By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 24 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-85961No exploit	Sensitive information exposure in Progress MarkLogic Server Azure deploymentsprogress software corporation · marklogic server · CWE-532 Pre-auth Info leak	High7.5	—	0.4%	Oct 12, 2026
30Monitor	CVE-2026-85962No exploit	Improper authentication in Progress MarkLogic Server SAML processingprogress software corporation · marklogic server · CWE-287 Pre-auth Auth bypass	High7.5	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-85963No exploit	Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirectorprogress software corporation · marklogic server · CWE-321 Pre-auth SSRF Hard-coded credentials	High7.5	—	0.4%	Oct 12, 2026
30Monitor	CVE-2026-85964No exploit	Path traversal in Progress MarkLogic Server Query Consoleprogress software corporation · marklogic server · CWE-22 Path traversal	High7.7	—	0.4%	Oct 12, 2026
32Monitor	CVE-2026-85965No exploit	Use-after-free in Progress MarkLogic Server JavaScript engine integrationprogress software corporation · marklogic server · CWE-416 Memory safety	High8.0	—	0.2%	Oct 12, 2026
30Monitor	CVE-2026-85966No exploit	Exposure of sensitive information in Progress MarkLogic Serverprogress software corporation · marklogic server · CWE-200 Info leak	High7.7	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-85968No exploit	Out-of-bounds read in Progress MarkLogic Serverprogress software corporation · marklogic server · CWE-125 Memory safety	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-85969No exploit	Out-of-bounds write in Progress MarkLogic Serverprogress software corporation · marklogic server · CWE-787 Memory safety	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-85970No exploit	Improper XML external entity restriction in Progress MarkLogic Serverprogress software corporation · marklogic server · CWE-611 XXE	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-85971No exploit	Incorrect log file permissions in Progress MarkLogic Serverprogress software corporation · marklogic server · CWE-732	High7.1	—	0.1%	Oct 12, 2026
29Monitor	CVE-2026-85972No exploit	Improper Kerberos server verification in Progress MarkLogic Serverprogress software corporation · marklogic server · CWE-303 Pre-auth	High7.4	—	0.3%	Oct 12, 2026
29Monitor	CVE-2026-85973No exploit	Cleartext transmission in Progress MarkLogic Server cluster join operationsprogress software corporation · marklogic server · CWE-319 Pre-auth Weak crypto	High7.4	—	0.1%	Oct 12, 2026
29Monitor	CVE-2026-85974No exploit	Improper TLS hostname verification in Progress MarkLogic Serverprogress software corporation · marklogic server · CWE-297 Pre-auth Weak crypto	High7.4	—	0.1%	Oct 12, 2026
30Monitor	CVE-2026-85975No exploit	Cleartext transmission in Progress MarkLogic Server Amazon S3 connectionsprogress software corporation · marklogic server · CWE-319 Pre-auth Weak crypto	High7.5	—	0.2%	Oct 12, 2026
32Monitor	CVE-2026-108479No exploit	WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerabilitypatreon · patreon wordpress · CWE-352 Pre-auth CSRF	High8.1	—	0.1%	Oct 12, 2026
29Monitor	CVE-2026-108481No exploit	WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerabilitypatreon · patreon wordpress · CWE-352 Pre-auth CSRF Denial of service	High7.4	—	0.1%	Oct 12, 2026
34Monitor	CVE-2026-108915No exploit	Edimax BR-6208AC formWlanMP buffer overflowedimax · br-6208ac · CWE-119 Memory safety	High8.6	—	0.4%	Oct 12, 2026
38Monitor	CVE-2026-108917No exploit	Edimax BR-6208AC formAutoFWupgrade command injectionedimax · br-6208ac · CWE-74 pre-auth RCE Command injection	Critical9.3	—	1.9%	Oct 12, 2026
38Monitor	CVE-2026-108918No exploit	Edimax BR-6208AC formWlanMP command injectionedimax · br-6208ac · CWE-74 pre-auth RCE Command injection	Critical9.3	—	2.0%	Oct 12, 2026
35Monitor	CVE-2026-77363No exploit	obsidian-tc Streamable HTTP transport permits cross-origin loopback vault accessthe-40-thieves · obsidian-tc · CWE-346 Pre-auth	High8.8	—	0.1%	Oct 12, 2026
