOct 8, 2026
CVE-2026-107802
28Monitor
SumatraPDF — Windows command-line argument injection in AI selection-translate
HighCVSS 7.1No exploitEPSS 0%
sumatrapdfreader · sumatrapdfOct 8, 2026
CVE-2026-56857
39Monitor
Root.Mkdir(All) can follow junctions out of the root on Windows in os
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
go standard library · osOct 8, 2026
CVE-2026-56866
30Monitor
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
go standard library · net/httpOct 8, 2026
CVE-2026-69435
32Monitor
Azure SRE Agent Elevation of Privilege Vulnerability
HighCVSS 8.1No exploitEPSS 0%
- SSRF
microsoft · azure sre agentOct 8, 2026
CVE-2026-77900
39Monitor
Azure App Service Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
microsoft · azure app service for linuxOct 8, 2026
CVE-2026-78659
30Monitor
HTTP/2 server memory exhaustion due to Trailer headers in net/http
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
go standard library · net/httpOct 8, 2026
CVE-2026-78660
30Monitor
HTTP/2 transport accepts malformed framing-related headers in net/http
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
go standard library · net/httpOct 8, 2026
CVE-2026-78663
36Monitor
Double flow control refund on HTTP/2 server streams in net/http
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
go standard library · net/httpOct 8, 2026
CVE-2026-78667
30Monitor
Lack of limit on size of parsed Range headers in net/http
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
go standard library · net/httpOct 8, 2026
CVE-2026-78669
30Monitor
Excessive CPU consumption from repeated initial window changes in net/http
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
go standard library · net/httpOct 8, 2026
CVE-2026-83943
34Monitor
Azure API Center Information Disclosure Vulnerability
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
microsoft · azure api centerOct 8, 2026
CVE-2026-88131
39Monitor
Microsoft Dataverse Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Deserialization
microsoft · dataverseOct 8, 2026
CVE-2026-94439
30Monitor
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
go standard library · net/httpOct 8, 2026
CVE-2026-94440
30Monitor
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
go standard library · net/textprotoOct 8, 2026
CVE-2026-94444
31Monitor
Checksum bypass for golang.org/fips140 in cmd/go
HighCVSS 7.8No exploitEPSS 0%
go toolchain · cmd/goOct 8, 2026
CVE-2026-94447
31Monitor
Checksum database bypass for golang.org/toolchain in cmd/go
HighCVSS 7.8No exploitEPSS 0%
go toolchain · cmd/goOct 8, 2026
CVE-2026-94510
39Monitor
Microsoft Bookings Elevation of Privilege Vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
microsoft · microsoft bookingsOct 8, 2026
CVE-2026-96207
40Plan
Microsoft Partner Center Elevation of Privilege Vulnerability
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
microsoft · partner centerOct 8, 2026
CVE-2026-97031
30Monitor
Reject malformed ECH outer extension references in crypto/tls
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
go standard library · crypto/tlsOct 8, 2026
CVE-2026-97032
30Monitor
HTTP/2 server crash due to HPACK encoder race in net/http
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Race condition
- Denial of service
go standard library · net/httpOct 8, 2026
CVE-2026-5759
37Monitor
Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
falkordb · falkordbOct 9, 2026
CVE-2026-7826
35Monitor
Heap out-of-bounds read in FalkorDB BufferSerializerIOv2_ReadBuffer via crafted RDB
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
falkordb · falkordbOct 9, 2026
CVE-2026-7827
36Monitor
Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Memory safety
falkordb · falkordbOct 9, 2026
CVE-2026-107908
37Monitor
Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
falkordb · falkordbOct 9, 2026
CVE-2026-107909
35Monitor
Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
falkordb · falkordbOct 9, 2026
CVE-2026-107910
36Monitor
Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
falkordb · falkordbOct 9, 2026
CVE-2026-107911
30Monitor
Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument
HighCVSS 7.7No exploitEPSS 0%
falkordb · falkordbOct 9, 2026
CVE-2026-107914
31Monitor
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archi
HighCVSS 7.8No exploitEPSS 0%
backdropcms · backdropOct 9, 2026
CVE-2025-15700
35Monitor
AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
unknown · awp classifiedsOct 9, 2026
CVE-2026-81929
28Monitor
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
oceanwp · ocean pro demosOct 9, 2026
CVE-2026-93548
35Monitor
FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation
HighCVSS 8.8No exploitEPSS 0%
unknown · foosalesOct 9, 2026
CVE-2026-97076
30Monitor
WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Denial of service
wp media · wp rocketOct 9, 2026
CVE-2026-106145
28Monitor
Privilege Escalation in Telerik Report Server Service-Agent Hub
HighCVSS 7.1No exploitEPSS 0%
progress software · telerik report serverOct 9, 2026
CVE-2026-106155
35Monitor
Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers
HighCVSS 8.9No exploitEPSS 0%
- XSS
progress software · telerik report serverOct 9, 2026
CVE-2026-19569
35Monitor
Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyrOct 9, 2026
CVE-2026-19570
35Monitor
Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrOct 9, 2026
CVE-2026-19574
28Monitor
ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation
HighCVSS 7.0No exploitEPSS 0%
- Broken access control (IDOR)
zephyrproject · zephyrOct 9, 2026
CVE-2026-19575
31Monitor
Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code
HighCVSS 7.8No exploitEPSS 0%
- RCE
zephyrproject · zephyrOct 9, 2026
CVE-2026-98376
31Monitor
bpf: Use array_map_meta_equal for percpu array inner map replacement
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 9, 2026
CVE-2026-98378
31Monitor
bpf: Skip unsettled links in link iterator
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 9, 2026
CVE-2026-98381
31Monitor
veth: manage XDP program pointers during channel resize
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 9, 2026
CVE-2026-98382
31Monitor
bpf: Reject dev-bound-only programs on other devices
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 9, 2026
CVE-2026-98383
31Monitor
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
HighCVSS 7.8No exploitEPSS 0%
linux · linuxOct 9, 2026
CVE-2026-104635
32Monitor
Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
elixir-protobuf · protobufOct 9, 2026
CVE-2026-76769
35Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability.
