By publication date

Exploited and new serious CVEs: October 2026

8,746 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 22 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-88930No exploit	Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secretunknown · social web suite · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89195No exploit	Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_existsunknown · site setup wizard · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89213No exploit	Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameterunknown · llavero.io · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89214No exploit	WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submissionunknown · wpcues basic quiz · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89232No exploit	RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameterunknown · recordbrowser · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89234No exploit	WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameterunknown · wp-partner · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89283No exploit	WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewriteunknown · wp posts password batch manager · CWE-862 Pre-auth Broken access control (IDOR)	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89285No exploit	Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_actionunknown · datalist it · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89287No exploit	ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameterunknown · aspl product quotation · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89297No exploit	Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameterunknown · loja automática · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89299No exploit	WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameterunknown · wp verify api · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
34Monitor	CVE-2026-89302No exploit	Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameterunknown · post voting system · CWE-89 Pre-auth SQL injection	High8.6	—	0.2%	Oct 11, 2026
28Monitor	CVE-2026-91829No exploit	Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameterunknown · subscribe to comments · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Oct 11, 2026
35Monitor	CVE-2026-96227No exploit	Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Uploadunknown · piotnet forms · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Oct 11, 2026
30Monitor	RUSTSEC-2026-0344No exploit	Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM) Pre-auth Denial of service	High7.5	—	—	Oct 11, 2026
41Plan	CVE-2026-108576No exploit	TOZED X300 IPPingDiagnostics process_ping os command injectiontozed · x300 · CWE-77 pre-auth RCE Command injection	Critical10.0	—	4.0%	Oct 11, 2026
27Monitor	CVE-2026-108578Proof of concept	Neterbit NW-431F Embedded Web Server sms.json information disclosureneterbit · nw-431f · CWE-200 Pre-auth Info leak	Medium6.9	—	1.4%	Oct 11, 2026
28Monitor	CVE-2026-108710No exploit	NornicDB through 1.4.1 Missing Authorization via Vector Search Endpointsorneryd · nornicdb · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Oct 11, 2026
34Monitor	CVE-2026-108714No exploit	MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocketmodelcontextprotocol · kotlin-sdk · CWE-770 Pre-auth Denial of service	High8.7	—	0.3%	Oct 11, 2026
34Monitor	CVE-2026-108718No exploit	Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registrationrill data · rill · CWE-862 Pre-auth Broken access control (IDOR)	High8.6	—	0.2%	Oct 11, 2026
28Monitor	CVE-2026-108728No exploit	Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhookflyteorg · flyte · CWE-312	High7.1	—	0.2%	Oct 11, 2026
32Monitor	CVE-2026-108729No exploit	Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpointscortezaproject · corteza · CWE-863 Pre-auth Broken access control (IDOR)	High8.2	—	0.2%	Oct 11, 2026
30Monitor	CVE-2026-108737No exploit	Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusiontraccar · traccar · CWE-640 Pre-auth	High7.6	—	0.3%	Oct 11, 2026
34Monitor	CVE-2026-108739No exploit	OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspacesopenagents-org · openagents · CWE-306 Pre-auth Auth bypass	High8.7	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-108740No exploit	GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignmentarp242 · goatcounter · CWE-915	High7.2	—	0.3%	Oct 11, 2026
