By publication date

Exploited and new serious CVEs: October 2026

8,604 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 87

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-79901No exploit	Predictable Active Directory service-account passwords in BoKS Managerfortra · boks manager boks-server · CWE-338 Weak crypto	Critical9.9	—	0.2%	Oct 1, 2026
34Monitor	CVE-2024-58388No exploit	Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.htmlsharp corporation · multiple multifunction printers · CWE-22 Pre-auth Path traversal	High8.7	—	0.8%	Oct 1, 2026
30Monitor	CVE-2026-100514No exploit	WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerabilitypete nelson · rest api log · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-100517No exploit	WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerabilityvillatheme · photo reviews for woocommerce · CWE-639 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-102378No exploit	WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilitybplugins · parallax section block · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 1, 2026
25Monitor	CVE-2026-103004No exploit	next.js cache leak on warm `use cache` handlers accessing root paramvercel · next.js · CWE-524 Pre-auth	Medium6.3	—	0.2%	Oct 1, 2026
35Monitor	CVE-2026-103068No exploit	WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerabilitybytecore stack · bytecorestack – mcp connector for ai tools · CWE-266	High8.8	—	0.2%	Oct 1, 2026
39Monitor	CVE-2026-103752Proof of concept	WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerabilitypaul ryan · authorizer · CWE-266 Pre-auth	Critical9.8	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-56589No exploit	HCL BigFix Service Management is affected by multiple security vulnerabilities.hcltech · bigfix service management · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 1, 2026
37Monitor	CVE-2026-62071No exploit	WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerabilitynickboss · wordpress file upload · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-62073No exploit	WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerabilitythemeisle · wp full stripe free · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Oct 1, 2026
29Monitor	CVE-2026-67105No exploit	HCL BigFix Service Management is affected by multiple security vulnerabilities.hcltech · bigfix service management · CWE-319 Pre-auth Weak crypto	High7.4	—	0.1%	Oct 1, 2026
36Monitor	CVE-2026-79898No exploit	Fortra BoKS Manager crlserver command injection vulnerabilityfortra · boks manager · CWE-78 RCE Command injection	Critical9.1	—	0.9%	Oct 1, 2026
31Monitor	CVE-2026-79899No exploit	Fortra BoKS Manager bccgethostcert insecure temporary file vulnerabilityfortra · boks manager · CWE-377	High7.9	—	0.0%	Oct 1, 2026
28Monitor	CVE-2026-94390No exploit	WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerabilitydotstore · hide shipping method for woocommerce · CWE-502 Deserialization	High7.2	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-95588No exploit	WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerabilityacymailing newsletter team · acymailing smtp newsletter · CWE-22 Pre-auth Path traversal Denial of service	High8.6	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-97260No exploit	WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerabilitymaxfoundry · maxgalleria · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 1, 2026
28Monitor	CVE-2026-97268No exploit	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerabilitypremmerce · premmerce wishlist for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 1, 2026
28Monitor	CVE-2026-97273No exploit	WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerabilitypremmerce · premmerce wishlist for woocommerce · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 1, 2026
30Monitor	CVE-2026-97277No exploit	WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerabilityapps mav · social boost · CWE-862 Broken access control (IDOR)	High7.6	—	0.2%	Oct 1, 2026