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-76779
39Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78018
28Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure De
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78019
35Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Contro
HighCVSS 8.8No exploitEPSS 0%
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78020
35Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78022
32Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerabili
HighCVSS 8.1No exploitEPSS 0%
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-107935
37Monitor
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Path traversal
red hat · red hat build of podman desktopOct 9, 2026
CVE-2026-71884
32Monitor
Packet CTR reports a full success length after the counter is exhausted
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
legion of the bouncy castle inc. · bc-lts-javaOct 9, 2026
CVE-2026-78023
35Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78024
34Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability.
HighCVSS 8.7No exploitEPSS 0%
- SSRF
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78025
30Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vuln
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78026
35Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78339
28Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Res
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-78341
28Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability.
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
dell · policy manager for secure connect gatewayOct 9, 2026
CVE-2026-93947
37Monitor
WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
shinetheme · travelerOct 9, 2026
CVE-2026-94158
28Monitor
WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bkninja · gloria admin panelOct 9, 2026
CVE-2026-94159
28Monitor
WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
klbtheme · total donationsOct 9, 2026
CVE-2026-94161
28Monitor
WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
themegoods · grand restaurantOct 9, 2026
CVE-2026-94166
28Monitor
WordPress UpSolution Core plugin < 9.4.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
upsolution · upsolution coreOct 9, 2026
CVE-2026-94167
28Monitor
WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
extend themes · kubio ai page builderOct 9, 2026
CVE-2026-94170
28Monitor
WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
heateor support · sassy social shareOct 9, 2026
CVE-2026-94415
28Monitor
WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
muffingroup · bethemeOct 9, 2026
CVE-2026-94503
40Plan
WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- File upload
px-lab · zombifyOct 9, 2026
CVE-2026-94568
28Monitor
WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
wp hosting as · pay with vipps for woocommerceOct 9, 2026
CVE-2026-94632
28Monitor
WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
stiofan · blockstrap page builder - bootstrap blocksOct 9, 2026
CVE-2026-94641
28Monitor
WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
stiofan · userswpOct 9, 2026
CVE-2026-94661
28Monitor
WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
crocoblock · jetblogOct 9, 2026
CVE-2026-94663
34Monitor
WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
metagauss · profilegridOct 9, 2026
CVE-2026-94664
30Monitor
WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
add-ons.org · pdf for contact form 7Oct 9, 2026
CVE-2026-94666
30Monitor
WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
zealousweb · generate pdf using contact form 7Oct 9, 2026
CVE-2026-94668
28Monitor
WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
dimitri grassi · salon booking systemOct 9, 2026
CVE-2026-95591
28Monitor
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
e4jvikwp · vikbooking hotel booking engine & pmsOct 9, 2026
CVE-2026-95596
28Monitor
WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
mamunur rashid · shopbuilder – elementor woocommerce builder addonsOct 9, 2026
CVE-2026-95597
26Monitor
WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
codemstory · 워드프레스 결제 심플페이Oct 9, 2026
CVE-2026-95598
28Monitor
WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
codepeople · search in placeOct 9, 2026
CVE-2026-95599
34Monitor
WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
taskbuilder · taskbuilderOct 9, 2026
CVE-2026-95607
34Monitor
WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
vibethemes · wplmsOct 9, 2026
CVE-2026-95608
28Monitor
WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
pluginus.net · huskyOct 9, 2026
CVE-2026-95609
28Monitor
WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
david lingren · media library assistantOct 9, 2026
CVE-2026-95610
34Monitor
WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
upsolution · upsolution coreOct 9, 2026
CVE-2026-96327
37Monitor
WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
vibethemes · wplmsOct 9, 2026
CVE-2026-96328
37Monitor
WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
jegtheme · jnews - pay writerOct 9, 2026