29Monitor	CVE-2026-108744No exploit	pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Syncminasaad1 · pbi-cli · CWE-78 RCE Local privilege escalation Command injection	High7.3	—	0.5%	Oct 11, 2026
34Monitor	CVE-2026-108746No exploit	Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResourcesvearch · vearch · CWE-863 Broken access control (IDOR)	High8.7	—	0.3%	Oct 11, 2026
37Monitor	CVE-2026-108753No exploit	Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Composeagnaistic · agnai · CWE-798 Pre-auth Hard-coded credentials	Critical9.3	—	0.4%	Oct 11, 2026
28Monitor	CVE-2026-108757No exploit	Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/sendnexting · pinclaw · CWE-306 Pre-auth Auth bypass	High7.1	—	0.2%	Oct 11, 2026
35Monitor	CVE-2026-108758No exploit	Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpointalextselegidis · easyappointments · CWE-639 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Oct 11, 2026
30Monitor	CVE-2026-108759No exploit	mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-execericlbuehler · mistral.rs · CWE-59	High7.6	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-108760No exploit	LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfacesllama-farm · llamafarm · CWE-1327 Pre-auth	High7.2	—	0.2%	Oct 11, 2026
33Monitor	CVE-2026-108698No exploit	hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Conditionhyper-mcp-rs · hyper-mcp · CWE-367 Pre-auth Race condition	High8.3	—	0.2%	Oct 11, 2026
33Monitor	CVE-2026-108699No exploit	hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Pluginshyper-mcp-rs · hyper-mcp · CWE-347 Pre-auth Weak crypto	High8.3	—	0.1%	Oct 11, 2026
28Monitor	CVE-2026-108853No exploit	UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/appunicomai · wanwu · CWE-639 Broken access control (IDOR)	High7.2	—	0.3%	Oct 11, 2026
34Monitor	CVE-2026-108859No exploit	mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Bufferingmark3labs · mcp-go · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Oct 11, 2026
37Monitor	CVE-2026-108860No exploit	BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Keyscisharp · botsharp · CWE-321 Pre-auth Auth bypass Hard-coded credentials	Critical9.3	—	0.4%	Oct 11, 2026
34Monitor	CVE-2026-108863No exploit	Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interfacekatanemo · plano · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Oct 11, 2026
35Monitor	CVE-2026-108865No exploit	AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorizeamoylab · unla · CWE-287 Pre-auth Auth bypass	High8.8	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-108883No exploit	JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfigjeecgboot · jeecgboot · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 11, 2026
28Monitor	CVE-2026-108902No exploit	pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_linkph7software · ph7builder · CWE-22 Path traversal	High7.2	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-108904No exploit	pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserControllerph7software · ph7builder · CWE-522 Info leak	High7.1	—	0.3%	Oct 11, 2026
34Monitor	CVE-2026-108905No exploit	pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Headerph7software · ph7builder · CWE-798 Pre-auth Hard-coded credentials	High8.7	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-108913No exploit	omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarcomarchy · omarchy · CWE-829 Pre-auth	High7.1	—	0.3%	Oct 11, 2026
28Monitor	CVE-2026-19577No exploit	Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer addresszephyrproject · zephyr · CWE-125 Pre-auth Memory safety	High7.1	—	0.2%	Oct 11, 2026
31Monitor	CVE-2026-19669No exploit	Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user modezephyrproject · zephyr · CWE-787 Memory safety	High7.8	—	0.1%	Oct 11, 2026
31Monitor	CVE-2026-19736No exploit	Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengthszephyrproject · zephyr · CWE-787 Memory safety	High7.8	—	0.1%	Oct 11, 2026
30Monitor	CVE-2026-19935No exploit	Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardownzephyrproject · zephyr · CWE-416 Pre-auth Memory safety	High7.5	—	0.1%	Oct 11, 2026
36Monitor	CVE-2026-108963No exploit	databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can bdavid-crty · databasement · CWE-88 RCE Command injection	High8.8	—	1.6%	Oct 11, 2026
31Monitor	CVE-2026-108976No exploit	GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list gnu · emacs · CWE-184 RCE Command injection	High7.8	—	0.6%	Oct 11, 2026