39Monitor	CVE-2026-77366No exploit	obsidian-tc tokens can access arbitrary configured vaultsthe-40-thieves · obsidian-tc · CWE-639 Broken access control (IDOR)	Critical9.9	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-104355No exploit	Temporal Server applies inbound namespace replication from a connected peer cluster to local namespacestemporal technologies, inc. · temporal server · CWE-863 Broken access control (IDOR)	High7.0	—	0.3%	Oct 12, 2026
35Monitor	CVE-2026-105464No exploit	IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege managementibm · db2 · CWE-269 Local privilege escalation	High8.8	—	0.0%	Oct 12, 2026
35Monitor	CVE-2026-105465No exploit	IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instanceibm · db2 · CWE-269 Local privilege escalation	High8.8	—	0.0%	Oct 12, 2026
30Monitor	CVE-2026-18166No exploit	IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host fibm · db2 · CWE-284 Broken access control (IDOR)	High7.7	—	0.2%	Oct 12, 2026
39Monitor	CVE-2026-57118No exploit	PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpointsmervinpraison · praisonai · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.4%	Oct 12, 2026
35Monitor	CVE-2026-57143No exploit	PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parametermervinpraison · praisonaiagents · CWE-20 Pre-auth SSRF	High8.8	—	0.2%	Oct 12, 2026
32Monitor	CVE-2026-59976No exploit	ConvertX: Path Traversal vulnerability leading to Arbitrary File Writec4illin · convertx · CWE-22 Auth bypass Path traversal	High8.1	—	0.7%	Oct 12, 2026
32Monitor	CVE-2026-59977No exploit	ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destructionc4illin · convertx · CWE-352 Pre-auth CSRF	High8.1	—	0.1%	Oct 12, 2026
34Monitor	CVE-2026-65954No exploit	PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()phpcsstandards · phpcsutils · CWE-95 RCE	High8.6	—	0.1%	Oct 12, 2026
29Monitor	CVE-2026-83535No exploit	Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparisonred hat · red hat openstack platform 18.0 · CWE-208 Pre-auth	High7.4	—	0.2%	Oct 12, 2026
36Monitor	CVE-2026-87744No exploit	Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotationsred hat · exploit intelligence · CWE-425 Pre-auth Auth bypass	Critical9.1	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-108361No exploit	Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacksprivasys · ra-tls-clients · CWE-367 Race condition	High7.2	—	0.0%	Oct 12, 2026
36Monitor	CVE-2026-108362No exploit	Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)privasys · ra-tls-clients · CWE-346 Pre-auth	Critical9.1	—	0.1%	Oct 12, 2026
21Monitor	CVE-2026-108924Proof of concept	getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorizationgetkirby · kirby · CWE-285 Broken access control (IDOR)	Medium5.3	—	0.3%	Oct 12, 2026
36Monitor	CVE-2026-109422No exploit	NetEase Cloud Music RCE via os.navigateExternal IPCnetease · netease cloud music for windows · CWE-749 pre-auth RCE	Critical9.2	—	0.5%	Oct 12, 2026
36Monitor	CVE-2026-109423No exploit	NetEase Cloud Music TLS Certificate Validation Bypassnetease · netease cloud music for windows · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.1%	Oct 12, 2026
32Monitor	CVE-2026-109424No exploit	NetEase Cloud Music Weak Encryption via eapi/xeapinetease · netease cloud music for windows · CWE-321 Pre-auth Hard-coded credentials	High8.2	—	0.1%	Oct 12, 2026
39Monitor	CVE-2026-109575No exploit	In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authhaproxy · data plane api ee · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-41510No exploit	OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingcorazawaf · coraza · CWE-693 Pre-auth	High7.2	—	0.3%	Oct 12, 2026
31Monitor	CVE-2026-95837No exploit	containerd CRI plugin: Checkpoint restore bypasses destination security contextcontainerd · containerd · CWE-269 Local privilege escalation	High7.8	—	0.1%	Oct 12, 2026
39Monitor	CVE-2026-96012No exploit	IBM Db2 Mirror for i Privilege Escalationibm · db2 mirror for i · CWE-264	Critical9.9	—	0.3%	Oct 12, 2026
37Monitor	CVE-2020-37279No exploit	easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge functionkaruppiah7890 · easy-pdf-merge · CWE-78 pre-auth RCE Command injection	Critical9.2	—	1.8%	Oct 12, 2026
34Monitor	CVE-2020-37280No exploit	cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengthspelioniot · cbor-sync · CWE-789 Pre-auth	High8.7	—	0.5%	Oct 12, 2026