35Monitor	CVE-2026-97284No exploit	WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerabilityicegram · icegram · CWE-502 Deserialization	High8.8	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-97297No exploit	WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerabilityapps mav · gratisfaction · CWE-862 Broken access control (IDOR)	High7.6	—	0.2%	Oct 1, 2026
33Monitor	CVE-2026-101322No exploit	In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastrueclipse foundation · eclipse basyx aas web ui · CWE-201 Pre-auth	High8.3	—	0.3%	Oct 1, 2026
8Monitor	CVE-2026-103690Proof of concept	itsourcecode Leave Management System controller.php sql injectionitsourcecode · leave management system · CWE-74 SQL injection	Low2.1	—	0.2%	Oct 1, 2026
39Monitor	CVE-2026-12627No exploit	Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerabilityfortra · fortra's core privileged access manager (boks) · CWE-121 Pre-auth Memory safety	Critical9.8	—	0.4%	Oct 1, 2026
30Monitor	CVE-2026-46729No exploit	Apache HTTP Server: mod_heartmonitor denial of serviceapache · http server · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 1, 2026
30Monitor	CVE-2026-47360No exploit	Apache HTTP Server: mod_session: Session cookie not removed during internal redirectapache · http server · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Oct 1, 2026
30Monitor	CVE-2026-79896No exploit	Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerabilityfortra · boks manager · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Oct 1, 2026
37Monitor	CVE-2026-94620No exploit	Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)foundation50 · classroom50 · CWE-22 Pre-auth Path traversal	Critical9.4	—	0.4%	Oct 1, 2026
34Monitor	CVE-2026-101888No exploit	Prime Mover < 2.2.1 Zip Slip Path Traversal File Writecodexonics · prime mover · CWE-22 RCE Path traversal	High8.6	—	0.5%	Oct 1, 2026
28Monitor	CVE-2026-101889No exploit	Prime Mover < 2.2.1 Path Traversal via wprime-config.jsoncodexonics · prime mover · CWE-22 Path traversal	High7.0	—	0.3%	Oct 1, 2026
29Monitor	CVE-2026-103921No exploit	GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executorardatan · graphql-tools · CWE-295 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 1, 2026
35Monitor	CVE-2026-12405No exploit	Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterred hat · red hat satellite 6.19 for rhel 9 · CWE-78 RCE Command injection	High8.8	—	1.5%	Oct 1, 2026
30Monitor	CVE-2026-12423No exploit	Foreman: unauthenticated information disclosure via provisioning token validation flawredhat · satellite · CWE-306 Pre-auth Auth bypass	High7.5	—	0.3%	Oct 1, 2026
32Monitor	CVE-2026-12540No exploit	Foreman: command injection in foreman-rake errors:fetch_log via request_id parameterredhat · satellite · CWE-78 RCE Command injection	High8.2	—	1.2%	Oct 1, 2026
32Monitor	CVE-2026-12541No exploit	Foreman: command injection in foreman-rake database tasksredhat · satellite · CWE-78 RCE Command injection	High8.2	—	1.2%	Oct 1, 2026
30Monitor	CVE-2026-12544No exploit	Foreman: ssti and insecure deserialization in foreman-rake configurationredhat · satellite · CWE-502 RCE Deserialization SSTI	High7.7	—	0.2%	Oct 1, 2026
37Monitor	CVE-2026-13043Proof of concept	WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Accesswatchguard · endpoint security · CWE-306 Auth bypass Local privilege escalation	Critical9.3	—	0.1%	Oct 1, 2026
32Monitor	CVE-2026-14316No exploit	Heap buffer overflow in boks_sshd revoked-key error handlingfortra · core privileged access manager (boks) · CWE-122 Pre-auth Memory safety	High8.1	—	0.2%	Oct 1, 2026
30Monitor	CVE-2026-48005No exploit	Apache HTTP Server: mod_auth_digest reauthentication attackapache · http server · CWE-306 Pre-auth Auth bypass Denial of service	High7.5	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-56153No exploit	Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_charapache · http server · CWE-787 Pre-auth Memory safety	High7.5	—	0.4%	Oct 1, 2026
39Monitor	CVE-2026-56154No exploit	Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}apache · http server · CWE-416 Pre-auth Memory safety	Critical9.8	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-56449No exploit	Apache HTTP Server: mod_proxy_html: crash in dump_contentapache · http server · CWE-787 Pre-auth Memory safety	High7.5	—	0.5%	Oct 1, 2026
