By publication date

Exploited and new serious CVEs: October 2026

8,751 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 25 of 88

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-109573No exploit	phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpointthorsten · phpmyfaq · CWE-89 Pre-auth SQL injection	Critical9.2	—	0.3%	Oct 12, 2026
32Monitor	CVE-2026-109601No exploit	Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTMLfrappe · frappe · CWE-73 Pre-auth Path traversal	High8.2	—	0.3%	Oct 12, 2026
34Monitor	CVE-2026-109604No exploit	ERPNext before 15.112.0 Stored XSS via Tool View Record Namesfrappe · erpnext · CWE-79 XSS	High8.5	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109608No exploit	Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Inputfrappe · erpnext · CWE-89 SQL injection	High8.7	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109609No exploit	Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validationfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109610No exploit	Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modificationfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109612No exploit	Frappe ERPNext before 15.120.0 Stored XSS via Report Viewfrappe · erpnext · CWE-79 XSS	High8.5	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109613No exploit	Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modificationfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109614No exploit	Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109615No exploit	Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109616No exploit	Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modificationfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109617No exploit	Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109621No exploit	Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypassfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109624No exploit	Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109625No exploit	Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109626No exploit	Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpointsfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109627No exploit	Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109628No exploit	Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorizationfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109631No exploit	Frappe ERPNext before 15.119.1 SQL Injection via Missing Validationfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109632No exploit	Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109633No exploit	Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Pagefrappe · erpnext · CWE-79 Pre-auth XSS	High8.6	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109636No exploit	Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109637No exploit	Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modificationfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109638No exploit	Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validationfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109639No exploit	Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requestsfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109640No exploit	Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modificationfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.2	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109643No exploit	Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109644No exploit	Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109645No exploit	Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorizationfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109646No exploit	Frappe ERPNext before 15.106.0 SQL Injection via Missing Validationfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109647No exploit	Frappe ERPNext before 15.106.0 SQL Injection via Missing Validationfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109648No exploit	Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validationfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109649No exploit	Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requestsfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109650No exploit	Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109652No exploit	Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fieldsfrappe · erpnext · CWE-1336 RCE SSTI	High8.7	—	0.3%	Oct 12, 2026