35Monitor	CVE-2026-108980No exploit	Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin.blinko · blinko · CWE-24 RCE Path traversal	High8.8	—	1.0%	Oct 12, 2026
39Monitor	CVE-2026-66086No exploit	Stack-based Buffer Overflow in Modemunisoc (shanghai) technologies co., ltd. · modem · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	0.4%	Oct 12, 2026
28Monitor	CVE-2026-108982No exploit	VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data.idrix · veracrypt · CWE-459	High7.2	—	0.1%	Oct 12, 2026
28Monitor	CVE-2026-108985No exploit	ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zsahlberg · libnfs · CWE-787 Pre-auth Memory safety	High7.1	—	0.1%	Oct 12, 2026
28Monitor	CVE-2026-21114No exploit	Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.samsung mobile · samsung mobile devices · CWE-787 RCE Memory safety	High7.0	—	0.1%	Oct 12, 2026
35Monitor	CVE-2026-21120No exploit	Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privisamsung mobile · samsung mobile devices · CWE-416 RCE Local privilege escalation Memory safety	High8.9	—	0.1%	Oct 12, 2026
28Monitor	CVE-2026-21122No exploit	Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.samsung mobile · samsung mobile devices · CWE-787 RCE Memory safety	High7.0	—	0.1%	Oct 12, 2026
34Monitor	CVE-2026-21124No exploit	Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackerssamsung mobile · samsung mobile devices · CWE-20 RCE	High8.6	—	0.1%	Oct 12, 2026
34Monitor	CVE-2026-21125No exploit	Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to psamsung mobile · samsung mobile devices · CWE-20 RCE	High8.6	—	0.1%	Oct 12, 2026
29Monitor	CVE-2026-21139No exploit	Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the cosamsung mobile · samsung continuity service for windows · CWE-284 Pre-auth Broken access control (IDOR)	High7.3	—	0.1%	Oct 12, 2026
35Monitor	CVE-2026-87690Proof of concept	Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Executionrapid7 · metasploit framework · CWE-22 Pre-auth Path traversal	High8.8	—	0.4%	Oct 12, 2026
38Monitor	CVE-2026-108804No exploit	TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injectiontrendnet · tew-751dr · CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.3%	Oct 12, 2026
28Monitor	CVE-2026-109080No exploit	SQL injection in Night Shift bulk license plate search allows cross-organization data accessflock · night shift · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
31Monitor	CVE-2026-98385Proof of concept	sched/cache: Decouple sched_cache_group from mm to fix UAFlinux · linux	High7.8	—	0.1%	Oct 12, 2026
34Monitor	CVE-2026-78355No exploit	Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directoryotrs gmbh (former otrs ag) · otrs · CWE-22 Path traversal	High8.7	—	0.7%	Oct 12, 2026
36Monitor	CVE-2026-78357No exploit	Insufficient Session Revocation for JWT Authenticationotrs gmbh (former otrs ag) · otrs · CWE-613 Pre-auth	Critical9.1	—	0.3%	Oct 12, 2026
37Monitor	CVE-2026-93582No exploit	Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authenticationotrs gmbh (former otrs ag) · otrs · CWE-290 Pre-auth Auth bypass	Critical9.4	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-1907No exploit	SQL Injection in Clustering Communication (Hybrid Mode)kong · kong enterprise gateway · CWE-89 SQL injection	High7.5	—	0.1%	Oct 12, 2026
30Monitor	CVE-2026-103902No exploit	DigiDoc improper signature verificationdigidoc · libdigidocpp · CWE-347 Pre-auth Weak crypto	High7.5	—	0.1%	Oct 12, 2026
34Monitor	CVE-2026-103903No exploit	MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalationmikrotik · routeros · CWE-863 Auth bypass Broken access control (IDOR)	High8.7	—	0.4%	Oct 12, 2026
36Monitor	CVE-2026-105407No exploit	OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5dassault systèmes · tuleap enterprise edition · CWE-78 RCE Command injection	High8.8	—	1.8%	Oct 12, 2026
34Monitor	CVE-2026-105408No exploit	Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5dassault systèmes · tuleap enterprise edition · CWE-79 RCE XSS	High8.7	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-105409No exploit	Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5dassault systèmes · tuleap enterprise edition · CWE-79 RCE XSS	High8.7	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-105410No exploit	Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5dassault systèmes · tuleap enterprise edition · CWE-79 RCE XSS	High8.7	—	0.2%	Oct 12, 2026