39Monitor	CVE-2026-57941No exploit	Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancyapache · http server · CWE-416 Pre-auth Memory safety	Critical9.8	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-59685No exploit	Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEMapache · http server · CWE-787 Pre-auth Memory safety	High7.5	—	0.4%	Oct 1, 2026
39Monitor	CVE-2026-59797No exploit	Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-functionapache · http server · CWE-269 Pre-auth	Critical9.8	—	0.4%	Oct 1, 2026
30Monitor	CVE-2026-63045No exploit	Apache HTTP Server: mod_proxy_ftp PASV address handlingapache · http server · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Oct 1, 2026
30Monitor	CVE-2026-63292Proof of concept	Apache HTTP Server: mod_vhost_alias stack overflowapache · http server · CWE-121 pre-auth RCE Memory safety Denial of service	High7.5	—	0.9%	Oct 1, 2026
30Monitor	CVE-2026-63686Proof of concept	Apache HTTP Server: mod_xml2enc crash on charset conversion failureapache · http server · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 1, 2026
30Monitor	CVE-2026-63718No exploit	Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smugglingapache · http server · CWE-444 Pre-auth	High7.5	—	0.4%	Oct 1, 2026
32Monitor	CVE-2026-73636No exploit	Apache HTTP Server: mod_auth_digest one-time-nonce replay attackapache · http server · CWE-294 Pre-auth Auth bypass	High8.1	—	0.3%	Oct 1, 2026
29Monitor	CVE-2026-73637No exploit	Apache HTTP Server: mod_auth_digest DoS attackapache · http server · CWE-416 Pre-auth Memory safety	High7.3	—	0.4%	Oct 1, 2026
33Monitor	CVE-2026-73975No exploit	djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples4turesearchdata · djehuty · CWE-943 SQL injection	High8.4	—	0.3%	Oct 1, 2026
35Monitor	CVE-2026-93546No exploit	Apache HTTP Server: mod_dav_fs namespace overflowapache · http server · CWE-190 Memory safety	High8.8	—	0.4%	Oct 1, 2026
35Monitor	CVE-2026-96658No exploit	Foreman: foreman: arbitrary code execution via safemode sandbox bypassredhat · satellite · CWE-94 RCE	High8.8	—	0.7%	Oct 1, 2026
36Monitor	CVE-2026-96659No exploit	Foreman: excessive permissions for viewer role on previewredhat · satellite · CWE-267 RCE	Critical9.1	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-102294No exploit	Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configurationtp-link system inc. · tl-wr841n v14 · CWE-78 RCE Command injection	High8.5	—	0.9%	Oct 1, 2026
34Monitor	CVE-2026-102369No exploit	Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200tp-link systems inc. · tapo c200 v5 · CWE-287 pre-auth RCE Auth bypass Command injection	High8.7	—	0.2%	Oct 1, 2026
37Monitor	CVE-2026-103922Proof of concept	Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathionic-team · capacitor · CWE-346 Pre-auth	Critical9.3	—	0.3%	Oct 1, 2026
35Monitor	CVE-2026-104018No exploit	VxWorks 7 improper privilege managementwind river systems inc · vxworks 7 · CWE-269	High8.8	—	0.6%	Oct 1, 2026
31Monitor	CVE-2026-12542No exploit	Foreman: command injection in foreman-tailredhat · satellite · CWE-78 RCE Command injection	High7.8	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-68495No exploit	jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of servicefasterxml · jackson-dataformats-binary · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-68496No exploit	jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of servicefasterxml · jackson-dataformats-binary · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Oct 1, 2026
28Monitor	CVE-2026-73976No exploit	djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)4turesearchdata · djehuty · CWE-943 SQL injection	High7.1	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-78578No exploit	Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200tp-link systems inc. · tapo c200 v5 · CWE-306 Pre-auth Auth bypass	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-9032No exploit	Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200tp-link systems inc. · tapo c200 v5 · CWE-476 Pre-auth Memory safety	High7.1	—	0.1%	Oct 1, 2026