34Monitor	CVE-2026-109653No exploit	Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeoverfrappe · erpnext · CWE-79 XSS	High8.5	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109655No exploit	Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109656No exploit	Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Accessfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109658No exploit	Frappe ERPNext before 15.115.0 Missing Authorization on Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109659No exploit	Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109660No exploit	Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109661No exploit	Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109663No exploit	Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parametersfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-109666No exploit	Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109667No exploit	Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creationfrappe · erpnext · CWE-269	High8.7	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109671No exploit	Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pagesfrappe · erpnext · CWE-79 XSS	High8.5	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109672No exploit	Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Datafrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
34Monitor	CVE-2026-109673No exploit	Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Namesfrappe · erpnext · CWE-79 XSS	High8.5	—	0.2%	Oct 12, 2026
28Monitor	CVE-2026-109674No exploit	Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validationfrappe · erpnext · CWE-89 SQL injection	High7.1	—	0.3%	Oct 12, 2026
28Monitor	CVE-2026-17475No exploit	IBM Planning Analytics Local is affected by security vulnerabilitiesibm · planning analytics · CWE-285 Broken access control (IDOR)	High7.1	—	0.2%	Oct 12, 2026
35Monitor	CVE-2026-19620No exploit	IBM Planning Analytics Local is affected by security vulnerabilitiesibm · planning analytics · CWE-288 Auth bypass	High8.8	—	0.3%	Oct 12, 2026
39Monitor	CVE-2026-19622No exploit	IBM Planning Analytics Local is affected by security vulnerabilitiesibm · planning analytics · CWE-288 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 12, 2026
32Monitor	CVE-2026-19627No exploit	IBM Planning Analytics Local is affected by security vulnerabilitiesibm · planning analytics · CWE-22 Pre-auth Path traversal	High8.2	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-75061No exploit	IBM Planning Analytics Local is affected by security vulnerabilitiesibm · planning analytics · CWE-22 Pre-auth Path traversal	High7.5	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-75095No exploit	IBM Aspera Enterprise Webapps Denial of Serviceibm · aspera enterprise webapps · CWE-400 Pre-auth Denial of service	High7.5	—	0.3%	Oct 12, 2026
31Monitor	CVE-2026-75782No exploit	IBM Aspera Enterprise Webapps Untrusted Search Pathibm · aspera enterprise webapps · CWE-426 Local privilege escalation	High7.8	—	0.1%	Oct 12, 2026
35Monitor	CVE-2026-82096No exploit	DataStage on Cloud Pak for Data Command Injectionibm · datastage on cloud pak for data · CWE-78 RCE Command injection	High8.8	—	0.4%	Oct 12, 2026
38Monitor	CVE-2026-82101No exploit	DataStage on Cloud Pak for Data Path Traversalibm · datastage on cloud pak for data · CWE-22 Path traversal	Critical9.6	—	0.4%	Oct 12, 2026
35Monitor	CVE-2026-82108No exploit	DataStage on Cloud Pak for Data Code Injectionibm · datastage on cloud pak for data · CWE-94 RCE	High8.8	—	0.4%	Oct 12, 2026
39Monitor	CVE-2026-82110No exploit	DataStage on Cloud Pak for Data Path Traversalibm · datastage on cloud pak for data · CWE-22 RCE Path traversal	Critical9.9	—	0.5%	Oct 12, 2026
29Monitor	CVE-2026-84418No exploit	DataStage on Cloud Pak for Data Improper Certificate Validationibm · datastage on cloud pak for data · CWE-295 Pre-auth Weak crypto	High7.4	—	0.1%	Oct 12, 2026
32Monitor	CVE-2026-85457No exploit	IBM Planning Analytics Local is affected by security vulnerabilitiesibm · planning analytics · CWE-121 RCE Memory safety	High8.1	—	0.3%	Oct 12, 2026
30Monitor	CVE-2026-93891No exploit	Security Vulnerability identified in IBM TRIRIGA - XXEibm · tririga application platform · CWE-611 XXE	High7.6	—	0.3%	Oct 12, 2026
32Monitor	CVE-2026-93892No exploit	Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Consoleibm · tririga application platform · CWE-200 Info leak	High8.1	—	0.2%	Oct 12, 2026
32Monitor	CVE-2026-81858No exploit	IBM i is Affected By A Denial of Service Vulnerability in Host Serversibm · i · CWE-125 Memory safety	High8.1	—	0.2%	Oct 13, 2026
39Monitor	CVE-2026-96119No exploit	IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUIibm · i · CWE-94 RCE	Critical9.9	—	0.5%	Oct 13, 2026