32Monitor	CVE-2026-105411No exploit	Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5dassault systèmes · tuleap enterprise edition · CWE-639 Broken access control (IDOR)	High8.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-105412No exploit	SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5dassault systèmes · tuleap enterprise edition · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
36Monitor	CVE-2026-85499No exploit	Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxyapache software foundation · apache skywalking banyandb · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-108951No exploit	LavaLite CMS through 10.1.2 Authorization Bypass via User Update APIlavalite · cms · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Oct 12, 2026
34Monitor	CVE-2026-108953No exploit	mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Argumentscfdude · mac-shell-mcp · CWE-78 RCE Command injection	High8.5	—	0.7%	Oct 12, 2026
28Monitor	CVE-2026-109164No exploit	TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}tduckcloud · tduck-survey-form · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-109166No exploit	lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlByIddromara · lamp-cloud · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109168No exploit	lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizIddromara · lamp-cloud · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109174No exploit	MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfigmoxi624 · mogublog · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109185No exploit	jshERP through 3.6 Privilege Escalation via PUT /user/updateUserjishenghua · jsherp · CWE-862 Broken access control (IDOR)	High8.7	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109186No exploit	jshERP through 3.6 Mass Assignment via PUT /user/updatejishenghua · jsherp · CWE-915	High8.7	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-109187No exploit	jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKeyjishenghua · jsherp · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
35Monitor	CVE-2026-52903No exploit	YAML safe_load production fallback to unsafe_load enables RCE via deserializationmanageiq · manageiq · CWE-502 RCE Deserialization	High8.8	—	0.4%	Oct 12, 2026
29Monitor	CVE-2026-93695No exploit	Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyServiceprogress · sharefile storage zones controller · CWE-22 RCE Path traversal	High7.4	—	0.1%	Oct 12, 2026
37Monitor	CVE-2026-108892No exploit	Linksys E1700 Mac Filter ssid1MACFilter stack-based overflowlinksys · e1700 · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.6%	Oct 12, 2026
34Monitor	CVE-2026-108893No exploit	Linksys E1700 setVlan stack-based overflowlinksys · e1700 · CWE-119 Memory safety	High8.6	—	0.5%	Oct 12, 2026
35Monitor	CVE-2026-108894No exploit	Linksys E1700 Static Route addStaticRoute os command injectionlinksys · e1700 · CWE-77 RCE Command injection	High8.6	—	2.1%	Oct 12, 2026
28Monitor	CVE-2026-109169No exploit	LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetterlogicaldoc · logicaldoc community edition · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109170No exploit	LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameterlogicaldoc · logicaldoc community edition · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109199No exploit	LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Templatelogicaldoc · logicaldoc community edition · CWE-94 RCE	High8.7	—	0.3%	Oct 12, 2026
34Monitor	CVE-2026-109201No exploit	LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentServicelogicaldoc · logicaldoc community edition · CWE-862 Broken access control (IDOR)	High8.7	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109202No exploit	LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servletlogicaldoc · logicaldoc community edition · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109203No exploit	LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servletlogicaldoc · logicaldoc community edition · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109205No exploit	LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServletlogicaldoc · logicaldoc community edition · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Oct 12, 2026
34Monitor	CVE-2026-109225No exploit	SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Uploadsgl-project · sglang · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Oct 12, 2026