39Monitor	CVE-2026-104056No exploit	Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin bindingauthlib · authlib · CWE-345 Pre-auth	Critical9.8	—	0.2%	Oct 1, 2026
34Monitor	CVE-2026-104057No exploit	Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handlerakhilrex · podgrab · CWE-362 Pre-auth Race condition	High8.7	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-104059No exploit	Lektor 3.3.14 CSRF via Admin API Endpointslektor · lektor · CWE-352 Pre-auth CSRF	High7.0	—	0.1%	Oct 1, 2026
29Monitor	CVE-2026-15911Proof of concept	Confluent Kafka Python Improper TLS Certificate Validationconfluent · confluent-kafka · CWE-295 Pre-auth Weak crypto	High7.4	—	0.2%	Oct 1, 2026
36Monitor	CVE-2026-55083No exploit	DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)dhis2 · dhis2-core · CWE-502 RCE Deserialization	Critical9.1	—	0.5%	Oct 1, 2026
34Monitor	CVE-2026-55230No exploit	Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than charactergivanz · vvveb · CWE-79 XSS	High8.7	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-55231No exploit	Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup toolsgivanz · vvveb · CWE-22 Path traversal	High7.2	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-55232No exploit	Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxygivanz · vvveb · CWE-918 SSRF	High7.6	—	0.3%	Oct 1, 2026
30Monitor	CVE-2026-84682No exploit	TDDPv2 setProductVer Command Injection in Archer AX90tp-link systems inc. · archer ax90 v1 · CWE-78 pre-auth RCE Command injection	High7.7	—	1.2%	Oct 1, 2026
30Monitor	CVE-2026-8618No exploit	Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plustp-link systems inc. · deco m9 plus v2 · CWE-121 pre-auth RCE Memory safety	High7.7	—	0.2%	Oct 1, 2026
36Monitor	CVE-2026-102628No exploit	Cadmos LTI exposure of sensitive information via debug modeeummena · cadmos lti · CWE-215 Pre-auth	Critical9.2	—	0.3%	Oct 1, 2026
36Monitor	CVE-2026-102667No exploit	Joyland AI WebView command injectionjoyland · joyland.ai · CWE-749 pre-auth RCE Command injection	Critical9.0	—	0.1%	Oct 1, 2026
35Monitor	CVE-2026-103484No exploit	pgvector buffer overflow in IVFFlat index buildCWE-787 RCE Memory safety	High8.8	—	0.4%	Oct 1, 2026
70This week	CVE-2026-104286Weaponized	An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, Ffortinet · fortimail · CWE-22 Pre-auth Path traversal	Critical9.8	KEV	4.5%	Oct 1, 2026
28Monitor	CVE-2026-14983No exploit	Missing Authentication in Teledyne FLIR Robots running Aware2teledyne flir · aware2 · CWE-306 Pre-auth Auth bypass	High7.1	—	0.2%	Oct 1, 2026
37Monitor	CVE-2026-14984No exploit	Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2teledyne flir · aware2 · CWE-319 Pre-auth Weak crypto	Critical9.4	—	0.1%	Oct 1, 2026
36Monitor	CVE-2026-53953No exploit	GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeovergetsimplecms-ce · getsimplecms-ce · CWE-338 Pre-auth Auth bypass Weak crypto	Critical9.1	—	0.4%	Oct 1, 2026
28Monitor	CVE-2026-53964No exploit	Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)adfinis · document-merge-service · CWE-1336 RCE SSTI	High7.2	—	0.4%	Oct 1, 2026
34Monitor	CVE-2026-54049No exploit	Sakai Conversations has a Stored XSS Issuesakaiproject · sakai · CWE-79 XSS	High8.7	—	0.3%	Oct 1, 2026
36Monitor	CVE-2026-56660No exploit	GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extractiongetsimplecms-ce · getsimplecms-ce · CWE-352 RCE SSRF Path traversal	Critical9.1	—	0.5%	Oct 1, 2026
30Monitor	CVE-2026-56661No exploit	GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpointgetsimplecms-ce · getsimplecms-ce · CWE-918 SSRF	High7.5	—	0.2%	Oct 1, 2026
38Monitor	CVE-2026-56662No exploit	GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update requestgetsimplecms-ce · getsimplecms-ce · CWE-352 pre-auth RCE CSRF	Critical9.6	—	0.2%	Oct 1, 2026
35Monitor	CVE-2026-70650No exploit	GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and contentgetsimplecms-ce · getsimplecms-ce · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-71426No exploit	GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" fieldgetsimplecms-ce · getsimplecms-ce · CWE-22 Path traversal	High7.1	—	0.3%	Oct 1, 2026