30Monitor	CVE-2026-58249Proof of concept	Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)sap_se · sap netweaver and sap web dispatcher (internet communication manager) · CWE-191 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Oct 13, 2026
39Monitor	CVE-2026-87689No exploit	Metasploit Framework Web Service REST API Missing Authentication on Credential Endpointsrapid7 · metasploit framework · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.3%	Oct 13, 2026
39Monitor	CVE-2026-89107No exploit	Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)sap_se · sap s/4hana (manage substitution/validation rules) · CWE-94 RCE	Critical9.9	—	0.4%	Oct 13, 2026
36Monitor	CVE-2026-89108No exploit	Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)sap_se · sap manufacturing integration and intelligence (configuration service) · CWE-862 Broken access control (IDOR)	Critical9.1	—	0.3%	Oct 13, 2026
39Monitor	CVE-2026-89110No exploit	Broken Access Control in SAP NetWeaver Visual Composersap_se · sap netweaver visual composer · CWE-749 Broken access control (IDOR)	Critical9.9	—	0.4%	Oct 13, 2026
40Plan	CVE-2026-89111No exploit	OAuth2 SSRF vulnerability in SAP Cloud SDK for Pythonsap_se · sap cloud · CWE-918 Pre-auth SSRF	Critical10.0	—	0.3%	Oct 13, 2026
35Monitor	CVE-2026-89113No exploit	SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)sap_se · sap commerce cloud (ootb code) · CWE-89 SQL injection	High8.8	—	0.4%	Oct 13, 2026
28Monitor	CVE-2026-89120No exploit	Missing authorization check in SAP ABAP Platformsap_se · sap abap platform · CWE-1188	High7.1	—	0.2%	Oct 13, 2026
32Monitor	CVE-2026-14814No exploit	Permissive Regular Expression in GitLabgitlab · gitlab · CWE-625	High8.2	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-16301No exploit	Incorrect Authorization in GitLabgitlab · gitlab · CWE-863 Broken access control (IDOR)	High8.5	—	0.3%	Oct 13, 2026
28Monitor	CVE-2026-35001No exploit	OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflowopens100 project · opens100 · CWE-122 RCE Memory safety	High7.1	—	0.1%	Oct 13, 2026
30Monitor	CVE-2026-81839No exploit	Incorrect Authorization in GitLabgitlab · gitlab · CWE-863 RCE Broken access control (IDOR)	High7.7	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-92883No exploit	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabgitlab · gitlab · CWE-79 RCE XSS	High8.7	—	0.4%	Oct 13, 2026
29Monitor	CVE-2026-96893No exploit	Improper Neutralization of Input Used for LLM Prompting in GitLabgitlab · gitlab · CWE-74 RCE	High7.3	—	0.5%	Oct 13, 2026
91Now	CVE-2026-97229Weaponized	Integer Overflow or Wraparound in GitLabgitlab · gitlab · CWE-190 pre-auth RCE Memory safety	Critical10.0	KEV	69.2%	Oct 13, 2026
37Monitor	CVE-2026-109758No exploit	Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized accperforce · helix authentication service · CWE-798 Pre-auth Hard-coded credentials	Critical9.3	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-108971No exploit	D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verificationd-link · dcs-930l · CWE-345 Pre-auth	High8.6	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-103316No exploit	The macOS version of the DigiD app is not signed with Hardened Runtimelogius · digid for macos · CWE-269 RCE Local privilege escalation	High7.1	—	0.1%	Oct 13, 2026
34Monitor	CVE-2026-75826No exploit	Teltonika Command Injection in Backup functionteltonika networks · rutos · CWE-78 RCE Command injection	High8.5	—	0.9%	Oct 13, 2026
28Monitor	CVE-2026-102007No exploit	Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callbackbitpressadmin · bit integrations – form integration, webhook, spreadsheets, crm, lms & email automation · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 13, 2026
28Monitor	CVE-2026-102562No exploit	AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameteracyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Oct 13, 2026
35Monitor	CVE-2026-103418No exploit	Universal XSS via the HTML language attribute in Translation Servicesmozilla · firefox for ios · CWE-79 Pre-auth XSS	High8.8	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-109108No exploit	Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injectionwavlink · wl-wn530be1-a · CWE-77 RCE Command injection	High8.6	—	1.6%	Oct 13, 2026
37Monitor	CVE-2026-109109No exploit	Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflowwavlink · wl-wn530be1-a · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.5%	Oct 13, 2026
34Monitor	CVE-2026-101020No exploit	An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +.hammock corporation · assetview · CWE-732 Local privilege escalation	High8.5	—	0.1%	Oct 13, 2026