34Monitor	CVE-2021-48011No exploit	Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segmentslukejacksonn · servor · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Oct 12, 2026
35Monitor	CVE-2021-48012No exploit	fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOMLgin-quin · fast-toml · CWE-1321 Pre-auth Prototype pollution	High8.8	—	0.4%	Oct 12, 2026
38Monitor	CVE-2025-71429No exploit	GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.pyrvc-boss · gpt-sovits · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.8%	Oct 12, 2026
30Monitor	CVE-2026-105052No exploit	IBM Maximo Application Suite Information Disclosureibm · maximo application suite · CWE-22 Pre-auth Path traversal	High7.5	—	0.4%	Oct 12, 2026
37Monitor	CVE-2026-108929No exploit	Netcore NR268 DDNS DDNSset.cgi execvp argument injectionnetcore · nr268 · CWE-74	Critical9.4	—	0.4%	Oct 12, 2026
34Monitor	CVE-2026-109380No exploit	modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Fieldayuhito · modern-tar · CWE-1284 Pre-auth	High8.7	—	0.4%	Oct 12, 2026
32Monitor	CVE-2026-109426No exploit	Telegram-Stremio 5.1.0 Insecure Session Storage via encode_stringweebzone · telegram-stremio · CWE-312 Pre-auth	High8.2	—	0.1%	Oct 12, 2026
28Monitor	CVE-2026-109427No exploit	Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDsweebzone · telegram-stremio · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
29Monitor	CVE-2026-109556No exploit	EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPCtianma-if · edgeever · CWE-749 RCE XSS	High7.3	—	0.6%	Oct 12, 2026
33Monitor	CVE-2026-109557No exploit	EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Previewtianma-if · edgeever · CWE-79 XSS	High8.4	—	0.4%	Oct 12, 2026
34Monitor	CVE-2026-109558No exploit	EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Previewtianma-if · edgeever · CWE-79 XSS	High8.5	—	0.4%	Oct 12, 2026
33Monitor	CVE-2026-109559No exploit	EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigatetianma-if · edgeever · CWE-863 Broken access control (IDOR)	High8.4	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-109560No exploit	Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chainingcontinuedev · continue · CWE-863 Pre-auth Broken access control (IDOR)	High7.7	—	0.5%	Oct 12, 2026
34Monitor	CVE-2026-109563No exploit	N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regexrdfjs · n3.js · CWE-1333 Pre-auth Denial of service	High8.7	—	0.3%	Oct 12, 2026
37Monitor	CVE-2026-109566Proof of concept	Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeederzofe · rapyd-admin · CWE-798 Pre-auth Hard-coded credentials	Critical9.3	—	0.6%	Oct 12, 2026
34Monitor	CVE-2026-109567No exploit	Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Componentzofe · rapyd-admin · CWE-269	High8.6	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-109568No exploit	Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routesmarceauka · shaark · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
37Monitor	CVE-2026-109569No exploit	sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespaceth0rgal · sandboxed.sh · CWE-1188	Critical9.3	—	0.1%	Oct 12, 2026
28Monitor	CVE-2026-18513No exploit	IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Managementibm · maximo application suite - location service for esri component · CWE-269	High7.2	—	0.2%	Oct 12, 2026
30Monitor	CVE-2026-18517No exploit	IBM Maximo Application Suite - Location Service for Esri Component Improper Access Controlibm · maximo application suite - location service for esri component · CWE-284 Broken access control (IDOR)	High7.7	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-18529No exploit	IBM Maximo Application Suite - Location Service for Esri Component Code Executionibm · maximo application suite - location service for esri component · CWE-78 RCE Command injection	High8.7	—	0.6%	Oct 12, 2026
34Monitor	CVE-2026-18537No exploit	IBM Maximo Application Suite - Location Service for Esri Component Code Executionibm · maximo application suite - location service for esri component · CWE-94 RCE	High8.7	—	0.2%	Oct 12, 2026