34Monitor	CVE-2026-71542No exploit	GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.phpgetsimplecms-ce · getsimplecms-ce · CWE-79 Pre-auth XSS	High8.7	—	0.3%	Oct 1, 2026
28Monitor	CVE-2026-82357No exploit	RT-Labs AB C-Open CANopen NULL pointer dereferencert-labs ab · c-open · CWE-476 Pre-auth Memory safety	High7.1	—	0.2%	Oct 1, 2026
28Monitor	CVE-2026-82358No exploit	RT-Labs AB C-Open CANopen SDO Server Write Protection Bypassrt-labs ab · c-open · CWE-863 Pre-auth Broken access control (IDOR)	High7.1	—	0.2%	Oct 1, 2026
33Monitor	CVE-2026-102514No exploit	Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archivepeazip · peazip · CWE-125 RCE Memory safety	High8.4	—	0.1%	Oct 1, 2026
34Monitor	CVE-2026-104020No exploit	Uncontrolled recursion in the Ion reader in Amazon Ion Pythonamazon · ion-python · CWE-674 Pre-auth Denial of service	High8.7	—	0.4%	Oct 1, 2026
40Plan	CVE-2026-55393No exploit	Local File Inclusion in Teledyne FLIR Robots running Aware2teledyne flir · aware2 · CWE-22 Pre-auth Path traversal	Critical10.0	—	0.4%	Oct 1, 2026
37Monitor	CVE-2026-55395No exploit	Hardcoded Passwords in Teledyne FLIR Robots running Aware2teledyne flir · aware2 · CWE-798 Pre-auth Hard-coded credentials	Critical9.4	—	0.1%	Oct 1, 2026
34Monitor	CVE-2026-55396No exploit	Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2teledyne flir · aware2 · CWE-319 Pre-auth Weak crypto	High8.5	—	0.1%	Oct 1, 2026
32Monitor	CVE-2026-96780No exploit	figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small widthpatorjk · figlet.js · CWE-835 Pre-auth Denial of service	High8.2	—	0.4%	Oct 1, 2026
35Monitor	CVE-2026-104051Proof of concept	PictShare < 3.7.1 Sensitive Information Disclosure via info APIhascheksolutions · pictshare · CWE-522 Pre-auth Info leak	High8.8	—	0.4%	Oct 1, 2026

CVE-2026-79901
39Monitor
Predictable Active Directory service-account passwords in BoKS Manager
CriticalCVSS 9.9No exploitEPSS 0%
- Weak crypto
fortra · boks manager boks-serverOct 1, 2026
CVE-2024-58388
34Monitor
Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
sharp corporation · multiple multifunction printersOct 1, 2026
CVE-2026-100514
30Monitor
WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
pete nelson · rest api logOct 1, 2026
CVE-2026-100517
30Monitor
WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
villatheme · photo reviews for woocommerceOct 1, 2026
CVE-2026-102378
28Monitor
WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
bplugins · parallax section blockOct 1, 2026
CVE-2026-103004
25Monitor
next.js cache leak on warm `use cache` handlers accessing root param
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
vercel · next.jsOct 1, 2026
CVE-2026-103068
35Monitor
WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.2 - Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
bytecore stack · bytecorestack – mcp connector for ai toolsOct 1, 2026
CVE-2026-103752
39Monitor
WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
paul ryan · authorizerOct 1, 2026
CVE-2026-56589
28Monitor
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
hcltech · bigfix service managementOct 1, 2026
CVE-2026-62071
37Monitor
WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
nickboss · wordpress file uploadOct 1, 2026
CVE-2026-62073
30Monitor
WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
themeisle · wp full stripe freeOct 1, 2026
CVE-2026-67105
29Monitor
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
hcltech · bigfix service managementOct 1, 2026
CVE-2026-79898
36Monitor
Fortra BoKS Manager crlserver command injection vulnerability
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Command injection
fortra · boks managerOct 1, 2026
CVE-2026-79899
31Monitor
Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability
HighCVSS 7.9No exploitEPSS 0%
fortra · boks managerOct 1, 2026
CVE-2026-94390
28Monitor
WordPress Hide Shipping Method For WooCommerce plugin <= 1.5.4 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
dotstore · hide shipping method for woocommerceOct 1, 2026