30Monitor	CVE-2026-108179No exploit	WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerabilitypluginus.net · wolf · CWE-89 SQL injection	High7.6	—	0.2%	Oct 13, 2026
38Monitor	CVE-2026-109110No exploit	Wavlink WL-WN592AX6 wmapd system os command injectionwavlink · wl-wn592ax6 · CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.0%	Oct 13, 2026
30Monitor	CVE-2026-109687No exploit	WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerabilitylink whisper inc · link whisper free · CWE-89 SQL injection	High7.6	—	0.2%	Oct 13, 2026
34Monitor	CVE-2026-13138No exploit	Improper Authorization in Divasoft Software's Biletiva Ticketing Platformdivasoft software and e-commerce inc. · biletiva ticketing platform · CWE-602 Pre-auth	High8.6	—	0.2%	Oct 13, 2026
40Plan	CVE-2026-89309No exploit	Missing Authentication Vulnerability in JTL-WMStbc · tbc · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.3%	Oct 13, 2026
35Monitor	CVE-2026-102073No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · apogee mbc (ppc) (bacnet) · CWE-191 Pre-auth Memory safety	High8.8	—	0.3%	Oct 13, 2026
34Monitor	CVE-2026-102074No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · apogee mbc (ppc) (bacnet) · CWE-121 Pre-auth Memory safety	High8.7	—	0.4%	Oct 13, 2026
34Monitor	CVE-2026-102075No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · apogee mbc (ppc) (bacnet) · CWE-121 Pre-auth Memory safety	High8.7	—	0.4%	Oct 13, 2026
34Monitor	CVE-2026-102076No exploit	A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (siemens · apogee mbc (ppc) (bacnet) · CWE-121 Pre-auth Memory safety	High8.7	—	0.4%	Oct 13, 2026

CVE-2026-109573
36Monitor
phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- SQL injection
thorsten · phpmyfaqOct 12, 2026
CVE-2026-109601
32Monitor
Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
frappe · frappeOct 12, 2026
CVE-2026-109604
34Monitor
ERPNext before 15.112.0 Stored XSS via Tool View Record Names
HighCVSS 8.5No exploitEPSS 0%
- XSS
frappe · erpnextOct 12, 2026
CVE-2026-109608
34Monitor
Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input
HighCVSS 8.7No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109609
28Monitor
Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109610
28Monitor
Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109612
34Monitor
Frappe ERPNext before 15.120.0 Stored XSS via Report View
HighCVSS 8.5No exploitEPSS 0%
- XSS
frappe · erpnextOct 12, 2026
CVE-2026-109613
28Monitor
Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109614
28Monitor
Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109615
28Monitor
Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109616
28Monitor
Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109617
28Monitor
Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109621
28Monitor
Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109624
28Monitor
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109625
28Monitor
Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109626
28Monitor
Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109627
28Monitor
Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109628
28Monitor
Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109631
28Monitor
Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109632
28Monitor
Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109633
34Monitor
Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
frappe · erpnextOct 12, 2026
CVE-2026-109636
28Monitor
Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109637
28Monitor
Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109638
28Monitor
Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109639
28Monitor
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109640
28Monitor
Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109643
28Monitor
Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109644
28Monitor
Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109645
28Monitor
Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109646
28Monitor
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109647
28Monitor
Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109648
28Monitor
Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109649
28Monitor
Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109650
28Monitor
Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109652
34Monitor
Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields
HighCVSS 8.7No exploitEPSS 0%
- RCE
- SSTI
frappe · erpnextOct 12, 2026
CVE-2026-109653
34Monitor
Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
HighCVSS 8.5No exploitEPSS 0%
- XSS
frappe · erpnextOct 12, 2026
CVE-2026-109655
28Monitor
Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109656
28Monitor
Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109658
28Monitor
Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109659
28Monitor
Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109660
28Monitor
Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109661
28Monitor
Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109663
28Monitor
Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-109666
28Monitor
Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109667
34Monitor
Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation
HighCVSS 8.7No exploitEPSS 0%
frappe · erpnextOct 12, 2026
CVE-2026-109671
34Monitor
Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
HighCVSS 8.5No exploitEPSS 0%
- XSS
frappe · erpnextOct 12, 2026
CVE-2026-109672
28Monitor
Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextOct 12, 2026
CVE-2026-109673
34Monitor
Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
HighCVSS 8.5No exploitEPSS 0%
- XSS
frappe · erpnextOct 12, 2026
CVE-2026-109674
28Monitor
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
frappe · erpnextOct 12, 2026
CVE-2026-17475
28Monitor
IBM Planning Analytics Local is affected by security vulnerabilities
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
ibm · planning analyticsOct 12, 2026
CVE-2026-19620
35Monitor
IBM Planning Analytics Local is affected by security vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
ibm · planning analyticsOct 12, 2026
CVE-2026-19622
39Monitor
IBM Planning Analytics Local is affected by security vulnerabilities
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · planning analyticsOct 12, 2026
CVE-2026-19627
32Monitor
IBM Planning Analytics Local is affected by security vulnerabilities
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · planning analyticsOct 12, 2026
CVE-2026-75061
30Monitor
IBM Planning Analytics Local is affected by security vulnerabilities
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · planning analyticsOct 12, 2026
CVE-2026-75095
30Monitor
IBM Aspera Enterprise Webapps Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · aspera enterprise webappsOct 12, 2026
CVE-2026-75782
31Monitor
IBM Aspera Enterprise Webapps Untrusted Search Path
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
ibm · aspera enterprise webappsOct 12, 2026
CVE-2026-82096
35Monitor
DataStage on Cloud Pak for Data Command Injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
ibm · datastage on cloud pak for dataOct 12, 2026
CVE-2026-82101
38Monitor
DataStage on Cloud Pak for Data Path Traversal
CriticalCVSS 9.6No exploitEPSS 0%
- Path traversal
ibm · datastage on cloud pak for dataOct 12, 2026
CVE-2026-82108
35Monitor
DataStage on Cloud Pak for Data Code Injection
HighCVSS 8.8No exploitEPSS 0%
- RCE
ibm · datastage on cloud pak for dataOct 12, 2026
CVE-2026-82110
39Monitor
DataStage on Cloud Pak for Data Path Traversal
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Path traversal
ibm · datastage on cloud pak for dataOct 12, 2026
CVE-2026-84418
29Monitor
DataStage on Cloud Pak for Data Improper Certificate Validation
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
ibm · datastage on cloud pak for dataOct 12, 2026
CVE-2026-85457
32Monitor
IBM Planning Analytics Local is affected by security vulnerabilities
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Memory safety
ibm · planning analyticsOct 12, 2026
CVE-2026-93891
30Monitor
Security Vulnerability identified in IBM TRIRIGA - XXE
HighCVSS 7.6No exploitEPSS 0%
- XXE
ibm · tririga application platformOct 12, 2026
CVE-2026-93892
32Monitor
Security Vulnerability identified in IBM TRIRIGA - Information Disclosure in Admin Console
HighCVSS 8.1No exploitEPSS 0%
- Info leak
ibm · tririga application platformOct 12, 2026
CVE-2026-81858
32Monitor
IBM i is Affected By A Denial of Service Vulnerability in Host Servers
HighCVSS 8.1No exploitEPSS 0%
- Memory safety
ibm · iOct 13, 2026
CVE-2026-96119
39Monitor
IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
ibm · iOct 13, 2026
CVE-2026-58249
30Monitor
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
sap_se · sap netweaver and sap web dispatcher (internet communication manager)Oct 13, 2026
CVE-2026-87689
39Monitor
Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
rapid7 · metasploit frameworkOct 13, 2026
CVE-2026-89107
39Monitor
Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
sap_se · sap s/4hana (manage substitution/validation rules)Oct 13, 2026
CVE-2026-89108
36Monitor
Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
CriticalCVSS 9.1No exploitEPSS 0%
- Broken access control (IDOR)