36Monitor	CVE-2026-53997No exploit	Netherman Portal del Hermano Account Takeover via Password Reset Oraclenetherman · portal del hermano (portaldelhermano.es) · CWE-307 Pre-auth	Critical9.1	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-75881No exploit	IBM Maximo Application Suite - IoT Component Denial of Serviceibm · maximo application suite - iot component · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-78673No exploit	Maximo AI Service Improper Input Validationibm · maximo ai service · CWE-20 Pre-auth Denial of service	High7.5	—	0.3%	Oct 12, 2026
35Monitor	CVE-2026-84313No exploit	Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover0xjacky · nginx-ui · CWE-287 Auth bypass	High8.8	—	0.5%	Oct 12, 2026
34Monitor	CVE-2026-84314No exploit	Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint0xjacky · nginx-ui · CWE-285 Broken access control (IDOR)	High8.7	—	0.4%	Oct 12, 2026
33Monitor	CVE-2026-84315No exploit	Nginx UI OTP secure-session step-up is missing on sensitive mutation routes0xjacky · nginx-ui · CWE-862 Broken access control (IDOR)	High8.3	—	0.3%	Oct 12, 2026
35Monitor	CVE-2026-84316No exploit	Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the offici0xjacky · nginx-ui · CWE-20 RCE	High8.8	—	0.5%	Oct 12, 2026
35Monitor	CVE-2026-84317No exploit	Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)0xjacky · nginx-ui · CWE-20 RCE	High8.8	—	0.4%	Oct 12, 2026
35Monitor	CVE-2026-84318No exploit	Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE0xjacky · nginx-ui · CWE-693 RCE	High8.8	—	0.8%	Oct 12, 2026
33Monitor	CVE-2026-84319No exploit	Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context0xjacky · nginx-ui · CWE-693	High8.3	—	0.2%	Oct 12, 2026
32Monitor	CVE-2026-84360No exploit	Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools0xjacky · nginx-ui · CWE-288 Auth bypass	High8.1	—	0.4%	Oct 12, 2026
36Monitor	CVE-2026-92116No exploit	Apache Allura: OAuth1 missing callback validationapache software foundation · apache allura · CWE-601 Pre-auth Open redirect	Critical9.1	—	0.2%	Oct 12, 2026
36Monitor	CVE-2026-92119No exploit	Apache Allura: REST API Mass Assignmentapache software foundation · apache allura · CWE-915 Pre-auth	Critical9.1	—	0.3%	Oct 12, 2026
36Monitor	CVE-2026-92120No exploit	Apache Allura: Oauth1 Replay Attackapache software foundation · apache allura · CWE-294 Pre-auth Auth bypass	Critical9.1	—	0.2%	Oct 12, 2026
29Monitor	CVE-2026-96261No exploit	IBM Power Systems Firmware Buffer Overflowibm · powervm hypervisor · CWE-121 Memory safety	High7.3	—	0.0%	Oct 12, 2026
32Monitor	CVE-2026-96262No exploit	IBM Power Systems Firmware Buffer Overflowibm · powervm hypervisor · CWE-121 RCE Memory safety	High8.2	—	0.1%	Oct 12, 2026
32Monitor	CVE-2026-96263No exploit	IBM Power Systems Firmware Buffer Overflowibm · powervm hypervisor · CWE-121 RCE Memory safety	High8.2	—	0.1%	Oct 12, 2026
32Monitor	CVE-2026-96264No exploit	IBM Power Systems Firmware Buffer Overflowibm · powervm hypervisor · CWE-121 RCE Memory safety	High8.2	—	0.1%	Oct 12, 2026
32Monitor	CVE-2026-96265No exploit	IBM Power Systems Firmware Improper Memory Buffer Restrictionibm · powervm hypervisor · CWE-119 Memory safety	High8.2	—	0.1%	Oct 12, 2026
32Monitor	CVE-2026-96266No exploit	IBM Power Systems Firmware Buffer Overflowibm · powervm hypervisor · CWE-121 Memory safety	High8.2	—	0.1%	Oct 12, 2026
37Monitor	CVE-2026-44828No exploit	Qexo initialization endpoint can reset setup state and expose stored credentialsqexo · qexo · CWE-538 Pre-auth Auth bypass CSRF	Critical9.3	—	0.3%	Oct 12, 2026
35Monitor	CVE-2026-49483No exploit	Code for IBMi: Uses IBM i components with blind check allowing arbitrary code executioncodefori · vscode-ibmi · CWE-345 RCE	High8.9	—	0.1%	Oct 12, 2026
28Monitor	CVE-2026-84312No exploit	Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)0xjacky · nginx-ui · CWE-287 Pre-auth Auth bypass CSRF	High7.1	—	0.1%	Oct 12, 2026
30Monitor	CVE-2026-90911No exploit	Maximo AI Service Denial of Serviceibm · maximo ai service · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-90912No exploit	Maximo AI Service Denial of Serviceibm · maximo ai service · CWE-674 Pre-auth Denial of service	High7.5	—	0.3%	Oct 12, 2026