34Monitor	CVE-2026-109226No exploit	SGLang through 0.5.21 Audio Decompression Amplification via load_audiosgl-project · sglang · CWE-409 Pre-auth	High8.7	—	0.5%	Oct 12, 2026

CVE-2026-88930
34Monitor
Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · social web suiteOct 11, 2026
CVE-2026-89195
34Monitor
Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · site setup wizardOct 11, 2026
CVE-2026-89213
34Monitor
Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · llavero.ioOct 11, 2026
CVE-2026-89214
34Monitor
WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · wpcues basic quizOct 11, 2026
CVE-2026-89232
34Monitor
RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · recordbrowserOct 11, 2026
CVE-2026-89234
34Monitor
WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · wp-partnerOct 11, 2026
CVE-2026-89283
34Monitor
WP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · wp posts password batch managerOct 11, 2026
CVE-2026-89285
34Monitor
Datalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · datalist itOct 11, 2026
CVE-2026-89287
34Monitor
ASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · aspl product quotationOct 11, 2026
CVE-2026-89297
34Monitor
Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · loja automáticaOct 11, 2026
CVE-2026-89299
34Monitor
WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · wp verify apiOct 11, 2026
CVE-2026-89302
34Monitor
Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · post voting systemOct 11, 2026
CVE-2026-91829
28Monitor
Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · subscribe to commentsOct 11, 2026
CVE-2026-96227
35Monitor
Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · piotnet formsOct 11, 2026
RUSTSEC-2026-0344
30Monitor
Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Oct 11, 2026
CVE-2026-108576
41Plan
TOZED X300 IPPingDiagnostics process_ping os command injection
CriticalCVSS 10.0No exploitEPSS 4%
- pre-auth RCE
- Command injection
tozed · x300Oct 11, 2026
CVE-2026-108578
27Monitor
Neterbit NW-431F Embedded Web Server sms.json information disclosure
MediumCVSS 6.9Proof of conceptEPSS 1%
- Pre-auth
- Info leak
neterbit · nw-431fOct 11, 2026
CVE-2026-108710
28Monitor
NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
orneryd · nornicdbOct 11, 2026
CVE-2026-108714
34Monitor
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
modelcontextprotocol · kotlin-sdkOct 11, 2026
CVE-2026-108718
34Monitor
Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
rill data · rillOct 11, 2026
CVE-2026-108728
28Monitor
Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook
HighCVSS 7.1No exploitEPSS 0%
flyteorg · flyteOct 11, 2026
CVE-2026-108729
32Monitor
Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
cortezaproject · cortezaOct 11, 2026
CVE-2026-108737
30Monitor
Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
traccar · traccarOct 11, 2026
CVE-2026-108739
34Monitor
OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
openagents-org · openagentsOct 11, 2026
CVE-2026-108740
28Monitor
GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
HighCVSS 7.2No exploitEPSS 0%
arp242 · goatcounterOct 11, 2026
CVE-2026-108744
29Monitor
pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
minasaad1 · pbi-cliOct 11, 2026
CVE-2026-108746
34Monitor
Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
vearch · vearchOct 11, 2026
CVE-2026-108753
37Monitor
Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
agnaistic · agnaiOct 11, 2026
CVE-2026-108757
28Monitor
Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
nexting · pinclawOct 11, 2026
CVE-2026-108758
35Monitor
Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
alextselegidis · easyappointmentsOct 11, 2026
CVE-2026-108759
30Monitor
mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec
HighCVSS 7.6No exploitEPSS 0%
ericlbuehler · mistral.rsOct 11, 2026
CVE-2026-108760
28Monitor
LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
llama-farm · llamafarmOct 11, 2026
CVE-2026-108698
33Monitor
hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Race condition
hyper-mcp-rs · hyper-mcpOct 11, 2026
CVE-2026-108699
33Monitor
hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
hyper-mcp-rs · hyper-mcpOct 11, 2026
CVE-2026-108853
28Monitor
UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
unicomai · wanwuOct 11, 2026
CVE-2026-108859
34Monitor
mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
mark3labs · mcp-goOct 11, 2026
CVE-2026-108860
37Monitor
BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
scisharp · botsharpOct 11, 2026