sap_se · sap manufacturing integration and intelligence (configuration service)Oct 13, 2026
CVE-2026-89110
39Monitor
Broken Access Control in SAP NetWeaver Visual Composer
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
sap_se · sap netweaver visual composerOct 13, 2026
CVE-2026-89111
40Plan
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- SSRF
sap_se · sap cloudOct 13, 2026
CVE-2026-89113
35Monitor
SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
sap_se · sap commerce cloud (ootb code)Oct 13, 2026
CVE-2026-89120
28Monitor
Missing authorization check in SAP ABAP Platform
HighCVSS 7.1No exploitEPSS 0%
sap_se · sap abap platformOct 13, 2026
CVE-2026-14814
32Monitor
Permissive Regular Expression in GitLab
HighCVSS 8.2No exploitEPSS 0%
gitlab · gitlabOct 13, 2026
CVE-2026-16301
34Monitor
Incorrect Authorization in GitLab
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
gitlab · gitlabOct 13, 2026
CVE-2026-35001
28Monitor
OpenS100 S-102 Parser Integer Overflow Heap Buffer Overflow
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Memory safety
opens100 project · opens100Oct 13, 2026
CVE-2026-81839
30Monitor
Incorrect Authorization in GitLab
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
gitlab · gitlabOct 13, 2026
CVE-2026-92883
34Monitor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
gitlab · gitlabOct 13, 2026
CVE-2026-96893
29Monitor
Improper Neutralization of Input Used for LLM Prompting in GitLab
HighCVSS 7.3No exploitEPSS 0%
- RCE
gitlab · gitlabOct 13, 2026
CVE-2026-97229
91Now
Integer Overflow or Wraparound in GitLab
CriticalCVSS 10.0KEVWeaponizedEPSS 69%
- pre-auth RCE
- Memory safety
gitlab · gitlabOct 13, 2026
CVE-2026-109758
37Monitor
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized acc
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
perforce · helix authentication serviceOct 13, 2026
CVE-2026-108971
34Monitor
D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
d-link · dcs-930lOct 13, 2026
CVE-2026-103316
28Monitor
The macOS version of the DigiD app is not signed with Hardened Runtime
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Local privilege escalation
logius · digid for macosOct 13, 2026
CVE-2026-75826
34Monitor
Teltonika Command Injection in Backup function
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
teltonika networks · rutosOct 13, 2026
CVE-2026-102007
28Monitor
Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
bitpressadmin · bit integrations – form integration, webhook, spreadsheets, crm, lms & email automationOct 13, 2026
CVE-2026-102562
28Monitor
AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
acyba · acymailing – an ultimate newsletter plugin and marketing automation solution for wordpressOct 13, 2026
CVE-2026-103418
35Monitor
Universal XSS via the HTML language attribute in Translation Services
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
mozilla · firefox for iosOct 13, 2026
CVE-2026-109108
34Monitor
Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
wavlink · wl-wn530be1-aOct 13, 2026
CVE-2026-109109
37Monitor
Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
wavlink · wl-wn530be1-aOct 13, 2026
CVE-2026-101020
34Monitor
An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +.
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
hammock corporation · assetviewOct 13, 2026
CVE-2026-108179
30Monitor
WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
pluginus.net · wolfOct 13, 2026
CVE-2026-109110
38Monitor
Wavlink WL-WN592AX6 wmapd system os command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
wavlink · wl-wn592ax6Oct 13, 2026
CVE-2026-109687
30Monitor
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
link whisper inc · link whisper freeOct 13, 2026
CVE-2026-13138
34Monitor
Improper Authorization in Divasoft Software's Biletiva Ticketing Platform
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
divasoft software and e-commerce inc. · biletiva ticketing platformOct 13, 2026
CVE-2026-89309
40Plan
Missing Authentication Vulnerability in JTL-WMS
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
tbc · tbcOct 13, 2026
CVE-2026-102073
35Monitor
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
siemens · apogee mbc (ppc) (bacnet)Oct 13, 2026
CVE-2026-102074
34Monitor
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
siemens · apogee mbc (ppc) (bacnet)Oct 13, 2026
CVE-2026-102075
34Monitor
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
siemens · apogee mbc (ppc) (bacnet)Oct 13, 2026
CVE-2026-102076
34Monitor
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
siemens · apogee mbc (ppc) (bacnet)Oct 13, 2026