CVE-2026-95588
34Monitor
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Path traversal
- Denial of service
acymailing newsletter team · acymailing smtp newsletterOct 1, 2026
CVE-2026-97260
28Monitor
WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
maxfoundry · maxgalleriaOct 1, 2026
CVE-2026-97268
28Monitor
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
premmerce · premmerce wishlist for woocommerceOct 1, 2026
CVE-2026-97273
28Monitor
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
premmerce · premmerce wishlist for woocommerceOct 1, 2026
CVE-2026-97277
30Monitor
WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
apps mav · social boostOct 1, 2026
CVE-2026-97284
35Monitor
WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
icegram · icegramOct 1, 2026
CVE-2026-97297
30Monitor
WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
apps mav · gratisfactionOct 1, 2026
CVE-2026-101322
33Monitor
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastru
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse basyx aas web uiOct 1, 2026
CVE-2026-103690
8Monitor
itsourcecode Leave Management System controller.php sql injection
LowCVSS 2.1Proof of conceptEPSS 0%
- SQL injection
itsourcecode · leave management systemOct 1, 2026
CVE-2026-12627
39Monitor
Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
fortra · fortra's core privileged access manager (boks)Oct 1, 2026
CVE-2026-46729
30Monitor
Apache HTTP Server: mod_heartmonitor denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache · http serverOct 1, 2026
CVE-2026-47360
30Monitor
Apache HTTP Server: mod_session: Session cookie not removed during internal redirect
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apache · http serverOct 1, 2026
CVE-2026-79896
30Monitor
Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
fortra · boks managerOct 1, 2026
CVE-2026-94620
37Monitor
Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Path traversal
foundation50 · classroom50Oct 1, 2026
CVE-2026-101888
34Monitor
Prime Mover < 2.2.1 Zip Slip Path Traversal File Write
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Path traversal
codexonics · prime moverOct 1, 2026
CVE-2026-101889
28Monitor
Prime Mover < 2.2.1 Path Traversal via wprime-config.json
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
codexonics · prime moverOct 1, 2026
CVE-2026-103921
29Monitor
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
ardatan · graphql-toolsOct 1, 2026
CVE-2026-12405
35Monitor
Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
red hat · red hat satellite 6.19 for rhel 9Oct 1, 2026
CVE-2026-12423
30Monitor
Foreman: unauthenticated information disclosure via provisioning token validation flaw
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
redhat · satelliteOct 1, 2026
CVE-2026-12540
32Monitor
Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
HighCVSS 8.2No exploitEPSS 1%
- RCE
- Command injection
redhat · satelliteOct 1, 2026
CVE-2026-12541
32Monitor
Foreman: command injection in foreman-rake database tasks
HighCVSS 8.2No exploitEPSS 1%
- RCE
- Command injection
redhat · satelliteOct 1, 2026
CVE-2026-12544
30Monitor
Foreman: ssti and insecure deserialization in foreman-rake configuration
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Deserialization
- SSTI
redhat · satelliteOct 1, 2026
CVE-2026-13043
37Monitor
WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Auth bypass
- Local privilege escalation
watchguard · endpoint securityOct 1, 2026
CVE-2026-14316
32Monitor
Heap buffer overflow in boks_sshd revoked-key error handling
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
fortra · core privileged access manager (boks)Oct 1, 2026
CVE-2026-48005
30Monitor
Apache HTTP Server: mod_auth_digest reauthentication attack
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
apache · http serverOct 1, 2026
CVE-2026-56153
30Monitor
Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · http serverOct 1, 2026
CVE-2026-56154
39Monitor
Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · http serverOct 1, 2026
CVE-2026-56449
30Monitor