39Monitor	CVE-2026-90920No exploit	Maximo AI Service Code Injectionibm · maximo ai service · CWE-94 pre-auth RCE	Critical9.8	—	0.5%	Oct 12, 2026
30Monitor	CVE-2026-90921No exploit	Maximo AI Service Denial of Serviceibm · maximo ai service · CWE-130 Pre-auth Denial of service	High7.5	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-92876No exploit	IBM Maximo Application Suite - IoT Component Denial of Serviceibm · maximo application suite - iot component · CWE-674 Pre-auth Denial of service	High7.5	—	0.3%	Oct 12, 2026
32Monitor	CVE-2023-54411No exploit	Frappe before 13.32.0 Weak Authentication via Print View Keyfrappe · frappe · CWE-290 Pre-auth Auth bypass	High8.2	—	0.2%	Oct 12, 2026
28Monitor	CVE-2023-54412No exploit	Frappe before 13.46.3 Improper Access Control for Email Templatesfrappe · frappe · CWE-284 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2024-58390No exploit	Frappe before 15.41.0 Privilege Escalation via Document Actionfrappe · frappe · CWE-269	High8.7	—	0.2%	Oct 12, 2026
34Monitor	CVE-2025-71432No exploit	Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeoverfrappe · erpnext · CWE-79 Pre-auth XSS	High8.6	—	0.2%	Oct 12, 2026
35Monitor	CVE-2026-102627No exploit	Security Vulnerability identified in IBM TRIRIGA - Zip Slipibm · tririga application platform · CWE-22 RCE Path traversal	High8.8	—	0.5%	Oct 12, 2026
28Monitor	CVE-2026-109572No exploit	Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxyopen-webui · open-webui · CWE-862 Broken access control (IDOR)	High7.2	—	0.2%	Oct 12, 2026

CVE-2026-85961
30Monitor
Sensitive information exposure in Progress MarkLogic Server Azure deployments
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85962
30Monitor
Improper authentication in Progress MarkLogic Server SAML processing
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85963
30Monitor
Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
- Hard-coded credentials
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85964
30Monitor
Path traversal in Progress MarkLogic Server Query Console
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85965
32Monitor
Use-after-free in Progress MarkLogic Server JavaScript engine integration
HighCVSS 8.0No exploitEPSS 0%
- Memory safety
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85966
30Monitor
Exposure of sensitive information in Progress MarkLogic Server
HighCVSS 7.7No exploitEPSS 0%
- Info leak
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85968
28Monitor
Out-of-bounds read in Progress MarkLogic Server
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85969
28Monitor
Out-of-bounds write in Progress MarkLogic Server
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85970
28Monitor
Improper XML external entity restriction in Progress MarkLogic Server
HighCVSS 7.1No exploitEPSS 0%
- XXE
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85971
28Monitor
Incorrect log file permissions in Progress MarkLogic Server
HighCVSS 7.1No exploitEPSS 0%
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85972
29Monitor
Improper Kerberos server verification in Progress MarkLogic Server
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85973
29Monitor
Cleartext transmission in Progress MarkLogic Server cluster join operations
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85974
29Monitor
Improper TLS hostname verification in Progress MarkLogic Server
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-85975
30Monitor
Cleartext transmission in Progress MarkLogic Server Amazon S3 connections
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
progress software corporation · marklogic serverOct 12, 2026
CVE-2026-108479
32Monitor
WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
patreon · patreon wordpressOct 12, 2026
CVE-2026-108481
29Monitor
WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- CSRF
- Denial of service
patreon · patreon wordpressOct 12, 2026
CVE-2026-108915
34Monitor
Edimax BR-6208AC formWlanMP buffer overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
edimax · br-6208acOct 12, 2026
CVE-2026-108917
38Monitor
Edimax BR-6208AC formAutoFWupgrade command injection
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