CVE-2026-108863
34Monitor
Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
katanemo · planoOct 11, 2026
CVE-2026-108865
35Monitor
AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
amoylab · unlaOct 11, 2026
CVE-2026-108883
28Monitor
JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jeecgboot · jeecgbootOct 11, 2026
CVE-2026-108902
28Monitor
pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
ph7software · ph7builderOct 11, 2026
CVE-2026-108904
28Monitor
pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
HighCVSS 7.1No exploitEPSS 0%
- Info leak
ph7software · ph7builderOct 11, 2026
CVE-2026-108905
34Monitor
pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
ph7software · ph7builderOct 11, 2026
CVE-2026-108913
28Monitor
omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarc
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
omarchy · omarchyOct 11, 2026
CVE-2026-19577
28Monitor
Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrOct 11, 2026
CVE-2026-19669
31Monitor
Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyrOct 11, 2026
CVE-2026-19736
31Monitor
Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyrOct 11, 2026
CVE-2026-19935
30Monitor
Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
zephyrproject · zephyrOct 11, 2026
CVE-2026-108963
36Monitor
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can b
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
david-crty · databasementOct 11, 2026
CVE-2026-108976
31Monitor
GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
gnu · emacsOct 11, 2026
CVE-2026-108980
35Monitor
Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin.
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Path traversal
blinko · blinkoOct 12, 2026
CVE-2026-66086
39Monitor
Stack-based Buffer Overflow in Modem
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
unisoc (shanghai) technologies co., ltd. · modemOct 12, 2026
CVE-2026-108982
28Monitor
VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data.
HighCVSS 7.2No exploitEPSS 0%
idrix · veracryptOct 12, 2026
CVE-2026-108985
28Monitor
ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_z
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
sahlberg · libnfsOct 12, 2026
CVE-2026-21114
28Monitor
Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Memory safety
samsung mobile · samsung mobile devicesOct 12, 2026
CVE-2026-21120
35Monitor
Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privi
HighCVSS 8.9No exploitEPSS 0%
- RCE
- Local privilege escalation
- Memory safety
samsung mobile · samsung mobile devicesOct 12, 2026
CVE-2026-21122
28Monitor
Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Memory safety
samsung mobile · samsung mobile devicesOct 12, 2026
CVE-2026-21124
34Monitor
Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers
HighCVSS 8.6No exploitEPSS 0%
- RCE
samsung mobile · samsung mobile devicesOct 12, 2026
CVE-2026-21125
34Monitor
Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to p
HighCVSS 8.6No exploitEPSS 0%
- RCE
samsung mobile · samsung mobile devicesOct 12, 2026
CVE-2026-21139
29Monitor
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the co
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
samsung mobile · samsung continuity service for windowsOct 12, 2026
CVE-2026-87690
35Monitor
Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
rapid7 · metasploit frameworkOct 12, 2026
CVE-2026-108804
38Monitor
TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
trendnet · tew-751drOct 12, 2026
CVE-2026-109080
28Monitor
SQL injection in Night Shift bulk license plate search allows cross-organization data access
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
flock · night shiftOct 12, 2026
CVE-2026-98385
31Monitor
sched/cache: Decouple sched_cache_group from mm to fix UAF
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linuxOct 12, 2026
CVE-2026-78355
34Monitor
Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
HighCVSS 8.7No exploitEPSS 0%
- Path traversal
otrs gmbh (former otrs ag) · otrsOct 12, 2026
CVE-2026-78357
36Monitor
Insufficient Session Revocation for JWT Authentication
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
otrs gmbh (former otrs ag) · otrsOct 12, 2026
CVE-2026-93582
37Monitor
Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
otrs gmbh (former otrs ag) · otrsOct 12, 2026
CVE-2026-1907
30Monitor
SQL Injection in Clustering Communication (Hybrid Mode)
HighCVSS 7.5No exploitEPSS 0%
- SQL injection