Apache HTTP Server: mod_proxy_html: crash in dump_content
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · http serverOct 1, 2026
CVE-2026-57941
39Monitor
Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · http serverOct 1, 2026
CVE-2026-59685
30Monitor
Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · http serverOct 1, 2026
CVE-2026-59797
39Monitor
Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
apache · http serverOct 1, 2026
CVE-2026-63045
30Monitor
Apache HTTP Server: mod_proxy_ftp PASV address handling
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache · http serverOct 1, 2026
CVE-2026-63292
30Monitor
Apache HTTP Server: mod_vhost_alias stack overflow
HighCVSS 7.5Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
- Denial of service
apache · http serverOct 1, 2026
CVE-2026-63686
30Monitor
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apache · http serverOct 1, 2026
CVE-2026-63718
30Monitor
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache · http serverOct 1, 2026
CVE-2026-73636
32Monitor
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache · http serverOct 1, 2026
CVE-2026-73637
29Monitor
Apache HTTP Server: mod_auth_digest DoS attack
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Memory safety
apache · http serverOct 1, 2026
CVE-2026-73975
33Monitor
djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
HighCVSS 8.4No exploitEPSS 0%
- SQL injection
4turesearchdata · djehutyOct 1, 2026
CVE-2026-93546
35Monitor
Apache HTTP Server: mod_dav_fs namespace overflow
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
apache · http serverOct 1, 2026
CVE-2026-96658
35Monitor
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
HighCVSS 8.8No exploitEPSS 0%
- RCE
redhat · satelliteOct 1, 2026
CVE-2026-96659
36Monitor
Foreman: excessive permissions for viewer role on preview
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
redhat · satelliteOct 1, 2026
CVE-2026-102294
34Monitor
Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
tp-link system inc. · tl-wr841n v14Oct 1, 2026
CVE-2026-102369
34Monitor
Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- Command injection
tp-link systems inc. · tapo c200 v5Oct 1, 2026
CVE-2026-103922
37Monitor
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
ionic-team · capacitorOct 1, 2026
CVE-2026-104018
35Monitor
VxWorks 7 improper privilege management
HighCVSS 8.8No exploitEPSS 0%
wind river systems inc · vxworks 7Oct 1, 2026
CVE-2026-12542
31Monitor
Foreman: command injection in foreman-tail
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
redhat · satelliteOct 1, 2026
CVE-2026-68495
30Monitor
jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
fasterxml · jackson-dataformats-binaryOct 1, 2026
CVE-2026-68496
30Monitor
jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
fasterxml · jackson-dataformats-binaryOct 1, 2026
CVE-2026-73976
28Monitor
djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
4turesearchdata · djehutyOct 1, 2026
CVE-2026-78578
28Monitor
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
tp-link systems inc. · tapo c200 v5Oct 1, 2026
CVE-2026-9032
28Monitor
Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
tp-link systems inc. · tapo c200 v5Oct 1, 2026
CVE-2026-104056
39Monitor
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
authlib · authlibOct 1, 2026
CVE-2026-104057
34Monitor
Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Race condition
akhilrex · podgrabOct 1, 2026
CVE-2026-104059
28Monitor
Lektor 3.3.14 CSRF via Admin API Endpoints
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- CSRF
lektor · lektorOct 1, 2026
CVE-2026-15911
29Monitor
Confluent Kafka Python Improper TLS Certificate Validation
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
confluent · confluent-kafkaOct 1, 2026
CVE-2026-55083
36Monitor
DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Deserialization
dhis2 · dhis2-coreOct 1, 2026
CVE-2026-55230
34Monitor
Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
HighCVSS 8.7No exploitEPSS 0%
- XSS
givanz · vvvebOct 1, 2026
CVE-2026-55231
28Monitor
Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