edimax · br-6208acOct 12, 2026
CVE-2026-108918
38Monitor
Edimax BR-6208AC formWlanMP command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
edimax · br-6208acOct 12, 2026
CVE-2026-77363
35Monitor
obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
the-40-thieves · obsidian-tcOct 12, 2026
CVE-2026-77366
39Monitor
obsidian-tc tokens can access arbitrary configured vaults
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
the-40-thieves · obsidian-tcOct 12, 2026
CVE-2026-104355
28Monitor
Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces
HighCVSS 7.0No exploitEPSS 0%
- Broken access control (IDOR)
temporal technologies, inc. · temporal serverOct 12, 2026
CVE-2026-105464
35Monitor
IBM® Db2® is vulnerable to a local attacker with DBADM authorization gaining elevated privileges due to improper privilege management
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
ibm · db2Oct 12, 2026
CVE-2026-105465
35Monitor
IBM® Db2® is vulnerable to privilege escalation when db2ssh is enabled with the db2 instance
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
ibm · db2Oct 12, 2026
CVE-2026-18166
30Monitor
IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host f
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · db2Oct 12, 2026
CVE-2026-57118
39Monitor
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
mervinpraison · praisonaiOct 12, 2026
CVE-2026-57143
35Monitor
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SSRF
mervinpraison · praisonaiagentsOct 12, 2026
CVE-2026-59976
32Monitor
ConvertX: Path Traversal vulnerability leading to Arbitrary File Write
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
- Path traversal
c4illin · convertxOct 12, 2026
CVE-2026-59977
32Monitor
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
c4illin · convertxOct 12, 2026
CVE-2026-65954
34Monitor
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
HighCVSS 8.6No exploitEPSS 0%
- RCE
phpcsstandards · phpcsutilsOct 12, 2026
CVE-2026-83535
29Monitor
Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
red hat · red hat openstack platform 18.0Oct 12, 2026
CVE-2026-87744
36Monitor
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
red hat · exploit intelligenceOct 12, 2026
CVE-2026-108361
28Monitor
Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
HighCVSS 7.2No exploitEPSS 0%
- Race condition
privasys · ra-tls-clientsOct 12, 2026
CVE-2026-108362
36Monitor
Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
privasys · ra-tls-clientsOct 12, 2026
CVE-2026-108924
21Monitor
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
MediumCVSS 5.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
getkirby · kirbyOct 12, 2026
CVE-2026-109422
36Monitor
NetEase Cloud Music RCE via os.navigateExternal IPC
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
netease · netease cloud music for windowsOct 12, 2026
CVE-2026-109423
36Monitor
NetEase Cloud Music TLS Certificate Validation Bypass
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
netease · netease cloud music for windowsOct 12, 2026
CVE-2026-109424
32Monitor
NetEase Cloud Music Weak Encryption via eapi/xeapi
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
netease · netease cloud music for windowsOct 12, 2026
CVE-2026-109575
39Monitor
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global auth
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
haproxy · data plane api eeOct 12, 2026
CVE-2026-41510
28Monitor
OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
corazawaf · corazaOct 12, 2026
CVE-2026-95837
31Monitor
containerd CRI plugin: Checkpoint restore bypasses destination security context
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
containerd · containerdOct 12, 2026
CVE-2026-96012
39Monitor
IBM Db2 Mirror for i Privilege Escalation
CriticalCVSS 9.9No exploitEPSS 0%
ibm · db2 mirror for iOct 12, 2026
CVE-2020-37279
37Monitor
easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function
CriticalCVSS 9.2No exploitEPSS 1%
- pre-auth RCE
- Command injection
karuppiah7890 · easy-pdf-mergeOct 12, 2026
CVE-2020-37280
34Monitor
cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
pelioniot · cbor-syncOct 12, 2026