kong · kong enterprise gatewayOct 12, 2026
CVE-2026-103902
30Monitor
DigiDoc improper signature verification
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
digidoc · libdigidocppOct 12, 2026
CVE-2026-103903
34Monitor
MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
mikrotik · routerosOct 12, 2026
CVE-2026-105407
36Monitor
OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
dassault systèmes · tuleap enterprise editionOct 12, 2026
CVE-2026-105408
34Monitor
Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
dassault systèmes · tuleap enterprise editionOct 12, 2026
CVE-2026-105409
34Monitor
Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
dassault systèmes · tuleap enterprise editionOct 12, 2026
CVE-2026-105410
34Monitor
Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
dassault systèmes · tuleap enterprise editionOct 12, 2026
CVE-2026-105411
32Monitor
Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
dassault systèmes · tuleap enterprise editionOct 12, 2026
CVE-2026-105412
28Monitor
SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
dassault systèmes · tuleap enterprise editionOct 12, 2026
CVE-2026-85499
36Monitor
Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache software foundation · apache skywalking banyandbOct 12, 2026
CVE-2026-108951
28Monitor
LavaLite CMS through 10.1.2 Authorization Bypass via User Update API
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
lavalite · cmsOct 12, 2026
CVE-2026-108953
34Monitor
mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
cfdude · mac-shell-mcpOct 12, 2026
CVE-2026-109164
28Monitor
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
tduckcloud · tduck-survey-formOct 12, 2026
CVE-2026-109166
28Monitor
lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dromara · lamp-cloudOct 12, 2026
CVE-2026-109168
28Monitor
lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dromara · lamp-cloudOct 12, 2026
CVE-2026-109174
28Monitor
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
moxi624 · mogublogOct 12, 2026
CVE-2026-109185
34Monitor
jshERP through 3.6 Privilege Escalation via PUT /user/updateUser
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpOct 12, 2026
CVE-2026-109186
34Monitor
jshERP through 3.6 Mass Assignment via PUT /user/update
HighCVSS 8.7No exploitEPSS 0%
jishenghua · jsherpOct 12, 2026
CVE-2026-109187
28Monitor
jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpOct 12, 2026
CVE-2026-52903
35Monitor
YAML safe_load production fallback to unsafe_load enables RCE via deserialization
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
manageiq · manageiqOct 12, 2026
CVE-2026-93695
29Monitor
Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService
HighCVSS 7.4No exploitEPSS 0%
- RCE
- Path traversal
progress · sharefile storage zones controllerOct 12, 2026
CVE-2026-108892
37Monitor
Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
linksys · e1700Oct 12, 2026
CVE-2026-108893
34Monitor
Linksys E1700 setVlan stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
linksys · e1700Oct 12, 2026
CVE-2026-108894
35Monitor
Linksys E1700 Static Route addStaticRoute os command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
linksys · e1700Oct 12, 2026
CVE-2026-109169
28Monitor
LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
logicaldoc · logicaldoc community editionOct 12, 2026
CVE-2026-109170
28Monitor
LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
logicaldoc · logicaldoc community editionOct 12, 2026
CVE-2026-109199
34Monitor
LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template
HighCVSS 8.7No exploitEPSS 0%
- RCE
logicaldoc · logicaldoc community editionOct 12, 2026
CVE-2026-109201
34Monitor
LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
logicaldoc · logicaldoc community editionOct 12, 2026
CVE-2026-109202
28Monitor
LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
logicaldoc · logicaldoc community editionOct 12, 2026
CVE-2026-109203
28Monitor
LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
logicaldoc · logicaldoc community editionOct 12, 2026
CVE-2026-109205
34Monitor
LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
logicaldoc · logicaldoc community editionOct 12, 2026
CVE-2026-109225
34Monitor
SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
sgl-project · sglangOct 12, 2026
CVE-2026-109226
34Monitor
SGLang through 0.5.21 Audio Decompression Amplification via load_audio
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
sgl-project · sglangOct 12, 2026