givanz · vvvebOct 1, 2026
CVE-2026-55232
30Monitor
Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
HighCVSS 7.6No exploitEPSS 0%
- SSRF
givanz · vvvebOct 1, 2026
CVE-2026-84682
30Monitor
TDDPv2 setProductVer Command Injection in Archer AX90
HighCVSS 7.7No exploitEPSS 1%
- pre-auth RCE
- Command injection
tp-link systems inc. · archer ax90 v1Oct 1, 2026
CVE-2026-8618
30Monitor
Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 Plus
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Memory safety
tp-link systems inc. · deco m9 plus v2Oct 1, 2026
CVE-2026-102628
36Monitor
Cadmos LTI exposure of sensitive information via debug mode
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
eummena · cadmos ltiOct 1, 2026
CVE-2026-102667
36Monitor
Joyland AI WebView command injection
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
- Command injection
joyland · joyland.aiOct 1, 2026
CVE-2026-103484
35Monitor
pgvector buffer overflow in IVFFlat index build
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Memory safety
Oct 1, 2026
CVE-2026-104286
70This week
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, F
CriticalCVSS 9.8KEVWeaponizedEPSS 4%
- Pre-auth
- Path traversal
fortinet · fortimailOct 1, 2026
CVE-2026-14983
28Monitor
Missing Authentication in Teledyne FLIR Robots running Aware2
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
teledyne flir · aware2Oct 1, 2026
CVE-2026-14984
37Monitor
Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
teledyne flir · aware2Oct 1, 2026
CVE-2026-53953
36Monitor
GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
getsimplecms-ce · getsimplecms-ceOct 1, 2026
CVE-2026-53964
28Monitor
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
HighCVSS 7.2No exploitEPSS 0%
- RCE
- SSTI
adfinis · document-merge-serviceOct 1, 2026
CVE-2026-54049
34Monitor
Sakai Conversations has a Stored XSS Issue
HighCVSS 8.7No exploitEPSS 0%
- XSS
sakaiproject · sakaiOct 1, 2026
CVE-2026-56660
36Monitor
GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- SSRF
- Path traversal
getsimplecms-ce · getsimplecms-ceOct 1, 2026
CVE-2026-56661
30Monitor
GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
HighCVSS 7.5No exploitEPSS 0%
- SSRF
getsimplecms-ce · getsimplecms-ceOct 1, 2026
CVE-2026-56662
38Monitor
GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- CSRF
getsimplecms-ce · getsimplecms-ceOct 1, 2026
CVE-2026-70650
35Monitor
GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
getsimplecms-ce · getsimplecms-ceOct 1, 2026
CVE-2026-71426
28Monitor
GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
getsimplecms-ce · getsimplecms-ceOct 1, 2026
CVE-2026-71542
34Monitor
GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- XSS
getsimplecms-ce · getsimplecms-ceOct 1, 2026
CVE-2026-82357
28Monitor
RT-Labs AB C-Open CANopen NULL pointer dereference
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
rt-labs ab · c-openOct 1, 2026
CVE-2026-82358
28Monitor
RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
rt-labs ab · c-openOct 1, 2026
CVE-2026-102514
33Monitor
Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Memory safety
peazip · peazipOct 1, 2026
CVE-2026-104020
34Monitor
Uncontrolled recursion in the Ion reader in Amazon Ion Python
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
amazon · ion-pythonOct 1, 2026
CVE-2026-55393
40Plan
Local File Inclusion in Teledyne FLIR Robots running Aware2
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Path traversal
teledyne flir · aware2Oct 1, 2026
CVE-2026-55395
37Monitor
Hardcoded Passwords in Teledyne FLIR Robots running Aware2
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
teledyne flir · aware2Oct 1, 2026
CVE-2026-55396
34Monitor
Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
teledyne flir · aware2Oct 1, 2026
CVE-2026-96780
32Monitor
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
patorjk · figlet.jsOct 1, 2026
CVE-2026-104051
35Monitor
PictShare < 3.7.1 Sensitive Information Disclosure via info API
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Info leak
hascheksolutions · pictshareOct 1, 2026