CVE-2021-48011
34Monitor
Servor 1.0.0 through 4.0.2 Unauthenticated Path Traversal via URL-Encoded Dot Segments
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
lukejacksonn · servorOct 12, 2026
CVE-2021-48012
35Monitor
fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Prototype pollution
gin-quin · fast-tomlOct 12, 2026
CVE-2025-71429
38Monitor
GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
rvc-boss · gpt-sovitsOct 12, 2026
CVE-2026-105052
30Monitor
IBM Maximo Application Suite Information Disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · maximo application suiteOct 12, 2026
CVE-2026-108929
37Monitor
Netcore NR268 DDNS DDNSset.cgi execvp argument injection
CriticalCVSS 9.4No exploitEPSS 0%
netcore · nr268Oct 12, 2026
CVE-2026-109380
34Monitor
modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
ayuhito · modern-tarOct 12, 2026
CVE-2026-109426
32Monitor
Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
weebzone · telegram-stremioOct 12, 2026
CVE-2026-109427
28Monitor
Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
weebzone · telegram-stremioOct 12, 2026
CVE-2026-109556
29Monitor
EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC
HighCVSS 7.3No exploitEPSS 0%
- RCE
- XSS
tianma-if · edgeeverOct 12, 2026
CVE-2026-109557
33Monitor
EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
HighCVSS 8.4No exploitEPSS 0%
- XSS
tianma-if · edgeeverOct 12, 2026
CVE-2026-109558
34Monitor
EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview
HighCVSS 8.5No exploitEPSS 0%
- XSS
tianma-if · edgeeverOct 12, 2026
CVE-2026-109559
33Monitor
EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
HighCVSS 8.4No exploitEPSS 0%
- Broken access control (IDOR)
tianma-if · edgeeverOct 12, 2026
CVE-2026-109560
30Monitor
Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
continuedev · continueOct 12, 2026
CVE-2026-109563
34Monitor
N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
rdfjs · n3.jsOct 12, 2026
CVE-2026-109566
37Monitor
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- Hard-coded credentials
zofe · rapyd-adminOct 12, 2026
CVE-2026-109567
34Monitor
Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component
HighCVSS 8.6No exploitEPSS 0%
zofe · rapyd-adminOct 12, 2026
CVE-2026-109568
28Monitor
Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
marceauka · shaarkOct 12, 2026
CVE-2026-109569
37Monitor
sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace
CriticalCVSS 9.3No exploitEPSS 0%
th0rgal · sandboxed.shOct 12, 2026
CVE-2026-18513
28Monitor
IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management
HighCVSS 7.2No exploitEPSS 0%
ibm · maximo application suite - location service for esri componentOct 12, 2026
CVE-2026-18517
30Monitor
IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · maximo application suite - location service for esri componentOct 12, 2026
CVE-2026-18529
34Monitor
IBM Maximo Application Suite - Location Service for Esri Component Code Execution
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
ibm · maximo application suite - location service for esri componentOct 12, 2026
CVE-2026-18537
34Monitor
IBM Maximo Application Suite - Location Service for Esri Component Code Execution
HighCVSS 8.7No exploitEPSS 0%
- RCE
ibm · maximo application suite - location service for esri componentOct 12, 2026
CVE-2026-53997
36Monitor
Netherman Portal del Hermano Account Takeover via Password Reset Oracle
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
netherman · portal del hermano (portaldelhermano.es)Oct 12, 2026
CVE-2026-75881
30Monitor
IBM Maximo Application Suite - IoT Component Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · maximo application suite - iot componentOct 12, 2026
CVE-2026-78673
30Monitor
Maximo AI Service Improper Input Validation
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · maximo ai serviceOct 12, 2026
CVE-2026-84313
35Monitor
Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
0xjacky · nginx-uiOct 12, 2026
CVE-2026-84314
34Monitor
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
0xjacky · nginx-uiOct 12, 2026
CVE-2026-84315
33Monitor
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
0xjacky · nginx-uiOct 12, 2026
CVE-2026-84316
35Monitor
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the offici
HighCVSS 8.8No exploitEPSS 0%
- RCE
0xjacky · nginx-uiOct 12, 2026
CVE-2026-84317
35Monitor
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
HighCVSS 8.8No exploitEPSS 0%
- RCE
0xjacky · nginx-uiOct 12, 2026
CVE-2026-84318
35Monitor
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
HighCVSS 8.8No exploitEPSS 0%
- RCE
0xjacky · nginx-uiOct 12, 2026
CVE-2026-84319
33Monitor
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
HighCVSS 8.3No exploitEPSS 0%
0xjacky · nginx-uiOct 12, 2026
CVE-2026-84360
32Monitor
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
0xjacky · nginx-uiOct 12, 2026
CVE-2026-92116
36Monitor
Apache Allura: OAuth1 missing callback validation
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Open redirect
apache software foundation · apache alluraOct 12, 2026
CVE-2026-92119
36Monitor
Apache Allura: REST API Mass Assignment
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache software foundation · apache alluraOct 12, 2026
CVE-2026-92120
36Monitor
Apache Allura: Oauth1 Replay Attack
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache alluraOct 12, 2026
CVE-2026-96261
29Monitor
IBM Power Systems Firmware Buffer Overflow
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
ibm · powervm hypervisorOct 12, 2026
CVE-2026-96262
32Monitor
IBM Power Systems Firmware Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · powervm hypervisorOct 12, 2026
CVE-2026-96263
32Monitor
IBM Power Systems Firmware Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · powervm hypervisorOct 12, 2026
CVE-2026-96264
32Monitor
IBM Power Systems Firmware Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- RCE
- Memory safety
ibm · powervm hypervisorOct 12, 2026
CVE-2026-96265
32Monitor
IBM Power Systems Firmware Improper Memory Buffer Restriction
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · powervm hypervisorOct 12, 2026
CVE-2026-96266
32Monitor
IBM Power Systems Firmware Buffer Overflow
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
ibm · powervm hypervisorOct 12, 2026
CVE-2026-44828
37Monitor
Qexo initialization endpoint can reset setup state and expose stored credentials
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
qexo · qexoOct 12, 2026
CVE-2026-49483
35Monitor
Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
HighCVSS 8.9No exploitEPSS 0%
- RCE
codefori · vscode-ibmiOct 12, 2026
CVE-2026-84312
28Monitor
Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
0xjacky · nginx-uiOct 12, 2026
CVE-2026-90911
30Monitor
Maximo AI Service Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · maximo ai serviceOct 12, 2026
CVE-2026-90912
30Monitor
Maximo AI Service Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · maximo ai serviceOct 12, 2026
CVE-2026-90920
39Monitor
Maximo AI Service Code Injection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
ibm · maximo ai serviceOct 12, 2026
CVE-2026-90921
30Monitor
Maximo AI Service Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · maximo ai serviceOct 12, 2026
CVE-2026-92876
30Monitor
IBM Maximo Application Suite - IoT Component Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · maximo application suite - iot componentOct 12, 2026
CVE-2023-54411
32Monitor
Frappe before 13.32.0 Weak Authentication via Print View Key
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
frappe · frappeOct 12, 2026
CVE-2023-54412
28Monitor
Frappe before 13.46.3 Improper Access Control for Email Templates
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · frappeOct 12, 2026
CVE-2024-58390
34Monitor
Frappe before 15.41.0 Privilege Escalation via Document Action
HighCVSS 8.7No exploitEPSS 0%
frappe · frappeOct 12, 2026
CVE-2025-71432
34Monitor
Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
frappe · erpnextOct 12, 2026
CVE-2026-102627
35Monitor
Security Vulnerability identified in IBM TRIRIGA - Zip Slip
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
ibm · tririga application platformOct 12, 2026
CVE-2026-109572
28Monitor
Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
open-webui · open-webuiOct 12, 2026